Gparted crash while moving/expanding ext3 ext partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pins
Posts: 4
Joined: 31 Jan 2013, 02:34

Gparted crash while moving/expanding ext3 ext partition

#1 Post by pins »

Hi All

I have an ext3 file system in an extended partition /dev/sdb5

I reduced another partition to extend and move /dev/sdb5 to the left.

The extend/move was being done from a Mint Live CD.

During the extend/move gparted crashed and the partition now shows as fully extended into the space and shows as a linux partition, however it is now showing with no filesystem (no I didn't back it up, yes I am an idiot).

I'm currently running testdisk across the drive to see if I can detect then recover the existing superblocks.

I have a couple of questions.

1. When gparted is doing an extend/move I think it does a sector by sector copy?

2. As I'm not sure at what point gparted crashed (It could have been before the data was being copied or during) I'm trying to get my head around where I might be.....

If the data copy hadn't started and we were still doing the extend does it just write the new start sector to the extended partition marker and the actual partition, this seems to have been successful as the partition is the new bigger size.

How do I tell the OS that the partition should be ext3?

If the data copy has started I could be in the horrible situation of half the data moved to the left correctly and half the data hanging in the middle of the new partition, as most of the examples here are talking about windows and ntfs partitions how do I go about merging my data back together?

Thanks in advance.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Gparted crash while moving/expanding ext3 ext partition

#2 Post by Fiona »

If testdisk displays your data, you can copy/backup them to another intact partition/disk.
At the bottom of the screen, you'll find the commands.
TestDisk displays ext2/3/4-partitions as linux-partitions.
To determine what kind of partition testdisk found, you can have a look at the bottom of the screen.
You'll find information related to your superblock and what kind of ext2/3/4 partition.
If your partition table still contain your linux partition, you can use the menu advanced/superblock to use the provided info to have a try to recover your superblock using the backup of a superblock.
Info related to superblock repair here;
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
Partition must be in your partition table, otherwise a superblock diagnose is not possible, because you can't choose it in the menu advanced.
To get it back in your partition table, you can use Quick and Deeper Search and if your partition is found, to write it to your partition table using the menu Write.

Fiona

pins
Posts: 4
Joined: 31 Jan 2013, 02:34

Re: Gparted crash while moving/expanding ext3 ext partition

#3 Post by pins »

Morning Fiona

Thanks for the response.....

Here is the testdisk.log with non relevent data removed

Thu Jan 31 05:05:46 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.0-17-generic (#28-Ubuntu SMP Tue Oct 9 19:31:23 UTC 2012) x86_64
Compiler: GCC 4.7
Compilation date: 2012-10-01T13:00:04
ext2fs lib: 1.42.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 1465149168 sectors
/dev/sdb: user_max 1465149168 sectors
/dev/sdb: native_max 1465149168 sectors
/dev/sdb: dco 1465149168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - WDC WD7500KEVT-00A28T0, S/N:WD-WX80A79M8238, FW:01.01A01

Partition table type (auto): Intel
Disk /dev/sdb - 750 GB / 698 GiB - WDC WD7500KEVT-00A28T0
Partition table type: Intel

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 83
Current partition structure:
1 * HPFS - NTFS 0 32 33 5736 209 41 92160000 [System Reserved]
2 E extended 10353 247 7 91201 20 19 1298808832
3 P Linux 5736 209 42 5858 112 14 1953792
4 P Linux 5858 112 15 10353 247 6 72220672
No ext2, JFS, Reiser, cramfs or XFS marker
5 L Linux 10354 24 39 90372 146 14 1285496832
5 L Linux 10354 24 39 90372 146 14 1285496832

After doing a standard Quick Search here's what I have onscreen

Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Partition Start End Size in sectors
* HPFS - NTFS 0 32 33 5736 209 41 92160000 [System Reserved]
P Linux 5736 209 42 5858 112 14 1953792
P Linux 5858 112 15 10353 246 61 72220664
>L Linux 15274 3 26 34322 229 19 306020352
L Linux Swap 90372 178 47 91201 52 35 13309936

It looks to me like the two are showing differnt partition values?

Ideas?

pins
Posts: 4
Joined: 31 Jan 2013, 02:34

Re: Gparted crash while moving/expanding ext3 ext partition

#4 Post by pins »

Anyone?

pins
Posts: 4
Joined: 31 Jan 2013, 02:34

Re: Gparted crash while moving/expanding ext3 ext partition

#5 Post by pins »

Well after doing the deeper search.....

