Filesystem repair after brief accidental erase by Ubuntu

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mattia
Posts: 5
Joined: 27 Sep 2012, 01:02

Filesystem repair after brief accidental erase by Ubuntu

#1 Post by mattia »

Hi here's my current situation:

I have a notebook with dual boot: Win XP and Ubuntu.
I have an external Western Digital 2 TB USB hard disk with two 1-GB partitions: partition "Disco di backup" is a Linux 1 TB partition (where I have a filesystem and .JPG files that I want to recover) and "NTFS" partition is a 1 TB NTFS partition (obviously!!) where I do not have any files that I want to recover.

Partition "Disco di backup" was only visible by Ubuntu and not by Win XP.

At some point I wanted to create a bootable USB device for the new release of Ubuntu on my "NFTS" partition so I launched the Ubuntu "Startup disk creator" which prompted me to "Erase" the disk before installing the new release of Ubuntu. I thought that this command would erase only the "NTFS" partition and I launched it. After about 30 seconds I realized that the command was erasing all hard disk (i.e. both "Disco di backup" and "NTFS" partitions) and I stopped the program. I do not think that in those 30 seconds all my JPG files could be completely erased (they are GB of files).

After that, from Ubuntu I could only see the 2TB ext. USB HD as a single partition and no files (well, some unreadable files were present but they have names made up by symbols).

I launched testdisk and found somehow the "Disco di backup" partition and changed its status from D(eleted) to P(rimary). Now Ubuntu see the ext. USB HD as a 1TB partition but with the same unreadable files (no sign of either the Linux partition filesystem or the lost JPG files).

After that first run of testdisk, I run test disk again and again and here is the log file contents:
*********
Tue Oct 9 15:10:55 2012
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.31-14-generic (#48-Ubuntu SMP Fri Oct 16 14:04:26 UTC 2009)
Compiler: GCC 4.4 - Jun 23 2009 17:11:34
ext2fs lib: 1.41.11, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 156301488 sectors
/dev/sda: user_max 156301488 sectors
/dev/sda: native_max 156301488 sectors
/dev/sda: dco 156301488 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - ATA FUJITSU MHV2080B
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WD Ext HDD 1021

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - WD Ext HDD 1021
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 83
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
No EXT2, JFS, Reiser, cramfs or XFS marker
1 P Linux 0 1 1 121575 254 63 1953118377
1 P Linux 0 1 1 121575 254 63 1953118377
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
FAT32 at 0/1/1
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
FAT differs, FAT sectors=0-16/953398
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB

interface_write()
1 * FAT32 LBA 0 1 1 243200 254 63 3907024002

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
FAT32 at 0/1/1
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
FAT differs, FAT sectors=0-16/953398
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
FAT32 at 0/1/7
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
set_FAT_info: name from BS used

FAT32 at 0/1/7
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT found using backup sector!, 2000 GB / 1863 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/7450, s_mnt_count=5/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244139797
recover_EXT2: part_size 1953118376
Linux 0 1 1 121575 254 62 1953118376 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=4

Results
Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB

interface_write()
1 P Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Need to fix
1 P Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
You will have to reboot for the change to take effect.

TestDisk exited normally.
***********
Now the problem is that after reboot, if I run testdisk again, the Linux partition is always D(eleted) and I go through the above process again and again without change in the status of the Linux partition and without getting to see any JGP lost files. I suppose the filesystem is corrupted, is that correct?
Problem is that I also run PhotoRec but it goes on forever (I let it run for 3 days) but the count of the analyzed cylinders sometimes decreases insted of always increasing so it will never reach the end and it recovered many .jpg files which were in the other (NTFS) partition.

My question: is there a way to restore the structure of the folders in the Linux partition (Disco di backup) and/or then to recover .JPG files from there?

Thanks a lot
Mattia
PS if needed I can attach screenshots of each step of testdisk and also a screenshot of which files I see now in the HD.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Filesystem repair after brief accidental erase by Ubuntu

#2 Post by cgrenier »

Run TestDisk 6.14-WIP

Code: Select all

wget -N http://www.cgsecurity.org/testdisk-6.14-WIP.linux26.tar.bz2
tar xjf testdisk-6.14-WIP.linux26.tar.bz2
cd testdisk-6.14-WIP
sudo ./testdisk_static
In Advanced, select the Linux partition, Superblock and it will tell you wich fsck.ext4 command to use to repair the filesystem.

mattia
Posts: 5
Joined: 27 Sep 2012, 01:02

Re: Filesystem repair after brief accidental erase by Ubuntu

#3 Post by mattia »

Hi
thanks for help.
I followed your instructions but I get a list of 9 superblock with different number but all with same blocksize=4096.
Which one should I choose to repair the filesystem (see attached screenshot)?

Thanks again for support.
Mattia
Attachments
Screenshot.png
Screenshot.png (176.72 KiB) Viewed 7265 times

mattia
Posts: 5
Joined: 27 Sep 2012, 01:02

Re: Filesystem repair after brief accidental erase by Ubuntu

#4 Post by mattia »

Hi
actually I get 10 superblocks: the one not showed in previous screenshot is first superblock 32768 blocksize=4096.
Thanks
Mattia

mattia
Posts: 5
Joined: 27 Sep 2012, 01:02

Re: Filesystem repair after brief accidental erase by Ubuntu

#5 Post by mattia »

Dear Christophe
thank you for your support.
I tried to use the fsck.ext4 command with all 10 backup superblocks but I obtained always the same message (see attached screenshot).
The translation to english of the message written in italian in the screenshot is the following:
************
fsck.ext4: Bad magic number in super-block during the opening of /dev/sdb
/dev/sdb:
the super-block is unreadable, or it does not describe a correct filesystem ext2.
If the device is valid and it really contains a filesystem ext2 (and not swap, ufs or other), then the superblock is corrupted , and you could try to run e2fsck with an alternative superblock:
e2fsck -b 8193 <device>
************
I tried to run e2fsck -b 8193 /dev/sdb but I got the same message as above.

I then run fsck.ext4 with /dev/sdb1 (instead of sdb, because from another application it seemed to me that sdb1 could be the Linux partition) but I got a different message as you can see in the second attachment.

Now if a run testdisk_static I get listed the two corrected partitions (Linux, primary bootable, and NFTS, primary): in the NFTS I can list the files but in the Linux partitions I still get the message that the filesystem might be damaged.

Any suggestion on how to proceed?

If you help me recover my lost file, I will sure donate.
Thanks
Mattia
Attachments
sdb1.jpg
sdb1.jpg (34.39 KiB) Viewed 7239 times
results_of_fsck-ext4.jpg
results_of_fsck-ext4.jpg (40.21 KiB) Viewed 7239 times

mattia
Posts: 5
Joined: 27 Sep 2012, 01:02

Re: Filesystem repair after brief accidental erase by Ubuntu

#6 Post by mattia »

I also run PhotoRec and it recovers about 14000 (fourteen thousand) JPG files but none is of interest to me as they all are very small JPG files (in the order of 10-100 KB, whereas all my pictures were about 4-5 MB each) and they all look like JPG from web pages I visited during Internet browsing. Problem is, the HD from which they are recovered is an external USB disk used only for backup. So how is it possible that PhoteRec recovers those files?
Is it recovering from the correct device?

Thanks
Mattia

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Filesystem repair after brief accidental erase by Ubuntu

#7 Post by cgrenier »

When using fsck, for the device, use /dev/sdb1, the devicename corresponding to the partition, instead of /dev/sdb.

Locked