Formated a SSD hard drive by mistake - How to repair file system and the correct boot partition?

[luisccfigueira]

Case description:

In my personal laptop which has 2 PCIe NVME M.2 slots each one with a different 500GB SSD Drive I have a dual boot system with a different O.S. for each Drive (Windows 11 and Kubuntu) using GRUB as a boot loader

When I was creating a persistent installation of PopOS Linux Distro to a USB drive I mistakenly formatted the Linux drive instead of the USB drive. That means that in Gparted I did the following:

1 - Deleted all existing partitions (I don't remember how many (maybe 3))
2 - Created a new partition table of type GPT
3 - Created a partition of 1000MB in FAT32 tagged it as boot (Primary Partition)
4 - Created a partition using the rest of the disk space in ext4 (Primary Partition)
5 - Wrote the changes do disk.
6 - I realized the error (that I had chosen the wrong drive) and rebooted.

Now the system boots to the GRUB command line (instead of list of boot options), and if I type exit it enters the windows system without problem.



My Conclusion:
I Formatted the drive where Linux was installed



My Background:
- I'm studying computer engineering, so I'm familiar with some terms and Ideas used in this area of knowledge and I can use the command line but I don't have working/practice knowledge in this filed of partitioning or repairing drives and on how these tools work (this is a perfect opportunity to learn).



Case Documentation:

1 - log File

Code: Select all

Thu Nov 28 16:21:42 2024
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.8.0-41-generic (#41-Ubuntu SMP PREEMPT_DYNAMIC Fri Aug  2 20:41:06 UTC 2024) x86_64
Compiler: GCC 13.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.4
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop14 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 15 GB / 14 GiB - CHS 14755 64 32, sector size=512 - Kingston DataTraveler 3.0
Disk /dev/sdb - 126 MB / 120 MiB - CHS 1011 4 61 (RO), sector size=512 - IT1165 USB Flash Disk, FW:0.00
Disk /dev/loop0 - 1752 MB / 1671 MiB - 3423344 sectors (RO), sector size=512
Disk /dev/loop1 - 493 MB / 471 MiB - 964624 sectors (RO), sector size=512
Disk /dev/loop10 - 529 MB / 505 MiB - 1034424 sectors (RO), sector size=512
Disk /dev/loop11 - 512 KB / 500 KiB - 1000 sectors (RO), sector size=512
Disk /dev/loop12 - 156 MB / 149 MiB - 306448 sectors (RO), sector size=512
Disk /dev/loop13 - 122 MB / 116 MiB - 239160 sectors (RO), sector size=512
Disk /dev/loop2 - 916 MB / 874 MiB - 1790704 sectors (RO), sector size=512
Disk /dev/loop3 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop4 - 282 MB / 269 MiB - 552488 sectors (RO), sector size=512
Disk /dev/loop5 - 11 MB / 10 MiB - 21952 sectors (RO), sector size=512
Disk /dev/loop6 - 77 MB / 74 MiB - 152112 sectors (RO), sector size=512
Disk /dev/loop7 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop8 - 40 MB / 38 MiB - 79520 sectors (RO), sector size=512
Disk /dev/loop9 - 11 MB / 10 MiB - 21584 sectors (RO), sector size=512
Disk /dev/nvme0n1 - 500 GB / 465 GiB - CHS 476940 64 32, sector size=512
Disk /dev/nvme1n1 - 512 GB / 476 GiB - CHS 488386 64 32, sector size=512

Partition table type (auto): Intel
Disk /dev/nvme0n1 - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/nvme0n1 - 500 GB / 465 GiB - CHS 476940 64 32
Geometry from i386 MBR: head=64 sector=32
FAT32 at 1/0/1
Info: size boot_sector 2097152, partition 2097152
FAT1 : 32-2079
FAT2 : 2080-4127
start_rootdir : 4128 root cluster : 2
Data : 4128-2097151
sectors : 2097152
cluster_size : 8
no_of_cluster : 261628 (2 - 261629)
fat_length 2048 calculated 2044
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
Current partition structure:
 1 * FAT32                    1   0  1  1024  63 32    2097152 [NO NAME]

search_part()
Disk /dev/nvme0n1 - 500 GB / 465 GiB - CHS 476940 64 32
FAT32 at 1/0/1
FAT1 : 32-2079
FAT2 : 2080-4127
start_rootdir : 4128 root cluster : 2
Data : 4128-2097151
sectors : 2097152
cluster_size : 8
no_of_cluster : 261628 (2 - 261629)
fat_length 2048 calculated 2044
set_FAT_info: name from BS used