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Partition Start End Size in sectors
D HPFS - NTFS 0 32 33 5736 209 41 92160000 [System Reserved]
D Linux 5112 40 49 5239 163 44 2048000
D Linux 5736 209 40 5858 112 12 1953792
D Linux 5736 209 42 5858 112 14 1953792
D Linux 5858 112 15 10353 246 61 72220664
D Linux 6386 185 8 10882 64 54 72220664
D Linux 6386 217 40 10882 97 23 72220664
D Linux 6388 32 45 10883 167 28 72220664
D Linux 6388 65 14 10883 199 60 72220664
D Linux 6391 47 57 10886 182 40 72220664
D Linux 6391 80 26 10886 215 9 72220664
D Linux 6394 63 6 10889 197 52 72220664
D Linux 6395 35 41 10890 170 24 72220664
D Linux 6396 170 47 10892 50 30 72220664
D Linux 6418 249 40 10914 129 23 72220664
D Linux 6420 32 13 10915 166 59 72220664
D Linux 6421 37 17 10916 171 63 72220664
D Linux 15274 3 26 34322 229 19 306020352
D Linux 15275 40 62 34324 11 55 306020352
D Linux 15275 138 32 34324 109 25 306020352
D Linux 15278 218 45 34327 189 38 306020352
D Linux 15280 33 50 34329 4 43 306020352
D Linux 15285 124 8 34334 95 1 306020352
D Linux 15285 221 41 34334 192 34 306020352
D HPFS - NTFS 20537 126 21 25636 198 34 81919985
>D Linux 24907 115 41 90372 146 14 1051697152 [Share500GB]<--- This looks like the missing/broken one.
D Linux LVM 25636 231 4 91201 52 51 1053290496
D Linux 28795 167 45 57514 210 40 461373440
D Linux 28796 205 18 57515 248 13 461373440
D Linux Swap 90372 178 47 91201 52 35 13309936

The directory structure looks like it's intact.....

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Linux 24907 115 41 90372 146 14 1051697152 [Share500GB]
Directory /

>drwxrwxr-x 0 1000 4096 30-Jan-2013 16:33 .
drwxrwxr-x 0 1000 4096 30-Jan-2013 16:33 ..
drwxrwxr-x 0 1000 16384 29-Jan-2013 22:22 lost+found
drwxrwxr-x 0 1000 4096 30-Jan-2013 16:46 backups
drwx------ 1000 1000 4096 30-Jan-2013 05:28 .Trash-1000
drwxrwxr-x 0 1000 4096 30-Jan-2013 03:41 Media
drwxrwxrwt 1000 1000 4096 30-Jan-2013 16:33 untitled folder
drwxrwxrwt 1000 1000 4096 30-Jan-2013 16:33 VMs

And the files within look like they're still there....

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Linux 24907 115 41 90372 146 14 1051697152 [Share500GB]
Directory /Media/TV/Two Guys and a Girl/Season 1

>drwxrwxr-x 0 1000 4096 30-Jan-2013 10:08 .
drwxrwxr-x 0 1000 4096 30-Jan-2013 09:41 ..
-rwxrwxr-x 0 1000 183447552 30-Jan-2013 09:47 Two Guys and a Girl.S01E03.Two Guys a Girl and
-rwxrwxr-x 0 1000 183457792 30-Jan-2013 09:43 Two Guys and a Girl.S01E01.Two Guys a Girl and
-rwxrwxr-x 0 1000 183439360 30-Jan-2013 09:45 Two Guys and a Girl.S01E02.Two Guys a Girl and
-rwxrwxr-x 0 1000 183459840 30-Jan-2013 10:02 Two Guys and a Girl.S01E10.Two Guys a Girl and
-rwxrwxr-x 0 1000 183457792 30-Jan-2013 09:49 Two Guys and a Girl.S01E04.Two Guys a Girl and
-rwxrwxr-x 0 1000 183453696 30-Jan-2013 09:51 Two Guys and a Girl.S01E05.Two Guys a Girl and
-rwxrwxr-x 0 1000 183465984 30-Jan-2013 09:54 Two Guys and a Girl.S01E06.Two Guys a Girl and
-rwxrwxr-x 0 1000 183451648 30-Jan-2013 09:56 Two Guys and a Girl.S01E07.Two Guys a Girl and
-rwxrwxr-x 0 1000 183443456 30-Jan-2013 09:58 Two Guys and a Girl.S01E08.Two Guys a Girl and
-rwxrwxr-x 0 1000 183449600 30-Jan-2013 10:00 Two Guys and a Girl.S01E09.Two Guys a Girl and
-rwxrwxr-x 0 1000 183459840 30-Jan-2013 10:06 Two Guys and a Girl.S01E12.Two Guys a Girl and
-rwxrwxr-x 0 1000 183455744 30-Jan-2013 10:04 Two Guys and a Girl.S01E11.Two Guys a Girl and
-rwxrwxr-x 0 1000 183463936 30-Jan-2013 10:08 .Two Guys and a Girl.S01E13.Two Guys a Girl an
-rwxrwxr-x 0 1000 183463936 30-Jan-2013 10:08 Two Guys and a Girl.S01E13.Two Guys a Girl and

So my questions are.......

1. Why does the file partition look like it's bigger then the immediately following partition?

2. I haven't written anything down to this disk yet, based on the information above how likely is it that the data is still intact and recoverable?

3. I realise that the best way to do the recovery is dd copy everything to another drive, if I've read the above correctly I want to copy from 24907 to 90372?

Thanks in advance.

Locked