cgsecurity.org

Hello, Community! And Merry Christmas!!

Is It possible to do an "undo" in this case after use TestDisk?

Let me give you more details:

I have one NAS WD My Cloud 6TB Gen1 (P/N: WDBCTL0060HWT - 00). Last month I noticed that some folders and files had disappeared like magic. Since then I have been busy reading how to do a data recovery. I thought I knew enough about the TestDisk tool when I realized I had done something wrong by using it to try to repair the disk and ended changing the original partition structure. Before use TestDisk I was able to connect the NAS over the network or using SSH, but after of these changes the NAS is not working. Unfortunatelly (inadvertently) I've overwritten the testdisk.log file with the changes, but I saved some information with the BEFORE/AFTER of the partitions. I hope they are enough for you to be able to help me.

Note: I've used two computers (in different moments) to save the logs, this is the reason for differents TestDisk versions.

==================== BEFORE========================

Before try to fix partitions with TestDisk - Analyse results:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63

Current partition structure:

Partition Start End Size in sectors

1 P Linux Raid 1032192 5031935 3999744 [primary] [md0]
2 P Linux Raid 5031936 9031679 3999744 [primary] [md0]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 30720 1032191 1001472 [primary]
3 P MS Data 30720 1032191 1001472 [primary]
4 P MS Data 9428992 11721043967 11711614976 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 9031680 9226239 194560 [primary]
5 P MS Data 9031680 9226239 194560 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
> 6 P MS Data 9226240 9422847 196608 [primary]
6 P MS Data 9226240 9422847 196608 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
7 P MS Data 9422848 9424895 2048 [primary]
7 P MS Data 9422848 9424895 2048 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
8 P MS Data 9424896 9428991 4096 [primary]
> 8 P MS Data 9424896 9428991 4096 [primary]

P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition

Before try to fix partitions with TestDisk - Quick Search results:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63

Partition Start End Size in sectors

>P Linux Swap 30832 30847 16
D MS Data 1032192 5031807 3999616
D Linux Raid 1032192 5031935 3999744 [md0]
D MS Data 5031936 9031551 3999616
D Linux Raid 5031936 9031679 3999744 [md0]
P MS Data 9428992 11721043967 11711614976


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 0, pagesize=8192, 8192 B

==================== AFTER========================

Partition structure after try to recover partitions with TestDisk - Analyse results

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63

Current partition structure:

Partition Start End Size in sectors

1 P Linux Swap 30832 30847 16
2 P MS Data 1032192 5031807 3999616
3 P MS Data 5031936 9031551 3999616
4 P MS Data 9428992 11721043967 11711614976


P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition


Partition structure after try to recover partitions with TestDisk - Quick search results

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 5723166 64 32

Partition Start End Size in sectors

>P Linux Swap 30832 30847 16
D Linux filesys. data 1032192 5031807 3999616
D Linux Raid 1032192 5031935 3999744 [md0]
D Linux filesys. data 5031936 9031551 3999616
D Linux Raid 5031936 9031679 3999744 [md0]
P Linux filesys. data 9428992 11721043967 11711614976


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 0, pagesize=8192, 8192 B

Option A results:

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 5723166 64 32

Unknown 1 11721045167 11721045167


>[Sector] [Sector] [ Type ] [ Done ]


Change starting sector

=============================================================================

Thank you for your help in advanced.

Peter

poliveira wrote: 24 Dec 2022, 01:42 Hello, Community! And Merry Christmas!!

Merry Christmas!

Is It possible to do an "undo" in this case after use TestDisk?

No.

Let me give you more details:

I have one NAS WD My Cloud 6TB Gen1 (P/N: WDBCTL0060HWT - 00).

How many disks are located inside this box?

Last month I noticed that some folders and files had disappeared like magic. Since then I have been busy reading how to do a data recovery. I thought I knew enough about the TestDisk tool when I realized I had done something wrong by using it to try to repair the disk and ended changing the original partition structure. Before use TestDisk I was able to connect the NAS over the network or using SSH, but after of these changes the NAS is not working. Unfortunatelly (inadvertently) I've overwritten the testdisk.log file with the changes, but I saved some information with the BEFORE/AFTER of the partitions. I hope they are enough for you to be able to help me.

Note: I've used two computers (in different moments) to save the logs, this is the reason for differents TestDisk versions.

How did you run Testdisk to access the NAS?

==================== BEFORE========================

Before try to fix partitions with TestDisk - Analyse results:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63

Current partition structure:

Partition Start End Size in sectors

1 P Linux Raid 1032192 5031935 3999744 [primary] [md0]
2 P Linux Raid 5031936 9031679 3999744 [primary] [md0]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 30720 1032191 1001472 [primary]
3 P MS Data 30720 1032191 1001472 [primary]
4 P MS Data 9428992 11721043967 11711614976 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 9031680 9226239 194560 [primary]
5 P MS Data 9031680 9226239 194560 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
> 6 P MS Data 9226240 9422847 196608 [primary]
6 P MS Data 9226240 9422847 196608 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
7 P MS Data 9422848 9424895 2048 [primary]
7 P MS Data 9422848 9424895 2048 [primary]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
8 P MS Data 9424896 9428991 4096 [primary]
> 8 P MS Data 9424896 9428991 4096 [primary]

P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition

Before try to fix partitions with TestDisk - Quick Search results:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63

Partition Start End Size in sectors

>P Linux Swap 30832 30847 16
D MS Data 1032192 5031807 3999616
D Linux Raid 1032192 5031935 3999744 [md0]
D MS Data 5031936 9031551 3999616
D Linux Raid 5031936 9031679 3999744 [md0]
P MS Data 9428992 11721043967 11711614976


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 0, pagesize=8192, 8192 B

==================== AFTER========================

Partition structure after try to recover partitions with TestDisk - Analyse results

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63

Current partition structure:

Partition Start End Size in sectors

1 P Linux Swap 30832 30847 16
2 P MS Data 1032192 5031807 3999616
3 P MS Data 5031936 9031551 3999616
4 P MS Data 9428992 11721043967 11711614976


P=Primary D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition

You successfully delete your linux RAID partitions. For what reason?

Anyway, if you have missing files and folders, that is an issue located within a file system caused either by malicious software, unreadable sectors or a logical error in your file system structure. File systems are like containers and a partition table is pointing to their location(s).
There is nothing to fix with your partition table.

There is documentation how to undelete files located here:
https://www.cgsecurity.org/wiki/TestDisk

You can rerun Testdisk and set the partitions whose entries you deleted in the partition table to "primary" and see what that gives.

@recuperation Thank you for your prompt reply! Please, see my answers below:

How many disks are located inside this box?
> There is only one (1) disk inside this box. It's a model like this in the picture at https://en.wikipedia.org/wiki/My_Cloud# ... yCloud.png

How did you run Testdisk to access the NAS?
> I took it out from the NAS enclosure and attached it to a laptop using a SATA-USB adapter.

You successfully delete your linux RAID partitions. For what reason?
> I didn't want to delete anything. It was a mistake, maybe due to my desperation. After see the quick search results I changed two of the partitions from "D" to "P" and wrote.

Anyway, if you have missing files and folders, that is an issue located within a file system...
> Before use TestDisk I've run e2fsck to try repair the filesystem, but the files and folders kept missing.

There is documentation how to undelete files located here:
> Before use PhotoRec I've tried extundelete and ext4magic, without success, however I thought I could repair the file system with TestDisk

You can rerun Testdisk and set the partitions whose entries you deleted in the partition table to "primary" and see what that gives.
> I just wanted to restore the previous partition configuration, but I didn't want to make things worse.