FAT32 at 1/0/1
FAT: cluster=2(0x2), pos=6176
     FAT32                    1   0  1  1024  63 32    2097152 [NO NAME]
     FAT32, blocksize=4096, 1073 MB / 1024 MiB
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2

Results
   * FAT32                    1   0  1  1024  63 32    2097152 [NO NAME]
     FAT32, blocksize=4096, 1073 MB / 1024 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 2097152 linear /dev/nvme0n1 2048" | dmsetup create test0
SIGHUP detected! TestDisk has been killed.

2 - testdisk version 7.1

3 - Operating system booted when error occurred: Linux Kubuntu

4 - I am using a live Ubuntu from a USB stick on the machine with the broken drive

5 - Corrupted drive Technology: SSD

6 - Corrupted drive Size: 500GB

7 - Corrupted drive Maker: Western Digital

8 - Corrupted drive Model: WD_BLACK SN750 SE 500GB

9 - Corrupted drive Name: nvme1n1

10 - Corrupted drive connection to PC: Motherboard NVME M.2 Slot

11 - Corrupted drive visible in O.S? - Yes ($ lsblk bellow):

Code: Select all

ubuntu@ubuntu:~$ lsblk
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
loop0         7:0    0   1.6G  1 loop /rofs
loop1         7:1    0   471M  1 loop 
loop2         7:2    0 874.4M  1 loop 
loop3         7:3    0     4K  1 loop /snap/bare/5
loop4         7:4    0 269.8M  1 loop /snap/firefox/4793
loop5         7:5    0  10.7M  1 loop /snap/firmware-updater/127
loop6         7:6    0  74.3M  1 loop /snap/core22/1564
loop7         7:7    0  91.7M  1 loop /snap/gtk-common-themes/1535
loop8         7:8    0  38.8M  1 loop /snap/snapd/21759
loop9         7:9    0  10.5M  1 loop /snap/snap-store/1173
loop10        7:10   0 505.1M  1 loop /snap/gnome-42-2204/176
loop11        7:11   0   500K  1 loop /snap/snapd-desktop-integration/178
loop12        7:12   0 149.6M  1 loop /snap/thunderbird/507
loop13        7:13   0 116.8M  1 loop /snap/ubuntu-desktop-bootstrap/237
sda           8:0    1  14.4G  0 disk 
├─sda1        8:1    1   6.4G  0 part /cdrom
└─sda2        8:2    1     8G  0 part 
sdc           8:32   0   1.4T  0 disk 
└─sdc1        8:33   0   1.4T  0 part /media/ubuntu/Backup Casa
sdd           8:48   1 120.5M  1 disk 
└─sdd1        8:49   1 120.5M  1 part 
nvme1n1     259:0    0 476.9G  0 disk 
├─nvme1n1p1 259:2    0   260M  0 part 
├─nvme1n1p2 259:3    0    16M  0 part 
├─nvme1n1p3 259:4    0 454.7G  0 part 
├─nvme1n1p4 259:5    0     1G  0 part 
├─nvme1n1p5 259:6    0    20G  0 part 
└─nvme1n1p6 259:8    0     1G  0 part 
nvme0n1     259:7    0 465.8G  0 disk 
└─nvme0n1p1 259:9    0     1G  0 part 

12 - What was the partitioning scheme used on the failed drive: Don't know

13 - How many partitions size and file system were there on the corrupted drive: Don't know

14 - Is the partition scheme containing your partitions still visible: No

15 - Is your disk showing signs of failures: No

16 - Do you use encryption: No



My attempt to restore the system:

