Hello, Community! And Merry Christmas!!
Is It possible to do an "undo" in this case after use TestDisk?
Let me give you more details:
I have one NAS WD My Cloud 6TB Gen1 (P/N: WDBCTL0060HWT - 00). Last month I noticed that some folders and files had disappeared like magic. Since then I have been busy reading how to do a data recovery. I thought I knew enough about the TestDisk tool when I realized I had done something wrong by using it to try to repair the disk and ended changing the original partition structure. Before use TestDisk I was able to connect the NAS over the network or using SSH, but after of these changes the NAS is not working. Unfortunatelly (inadvertently) I've overwritten the testdisk.log file with the changes, but I saved some information with the BEFORE/AFTER of the partitions. I hope they are enough for you to be able to help me.
Note: I've used two computers (in different moments) to save the logs, this is the reason for differents TestDisk versions.
==================== BEFORE========================
Before try to fix partitions with TestDisk - Analyse results:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63
Current partition structure:
Partition Start End Size in sectors
1 P Linux Raid 1032192 5031935 3999744 [primary] [md0]
2 P Linux Raid 5031936 9031679 3999744 [primary] [md0]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 30720 1032191 1001472 [primary]
3 P MS Data 30720 1032191 1001472 [primary]
4 P MS Data 9428992 11721043967 11711614976 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 9031680 9226239 194560 [primary]
5 P MS Data 9031680 9226239 194560 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
> 6 P MS Data 9226240 9422847 196608 [primary]
6 P MS Data 9226240 9422847 196608 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
7 P MS Data 9422848 9424895 2048 [primary]
7 P MS Data 9422848 9424895 2048 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
8 P MS Data 9424896 9428991 4096 [primary]
> 8 P MS Data 9424896 9428991 4096 [primary]
P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
Before try to fix partitions with TestDisk - Quick Search results:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63
Partition Start End Size in sectors
>P Linux Swap 30832 30847 16
D MS Data 1032192 5031807 3999616
D Linux Raid 1032192 5031935 3999744 [md0]
D MS Data 5031936 9031551 3999616
D Linux Raid 5031936 9031679 3999744 [md0]
P MS Data 9428992 11721043967 11711614976
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 0, pagesize=8192, 8192 B
==================== AFTER========================
Partition structure after try to recover partitions with TestDisk - Analyse results
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63
Current partition structure:
Partition Start End Size in sectors
1 P Linux Swap 30832 30847 16
2 P MS Data 1032192 5031807 3999616
3 P MS Data 5031936 9031551 3999616
4 P MS Data 9428992 11721043967 11711614976
P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
Partition structure after try to recover partitions with TestDisk - Quick search results
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 5723166 64 32
Partition Start End Size in sectors
>P Linux Swap 30832 30847 16
D Linux filesys. data 1032192 5031807 3999616
D Linux Raid 1032192 5031935 3999744 [md0]
D Linux filesys. data 5031936 9031551 3999616
D Linux Raid 5031936 9031679 3999744 [md0]
P Linux filesys. data 9428992 11721043967 11711614976
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 0, pagesize=8192, 8192 B
Option A results:
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 5723166 64 32
Unknown 1 11721045167 11721045167
>[Sector] [Sector] [ Type ] [ Done ]
Change starting sector
=============================================================================
Thank you for your help in advanced.
Peter
How to revert original partition structure from WD My Cloud Generation 1 (Undo?)
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
How to revert original partition structure from WD My Cloud Generation 1 (Undo?)
Last edited by poliveira on 24 Dec 2022, 18:50, edited 2 times in total.
-
recuperation
- Posts: 2736
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: How to recover original partition structure from WD My Cloud Generation 1 (Undo)
Merry Christmas!
No.
Is It possible to do an "undo" in this case after use TestDisk?
How many disks are located inside this box?Let me give you more details:
I have one NAS WD My Cloud 6TB Gen1 (P/N: WDBCTL0060HWT - 00).
How did you run Testdisk to access the NAS?
Last month I noticed that some folders and files had disappeared like magic. Since then I have been busy reading how to do a data recovery. I thought I knew enough about the TestDisk tool when I realized I had done something wrong by using it to try to repair the disk and ended changing the original partition structure. Before use TestDisk I was able to connect the NAS over the network or using SSH, but after of these changes the NAS is not working. Unfortunatelly (inadvertently) I've overwritten the testdisk.log file with the changes, but I saved some information with the BEFORE/AFTER of the partitions. I hope they are enough for you to be able to help me.
