Disk with extended partition, lost file system, and data - problems and way forward

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Plak
Posts: 2
Joined: 02 Jan 2020, 18:38

Disk with extended partition, lost file system, and data - problems and way forward

#1 Post by Plak »

Hi,

I have a disk on which the last extended partition shows as empty, although I know having had files there. Here's the setup:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Sector size:512
Model: ST1000LM 048-2E7172, FW:8104

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
1 * Linux 0 32 33 60 206 18 974848
ext4 blocksize=1024 Large_file Sparse_SB Recover
2 E extended 60 238 49 121601 57 56 1952544770
5 L Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover
X extended 1305 203 51 2301 208 19 16001024
6 L Linux Swap 1305 236 20 2301 208 19 15998976
SWAP2 version 1, pagesize=4096
X extended 2301 208 20 6103 182 31 61077504
7 L Linux 2301 240 52 6103 182 31 61075456
ext4 blocksize=4096 Large_file Sparse_SB Recover
X extended 6103 182 32 121601 57 56 1855467520
I've tried to follow through testdisk steps, adding an NTFS (07) partition for the last row, but maybe, I've made some mistakes. To be sincere, I'm not so sure, wasn't that an ext4 partition originally.
Anyway, I could get to the step, where the contents would have been saved, but after minor reassuring steps, the disk started to infinitely loop, hitting the heads regularly to extreme position, giving the characteristic noise of re-positioning, or whatsoever. I've tried this several times, and finally decided to just create a log. Everything looks fine according to that, even the top level directories look fine, including the problematic partition.
Thu Jan 2 14:06:46 2020
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.15.0-72-generic (#81~16.04.1-Ubuntu SMP Tue Nov 26 16:34:21 UTC 2019) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM 048-2E7172, FW:8104
Disk /dev/mapper/nvme0n1p3_crypt - 511 GB / 475 GiB - 998160384 sectors, sector size=512
Disk /dev/mapper/ubuntu--vg-root - 476 GB / 444 GiB - 931356672 sectors, sector size=512
Disk /dev/mapper/ubuntu--vg-swap_1 - 34 GB / 31 GiB - 66797568 sectors, sector size=512
Disk /dev/dm-0 - 511 GB / 475 GiB - 998160384 sectors, sector size=512
Disk /dev/dm-1 - 476 GB / 444 GiB - 931356672 sectors, sector size=512
Disk /dev/dm-2 - 34 GB / 31 GiB - 66797568 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - ST1000LM 048-2E7172
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
1 * Linux 0 32 33 60 206 18 974848
ext4 blocksize=1024 Large_file Sparse_SB Recover, 499 MB / 476 MiB
2 E extended 60 238 49 121601 57 56 1952544770
5 L Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 10239 MB / 9765 MiB
X extended 1305 203 51 2301 208 19 16001024
6 L Linux Swap 1305 236 20 2301 208 19 15998976
SWAP2 version 1, pagesize=4096, 8191 MB / 7812 MiB
X extended 2301 208 20 6103 182 31 61077504
7 L Linux 2301 240 52 6103 182 31 61075456
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
X extended 6103 182 32 121601 57 56 1855467520
New options :
Dump : No
Align partition: Yes
Expert mode : No
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
1 * Linux 0 32 33 60 206 18 974848
ext4 blocksize=1024 Large_file Sparse_SB Recover, 499 MB / 476 MiB
2 E extended 60 238 49 121601 57 56 1952544770
5 L Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 10239 MB / 9765 MiB
X extended 1305 203 51 2301 208 19 16001024
6 L Linux Swap 1305 236 20 2301 208 19 15998976
SWAP2 version 1, pagesize=4096, 8191 MB / 7812 MiB
X extended 2301 208 20 6103 182 31 61077504
7 L Linux 2301 240 52 6103 182 31 61075456
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
X extended 6103 182 32 121601 57 56 1855467520

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
1 * Linux 0 32 33 60 206 18 974848
2 E extended 60 238 49 121601 57 56 1952544770
5 L Linux 60 238 51 1305 203 50 19998720
X extended 1305 203 51 2301 208 19 16001024
6 L Linux Swap 1305 236 20 2301 208 19 15998976
X extended 2301 208 20 6103 182 31 61077504
7 L Linux 2301 240 52 6103 182 31 61075456
X extended 6103 182 32 121601 57 56 1855467520

test_logical:
Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63

recover_EXT2: s_block_group_nr=0/59, s_mnt_count=336/4294967295, s_blocks_per_group=8192, s_inodes_per_group=2032
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 487424
recover_EXT2: part_size 974848
Linux 0 32 33 60 206 18 974848
ext4 blocksize=1024 Large_file Sparse_SB Recover, 499 MB / 476 MiB

