SD Card Ext4 partition disappeared

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bigtorque
Posts: 2
Joined: 14 Nov 2023, 00:50

SD Card Ext4 partition disappeared

#1 Post by bigtorque »

Hello,

I am using a steam deck running steam OS (which is essentially arch linux) with system files on an internal SSD and most of my data such as games and saves on an SD card.

The SD card is a Samsung 512 Evo Select and until yesterday, it had a single Ext4 partition with games, saves and such on it. Nothing very important but it would still hurt to lose.

Yesterday I turned off my pc after playing some games that are installed on the SD card, then turned it back on a while later.

Except the card wasn't being detected by steam or appearing in file manager anymore, after checking partition manager this is what showed up.

Image
And here's some possibly useful info :

Image
Image
This happened some months ago on another SD card, also on this computer, and I'd fixed it by running fsck with a backup superblock. By following the instructions of this article : https://linuxexpresso.wordpress.com/201 ... in-ubuntu/.

So I tried to do that again, these are the commands I ran with the outputs :

Image
This is only the first two backup superblocks, but I tried every single one and the first half all gave the same "bad magic number in super-block", while the second half all said this :

Image

No idea why, but it doesn't help, so that's when I tried testdisk.

I first did a quick search which found an ext4 partition with the right size, so I thought that was that, made it the primary and pressed write, then rebooted my pc.

But nothing changed, sadly I don't have the log from that first time I used it, but when I run testdisk again, it gives me the same output as back then, so here it is (without pressing write of course) :

Code: Select all

Mon Nov 13 20:10:52 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.13.0-valve37-1-neptune (#1 SMP PREEMPT Thu, 17 Aug 2023 23:47:04 +0000) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/mmcblk0 - 512 GB / 477 GiB - CHS 15646720 4 16, sector size=512
Disk /dev/nvme0n1 - 61 GB / 57 GiB - CHS 58999 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/mmcblk0 - 512 GB / 477 GiB
Partition table type: EFI GPT

Analyse Disk /dev/mmcblk0 - 512 GB / 477 GiB - CHS 15646720 4 16
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1001390079 (expected 1001390079)
hdr_lba_start=34
hdr_lba_end=1001390046
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P Linux filesys. data         2046 1001388029 1001385984

search_part()
Disk /dev/mmcblk0 - 512 GB / 477 GiB - CHS 15646720 4 16

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/3819, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 125173248
recover_EXT2: part_size 1001385984
Filesystem created: Fri Aug  4 08:27:00 2023
     Linux filesys. data         2046 1001388029 1001385984
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 512 GB / 477 GiB

Results
   P Linux filesys. data         2046 1001388029 1001385984
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 512 GB / 477 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1001385984 linear /dev/mmcblk0 2046" | dmsetup create test0

interface_write()
 1 P Linux filesys. data         2046 1001388029 1001385984
simulate write!

TestDisk exited normally.
I also tried to check the backup superblocks which showed nothing, here's the log :

Code: Select all


Mon Nov 13 21:11:24 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.13.0-valve37-1-neptune (#1 SMP PREEMPT Thu, 17 Aug 2023 23:47:04 +0000) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/mmcblk0 - 512 GB / 477 GiB - CHS 15646720 4 16, sector size=512
Disk /dev/nvme0n1 - 61 GB / 57 GiB - CHS 58999 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/mmcblk0 - 512 GB / 477 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1001390079 (expected 1001390079)
hdr_lba_start=34
hdr_lba_end=1001390046
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P Linux filesys. data         2046 1001388029 1001385984
gpt_change_part_type
Change partition type:
 1 P Linux filesys. data         2046 1001388029 1001385984
Change partition type:
 1 P ext4                        2046 1001388029 1001385984
search_superblock

TestDisk exited normally.
So then I tried doing a deeper search (took about 2 hours I think), which found a lot of stuff. Hundreds (maybe thousands, I've no idea) of partitions that are all almost the same showed up.

I can't post the log here because it's 82 thousand lines long, so here's a google drive link for it, if it would be more convenient somewhere else do let me know : https://drive.google.com/file/d/16KMY2L ... rive_link/

After looking through the log myself, I did find something I think is interesting. Starting at line 622, it seems to be listing off the partitions, which say they were created on the 4th of august.

That's around when I got this SD card so it's probably my lost partition, but what I find weird is it keeps listing it off with different last mount dates and times, that go from when my partition broke, November 12th, to when I got it, August 4th.

And not only that, but they're apparently after the disk limits. I have no idea what any of this could mean, is this at all usual and is there anything else to try to recover my partition ?

It also showed me an efi, mac hfs and some cramfs partitions, and those I could recover, but they seem to have the same issue where they're the same, simply offset a little.

I also have no idea what they are, and the cramfs all have the same messed up name with a bunch of symbols.

There were only 2 "real" partitions I had the choice to recover at that point, the same one as with the quick search, and another that seemed to have the same issue as the rest where it has the same characteristics but is offset.

I've thought of trying photorec at this point, but since it's mostly games and saves on it, I don't imagine the result would be very useful.

Thanks in advance for any tips anyone might have.

Also you might have broken your forum permissions ? It's written to use attachments and post images on-site but I can't, unless we're just meant to embed them like I did :

Image
User avatar
cgrenier
Site Admin
Posts: 5441
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: SD Card Ext4 partition disappeared

#2 Post by cgrenier »

What is the result after "fsck.ext4 /dev/mmcblk0p1" ?
bigtorque
Posts: 2
Joined: 14 Nov 2023, 00:50

Re: SD Card Ext4 partition disappeared

#3 Post by bigtorque »

This is what I get :
Image
recuperation
Posts: 3026
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: SD Card Ext4 partition disappeared

#4 Post by recuperation »

Sorry, I am not familiar with the extX-family of file systems.
Some commercial solutions support the ext4 partition format, though.
Locked