Note: I've used two computers (in different moments) to save the logs, this is the reason for differents TestDisk versions.
You successfully delete your linux RAID partitions. For what reason?==================== BEFORE========================
Before try to fix partitions with TestDisk - Analyse results:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63
Current partition structure:
Partition Start End Size in sectors
1 P Linux Raid 1032192 5031935 3999744 [primary] [md0]
2 P Linux Raid 5031936 9031679 3999744 [primary] [md0]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 30720 1032191 1001472 [primary]
3 P MS Data 30720 1032191 1001472 [primary]
4 P MS Data 9428992 11721043967 11711614976 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 9031680 9226239 194560 [primary]
5 P MS Data 9031680 9226239 194560 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
> 6 P MS Data 9226240 9422847 196608 [primary]
6 P MS Data 9226240 9422847 196608 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
7 P MS Data 9422848 9424895 2048 [primary]
7 P MS Data 9422848 9424895 2048 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
8 P MS Data 9424896 9428991 4096 [primary]
> 8 P MS Data 9424896 9428991 4096 [primary]
P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
Before try to fix partitions with TestDisk - Quick Search results:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63
Partition Start End Size in sectors
>P Linux Swap 30832 30847 16
D MS Data 1032192 5031807 3999616
D Linux Raid 1032192 5031935 3999744 [md0]
D MS Data 5031936 9031551 3999616
D Linux Raid 5031936 9031679 3999744 [md0]
P MS Data 9428992 11721043967 11711614976
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 0, pagesize=8192, 8192 B
==================== AFTER========================
Partition structure after try to recover partitions with TestDisk - Analyse results
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63
Current partition structure:
Partition Start End Size in sectors
1 P Linux Swap 30832 30847 16
2 P MS Data 1032192 5031807 3999616
3 P MS Data 5031936 9031551 3999616
4 P MS Data 9428992 11721043967 11711614976
P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
Anyway, if you have missing files and folders, that is an issue located within a file system caused either by malicious software, unreadable sectors or a logical error in your file system structure. File systems are like containers and a partition table is pointing to their location(s).
There is nothing to fix with your partition table.
There is documentation how to undelete files located here:
https://www.cgsecurity.org/wiki/TestDisk
You can rerun Testdisk and set the partitions whose entries you deleted in the partition table to "primary" and see what that gives.
Re: How to recover original partition structure from WD My Cloud Generation 1 (Undo)
@recuperation Thank you for your prompt reply! Please, see my answers below:
How many disks are located inside this box?
> There is only one (1) disk inside this box. It's a model like this in the picture at https://en.wikipedia.org/wiki/My_Cloud# ... yCloud.png
How did you run Testdisk to access the NAS?
> I took it out from the NAS enclosure and attached it to a laptop using a SATA-USB adapter.
You successfully delete your linux RAID partitions. For what reason?
> I didn't want to delete anything. It was a mistake, maybe due to my desperation. After see the quick search results I changed two of the partitions from "D" to "P" and wrote.
Anyway, if you have missing files and folders, that is an issue located within a file system...
> Before use TestDisk I've run e2fsck to try repair the filesystem, but the files and folders kept missing.
There is documentation how to undelete files located here:
> Before use PhotoRec I've tried extundelete and ext4magic, without success, however I thought I could repair the file system with TestDisk
You can rerun Testdisk and set the partitions whose entries you deleted in the partition table to "primary" and see what that gives.
> I just wanted to restore the previous partition configuration, but I didn't want to make things worse.
How many disks are located inside this box?
> There is only one (1) disk inside this box. It's a model like this in the picture at https://en.wikipedia.org/wiki/My_Cloud# ... yCloud.png
How did you run Testdisk to access the NAS?
> I took it out from the NAS enclosure and attached it to a laptop using a SATA-USB adapter.
You successfully delete your linux RAID partitions. For what reason?
> I didn't want to delete anything. It was a mistake, maybe due to my desperation. After see the quick search results I changed two of the partitions from "D" to "P" and wrote.
Anyway, if you have missing files and folders, that is an issue located within a file system...
> Before use TestDisk I've run e2fsck to try repair the filesystem, but the files and folders kept missing.
There is documentation how to undelete files located here:
> Before use PhotoRec I've tried extundelete and ext4magic, without success, however I thought I could repair the file system with TestDisk
You can rerun Testdisk and set the partitions whose entries you deleted in the partition table to "primary" and see what that gives.
> I just wanted to restore the previous partition configuration, but I didn't want to make things worse.