recover_EXT2: s_block_group_nr=0/76, s_mnt_count=336/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 10239 MB / 9765 MiB
Linux Swap 1305 236 20 2301 208 3 15998960
SWAP2 version 1, pagesize=4096, 8191 MB / 7811 MiB

recover_EXT2: s_block_group_nr=0/232, s_mnt_count=334/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7634432
recover_EXT2: part_size 61075456
Linux 2301 240 52 6103 182 31 61075456
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/7078, s_mnt_count=329/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 231933184
recover_EXT2: part_size 1855465472
Linux 6103 215 1 121601 57 56 1855465472
ext4 blocksize=4096 Large_file Sparse_SB, 949 GB / 884 GiB
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
* Linux 0 32 33 60 206 18 974848
ext4 blocksize=1024 Large_file Sparse_SB Recover, 499 MB / 476 MiB
P Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 10239 MB / 9765 MiB
P Linux Swap 1305 236 20 2301 208 19 15998976
SWAP2 version 1, pagesize=4096, 8191 MB / 7812 MiB
L Linux 2301 240 52 6103 182 31 61075456
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
L Linux 6103 215 1 121601 57 56 1855465472
ext4 blocksize=4096 Large_file Sparse_SB, 949 GB / 884 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 974848 linear /dev/sda 2048" | dmsetup create test0
echo "0 19998720 linear /dev/sda 978944" | dmsetup create test1
echo "0 15998976 linear /dev/sda 20979712" | dmsetup create test2
echo "0 61075456 linear /dev/sda 36980736" | dmsetup create test3
echo "0 1855465472 linear /dev/sda 98058240" | dmsetup create test4
Change partition type:
P Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 10239 MB / 9765 MiB


dir_partition inode=2
P Linux 60 238 51 1305 203 50 19998720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 10239 MB / 9765 MiB
Directory /
2 drwxr-xr-x 0 0 4096 28-Feb-2018 19:52 .
2 drwxr-xr-x 0 0 4096 28-Feb-2018 19:52 ..
11 drwx------ 0 0 16384 19-Mar-2018 21:45 lost+found
390145 drwxr-xr-x 0 0 4096 20-Mar-2018 00:41 cache
130049 drwxr-xr-x 0 0 4096 22-Dec-2018 19:21 backups
260097 drwxrwsrwt 0 117 4096 22-Dec-2018 19:21 crash
130050 drwxr-xr-x 0 0 4096 29-Jul-2018 11:08 lib
260098 drwxrwsr-x 0 50 4096 12-Apr-2016 22:14 local
12 lrwxrwxrwx 0 0 9 19-Mar-2018 21:47 lock
130051 drwxrwxr-x 0 108 4096 22-Dec-2018 22:12 log
260099 drwxrwsr-x 0 8 4096 28-Feb-2018 19:25 mail
13 drwxrwsrwt 0 117 4096 28-Feb-2018 19:38 metrics
130052 drwxr-xr-x 0 0 4096 28-Feb-2018 19:25 opt
14 lrwxrwxrwx 0 0 4 19-Mar-2018 21:47 run
260100 drwxr-xr-x 0 0 4096 19-Mar-2018 22:35 snap
15 drwxr-xr-x 0 0 4096 28-Feb-2018 19:33 spool
16 drwxrwxrwt 0 0 4096 22-Dec-2018 22:12 tmp


