3TB HD deleted ext4 & formated NTFS Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
danblake
Posts: 13
Joined: 28 Apr 2012, 02:15

Re: 3TB HD deleted ext4 & formated NTFS

#21 Post by danblake »

Fiona,

I have attached the log and pasted the ext4 partition found that might be right. When I press P to look at the files it shows / but no files.

P ext4 2048 5860532223 5860530176
EXT4 Large file Sparse superblock Backup superblock, 3000 GB / 2794 GiB

I am willing to write this partition back to see what comes up and then "Afterwards it would be possible to have a superblock diagnose" as you previously suggested.

What do you think?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: 3TB HD deleted ext4 & formated NTFS

#22 Post by Fiona »

Something first;
I think I might have seen a directory when I pressed p.
It's from a previous post.
TestDisk can copy/backup files to another directory.
Just in case if you'd like to safe some data.

You can add your ext4-partition in Quick Search, if you have the values.
Your disk type should be GPT, so that you can write a valid signature to the GUID partition table.
Afterwards you can use the menu Advanced, select your partition and use Superblock to get infos about a backup of the superblock.
You should run fsck as explained here;
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
It's actually ext3 and I'm not as much an Linux tech savvy either, but I asked remy and I already used it in another topic with success.
If you want to go for sure, PM remy and ask him!
After adding a partition and write it, the superblock or boot sector was not recognized anymore.
But a windows boot sector it was possible to get partition back using Backup BS, under Linux you can try fsck like it's described in my link above.

Fiona

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: 3TB HD deleted ext4 & formated NTFS

#23 Post by remy »

From linux, try to create a loopdevice :

Code: Select all

sudo losetup -f
to find which loopdevice is the first free. Let's say /dev/loop1.

Then :

Code: Select all

sudo losetup /dev/loop1 -o $offset --seizelimit $sizeofpartition
from the values you've found before, $offset may be 2048*512 or 2046*512. $sizeofpartition should be 5860530176*512

Then try to fsck with "-n" to determine if there's a valid fliesystem (-n ="no change" to avoid writings) :

Code: Select all

sudo e2fsck -n /dev/loop1
If you create a loopdevice, delete it (sudo losetup -d /dev/loop1) before to create another one, or increment loop value (/dev/loop2).

If you have found a valid filesytem, try to mount it in read only :

Code: Select all

mkdir test
sudo mount /dev/loop1 test/ -o ro
ls test/
If you can't recover your files, try to find superblocks with testdisk on this loopdevice :

Code: Select all

sudo testdisk /dev/loop1
and then "Advanced" > "Superblock".

With these superblocks found, you may try to simulate again verification of your filesystem (sudo e2fsck /dev/loop1 -n -b $superblock).

Please give feedback with these solution so I may help you further.

danblake
Posts: 13
Joined: 28 Apr 2012, 02:15

Re: 3TB HD deleted ext4 & formated NTFS

#24 Post by danblake »

I forgot to post how this worked out.

Remy helped me and was able to recover 100% of the files using the marvelous Linux feature of mounting loopdevices.

Thanks fiona & remy. You helped me recover over 2TB of data.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: 3TB HD deleted ext4 & formated NTFS

#25 Post by remy »

danblake wrote:I forgot to post how this worked out.

Remy helped me and was able to recover 100% of the files using the marvelous Linux feature of mounting loopdevices.

Thanks fiona & remy. You helped me recover over 2TB of data.
:ugeek: Thank's for feedback ! I close your thread ;)

Locked