1 - Followed the step by step Guide with the following results

Analize:


Deepsearch





















My approach / understanding of the restoration process:

1 - FAT32 partitions correspond to the previous and new boot partitions
2 - The firsts and last Linux partitions on the list might be corrupted because are duplicates and with damaged file system therefore should be repaired
3 - The second Linux partition is visible and correct and I should write it to the drive.
2 - I need to specify the partitions to write to disk:
- One from these two: FAT32 or FAT32 LBA
- The Linux Partition that has files accessible
- One of the remaining Linux partitions



Questions:

1 - What should I do first?
- Try to recover the file system of the partitions that might be damaged;
- Try try to recover the correct boot partition?
2 - Does anyone knows which of the boot patrtitions (FAT32 or FAT32 LBA) is my old (correct) so that i can mark the other D(delete) to rewrite it?
3 - Repairing the filesystem on the partitions that might be damaged is achieved just by running the command fsck -y /dev/nvme0n1 (in my case)?
5 - What should I mark the Linux partitions to write? Primary or Logical?
4 - Am I wrong on the approach / understanding that I'm following?

[recuperation]

Sorry, I neither support general file system "repair" nor manually repairing complex modern dual boot configurations.
When using a software, use the most recent one such as TestDisk 7.2 or the most recent beta version.

When using the forum function to link images, link images - not web pages!
Any image link ends with the name of the image linked but you should upload your images to this website anyway.

Read here:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

If YOU do not know how your disk was partition before, how will you judge the findings of TestDisk?
Finding a partition is not enough, you have to look inside using the "list files" function which is only available if the partition typ is supported for reading out directory structures and dammages are limited to an extent that TestDisk can heel (repair).

If that fails, use commercial software and if commercial software fails, use the mean of last defense for data recovery, PhotoRec.

If "list files" succeeds, you can have your linux run a file check after either cloning your logically broken disk as described in the manual or after rescuing folders and files using the "list files" function.
For boot repair use your linux installation media.

4 - Created a partition using the rest of the disk space in ext4 (Primary Partition)

That is detrimental. For my knowledge the ext-family of file systems requires writing block groups (metadata) all over the space. That overwritten information is not retrievable.

- The firsts and last Linux partitions on the list might be corrupted because are duplicates and with damaged file system therefore should be repaired

That sentence is totally incomprehensible to me. Please make an effort to write in a understandable way.

[luisccfigueira]

Hi @recuperation. Thanks for the reply!

Sorry, I neither support general file system "repair" nor manually repairing complex modern dual boot configurations.

You don' t have to be sorry, I never expected that you supported all of that.

When using a software, use the most recent one such as TestDisk 7.2 or the most recent beta version.

I followed the TestDisk Documentation (Release 7.2 - May 09, 2024) installation instructions for the Distribution I'm using (Ubuntu):

Code: Select all

apt update
apt install testdisk

If you had read the documentation you had known that in page 11 it states that:

Building the source code is usually reserved to
• developers wanting to add new features
• packagers wanting to create archive/package to distribute
• users who are using a platform for which no ready to use binaries are available

If you had read my post carefully you would know that none of those cases apply to me and therefore the version that I should use is the one made available by the Linux distribution I'm using.

When using the forum function to link images, link images - not web pages!

When I wrote the post the "Attachments" tab was not available, maybe because it wasn't enabled by a board administrator, since I wanted to give as much information about my case in the most clear possible way I tried my best to embed an image in the post without uploading to the forum, but unfortunately without success. If you had read the following page app.php/help/bbcode#f5r1 you could have read that:

...if the attachments functionality has been enabled by a board administrator and if you are given the appropriate permissions to create attachments.

Now that I have access to the "Attachments" tab I can only attach 3 files but I want to link 11 images. This is a forum limitation.

Finding a partition is not enough, you have to look inside using the "list files" function which is only available if the partition typ is supported for reading out directory structures and dammages are limited to an extent that TestDisk can heel (repair).

That sentence is totally incomprehensible to me. Please make an effort to write in a understandable way. What is typ? What is dammages? TestDisk can "heel", what does that mean?