dir_partition inode=2
L Linux 2301 240 52 6103 182 31 61075456
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Directory /
2 drwxr-xr-x 0 0 4096 22-Dec-2018 22:25 .
2 drwxr-xr-x 0 0 4096 22-Dec-2018 22:25 ..
11 drwx------ 0 0 16384 19-Mar-2018 21:45 lost+found
131073 drwxrwxr-x 0 0 4096 19-Mar-2018 21:45 boot
524289 drwxr-xr-x 0 0 4096 19-Mar-2018 21:45 home
262145 drwxr-xr-x 0 0 4096 22-Dec-2018 22:06 var
1048577 drwxr-xr-x 0 0 12288 22-Dec-2018 19:21 etc
393217 drwxr-xr-x 0 0 4096 6-Nov-2018 10:52 media
1179649 drwxr-xr-x 0 0 4096 29-Nov-2018 08:16 bin
786433 p--Sr--r-T 37532 47045 3692567382612411757 6-Apr-2080 17:39 dev
1310721 drwxr-xr-x 0 0 4096 19-Mar-2018 23:50 lib
1572865 drwxr-xr-x 0 0 4096 28-Feb-2018 19:26 lib64
655361 drwxr-xr-x 0 0 4096 28-Feb-2018 19:25 mnt
1441793 drwxr-xr-x 0 0 4096 22-Oct-2018 10:41 opt
1703937 p--Sr--r-T 37532 47045 3692567382612411757 6-Apr-2080 17:39 proc
524290 drwx------ 0 0 4096 29-Oct-2018 07:18 root
1179650 drwxr-xr-x 0 0 4096 28-Feb-2018 19:46 run
131074 drwxr-xr-x 0 0 12288 29-Nov-2018 08:16 sbin
1703938 dr-sr---wT 47736 101 2944507980 5-Mar-2055 11:43 snap
786434 dr-sr---wT 47736 101 2944507980 5-Mar-2055 11:43 srv
262146 drwxr-xr-x 0 0 4096 5-Feb-2016 10:48 sys
393218 drwxrwxrwt 0 0 4096 22-Dec-2018 21:46 tmp
655362 drwxr-xr-x 0 0 4096 28-Feb-2018 19:35 usr
17 lrwxrwxrwx 0 0 30 22-Dec-2018 19:20 vmlinuz
15 lrwxrwxrwx 0 0 33 22-Dec-2018 19:20 initrd.img
524294 drwxrwxr-x 0 0 4096 19-Mar-2018 21:47 cdrom
13 -rw------- 0 0 153034752 17-Aug-2018 23:17 core
12 lrwxrwxrwx 0 0 33 22-Dec-2018 19:20 initrd.img.old
16 lrwxrwxrwx 0 0 30 22-Dec-2018 19:20 vmlinuz.old
X 14 -rw------- 0 0 0 22-Dec-2018 22:25 .ismount-test-file
Change partition type:
L Linux 6103 215 1 121601 57 56 1855465472
ext4 blocksize=4096 Large_file Sparse_SB, 949 GB / 884 GiB


dir_partition inode=2
L Linux 6103 215 1 121601 57 56 1855465472
ext4 blocksize=4096 Large_file Sparse_SB, 949 GB / 884 GiB
Directory /
2 drwxr-xr-x 0 0 4096 19-Aug-2018 19:42 .
2 drwxr-xr-x 0 0 4096 19-Aug-2018 19:42 ..
11 drwx------ 0 0 16384 19-Mar-2018 21:45 lost+found
36700161 drwxr-xr-x 1000 1000 4096 8-Dec-2018 17:28 G
17956865 drwxr-xr-x 1001 1001 4096 22-Dec-2018 19:17 M
36569089 drwxr-xr-x 0 0 4096 19-Aug-2018 19:42 m
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
1 * Linux 0 32 33 60 206 18 974848
2 P Linux 60 238 51 1305 203 50 19998720
3 P Linux Swap 1305 236 20 2301 208 19 15998976
4 E extended LBA 2301 208 20 121601 57 56 1916545024
5 L Linux 2301 240 52 6103 182 31 61075456
6 L Linux 6103 215 1 121601 57 56 1855465472

simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 2301/208/20,lba=36978688
write_all_log_i386: CHS: 6103/214/1,lba=98058177

TestDisk exited normally.
[actual user names modified]

Note, that the bold part doesn't quite match what has been discovered in the previous step, and what gparted would show: All but the first partition are extended ones, and what shows here at row 4 should start at 60 238 49 for EBR, and actual partition data starting at 60 238 51. Hopefully, this isn't a disk, but a presentation problem only.

Thinking that I've run to the wall on that branch, I've also tried PhotoRec to recover my files. It provided me with projections of half a year to a century, and 0 files found after hald an hour's run for NTFS/... and Ext/... trials each.

Now, how to go forward:?:

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Disk with extended partition, lost file system, and data - problems and way forward

#2 Post by cgrenier »

After Analyse, Quick Search, choose Write, confirm, Quit and restart your computer.
Does the last partition shows up after that ?

Plak
Posts: 2
Joined: 02 Jan 2020, 18:38

Re: Disk with extended partition, lost file system, and data - problems and way forward

#3 Post by Plak »

I didn't dare so far. But I've found a way to copy interesting parts, by browsing,the directories, using P(rint?) to start with, and later navigating deep into it. At some places, it did work, at others, it didn't.
Probably, I'll give it a try, just to see, how it works, but I've mostly lost confidence of anything relevant still being recoverable there.
Thank you anyway. Will be back with the result, just for the lesson.

Locked