"Corrupted" Partition after Disk changes (resize and partition table change)

[Opa114]

Hello,

i have a problem since i have done some changes to my disk.
Originally it was a Almalinux 9 system with lvm volume. Because of needed storage space a tried to expand the disk size and the lvm volume. At this point the disk was greater than 2 TB, and so i heared i should use GPT instead of MBR as partition table and so i tried to change it with gdisk. That worked but after a reboot the system did not boot. I think it's aproblem with the bootloader / grub. So i booted up the system with the systemrescuecd and run testdisk to recover / restore the things but with only a little success and before i damage the things more i need some help.

So i could recover one part of the partition/ lvm volume (dev/almalinux/home) but that is not all. in gparted i see 1.5 TB as unallocated space.
testfind find 2 more partitions marked as deleted (see screenshots). How can i get these back or better my data on it? If possible, i do not want to loose my data and so i did not write back the partition data of the 2 other found partitions.

Attached you can see the output from testdisk.

[recuperation]

Hello,

i have a problem since i have done some changes to my disk.
Originally it was a Almalinux 9 system with lvm volume. Because of needed storage space a tried to expand the disk size

There is no way you can expand a physical disk device. Surprisingly your documentation does not show any physical device.

and the lvm volume. At this point the disk was greater than 2 TB, and so i heared i should use GPT instead of MBR as partition table and so i tried to change it with gdisk. That worked but after a reboot the system did not boot. I think it's aproblem with the bootloader / grub. So i booted up the system with the systemrescuecd and run testdisk to recover / restore the things but with only a little success and before i damage the things more i need some help.

I have no idea what you did.

So i could recover one part of the partition/ lvm volume (dev/almalinux/home) but that is not all. in gparted i see 1.5 TB as unallocated space.

I don't know if that plays a role once you are not using your devices directly but are using lvm to manage disk space.

testfind find 2 more partitions marked as deleted (see screenshots). How can i get these back or better my data on it? If possible, i do not want to loose my data and so i did not write back the partition data of the 2 other found partitions.

Check each partition found for readable content and copy the possible content to a safe location far away from your problem area:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Everything is virtualized in your example. No physical device is visible. That is making things complicated because the structure of your storage is not disclosed - no picture or drawing that outlines the relationship between volumes and their physical resources.
Furthermore you added LVM as an additional mean of complexity.

Please upload your pictures to this site using the attachments tab on the bottom of the page.

[Opa114]

I can only attach 3 Screenshots per post, so here the other three. And sorry - can't change the right order?! so 1 til 6 is the correct order.

No i don't expand the physical drive, but my virtual drive at virtual machine layer and then inside the vm with some lvexpand etc stuff.
and then i got somehwere the message that more than 3TB are not supported or usable with mbr so i googled and read that i can convert the mbr partition to gpt without data los. so i used gdisk and converted the mbr to gpt. Then the whole vm did not boot again.

As wrote above i booted from systemresscue live cd an brought back a partition which holds the swap and home lv. but the rest is missing
And yes i can see the two deleted partitions. but i don't want to write the partition table back, because of possible data loss - don't know if i override it and lose whole data.

I checked the partitions for readable conten, but on the first of the two i don't have the option to list files (see screenshots) and on the second of the two i can, but got the message: can't open filesystem. Filesystem seems damaged.

so yes, i can write the disk data with ddrescue or something like that on another storage, but the question is, is there useable data on my now unallocated space or not?
Or can i write back the partition table on the two lost partitions without any futher corruption?

[recuperation]

No i don't expand the physical drive, but my virtual drive at virtual machine layer and then inside the vm with some lvexpand etc stuff.

Sorry, this not a case description. It seems that you are running a virtualization software, VMWare, inside a LVM environment on a virtual machine. This is the most complicated case I have seen until now.
You have applied TestDisk on some level in this abstraction pyramid and expect TestDisk to cure what you did wrong in LVM. Breaking things in LVM does not necessarily break a partition table. The deleted partitions in TestDisk do not mean anything unless you prove that in a traceable manner.

If you fear overwriting something valuable writing a partition table, backup the disk where the table resides upon.