3TB HD deleted ext4 & formated NTFS Topic is solved

[danblake]

Fiona,

I have attached the log and pasted the ext4 partition found that might be right. When I press P to look at the files it shows / but no files.

P ext4 2048 5860532223 5860530176
EXT4 Large file Sparse superblock Backup superblock, 3000 GB / 2794 GiB

I am willing to write this partition back to see what comes up and then "Afterwards it would be possible to have a superblock diagnose" as you previously suggested.

What do you think?

[Fiona]

Something first;

I think I might have seen a directory when I pressed p.

It's from a previous post.
TestDisk can copy/backup files to another directory.
Just in case if you'd like to safe some data.

You can add your ext4-partition in Quick Search, if you have the values.
Your disk type should be GPT, so that you can write a valid signature to the GUID partition table.
Afterwards you can use the menu Advanced, select your partition and use Superblock to get infos about a backup of the superblock.
You should run fsck as explained here;
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
It's actually ext3 and I'm not as much an Linux tech savvy either, but I asked remy and I already used it in another topic with success.
If you want to go for sure, PM remy and ask him!
After adding a partition and write it, the superblock or boot sector was not recognized anymore.
But a windows boot sector it was possible to get partition back using Backup BS, under Linux you can try fsck like it's described in my link above.

Fiona

[remy]

From linux, try to create a loopdevice :

Code: Select all

sudo losetup -f

to find which loopdevice is the first free. Let's say /dev/loop1.

Then :

Code: Select all

sudo losetup /dev/loop1 -o $offset --seizelimit $sizeofpartition

from the values you've found before, $offset may be 2048*512 or 2046*512. $sizeofpartition should be 5860530176*512

Then try to fsck with "-n" to determine if there's a valid fliesystem (-n ="no change" to avoid writings) :

Code: Select all

sudo e2fsck -n /dev/loop1

If you create a loopdevice, delete it (sudo losetup -d /dev/loop1) before to create another one, or increment loop value (/dev/loop2).

If you have found a valid filesytem, try to mount it in read only :

Code: Select all

mkdir test
sudo mount /dev/loop1 test/ -o ro
ls test/

If you can't recover your files, try to find superblocks with testdisk on this loopdevice :

Code: Select all

sudo testdisk /dev/loop1

and then "Advanced" > "Superblock".

With these superblocks found, you may try to simulate again verification of your filesystem (sudo e2fsck /dev/loop1 -n -b $superblock).

Please give feedback with these solution so I may help you further.

[danblake]

I forgot to post how this worked out.

Remy helped me and was able to recover 100% of the files using the marvelous Linux feature of mounting loopdevices.

Thanks fiona & remy. You helped me recover over 2TB of data.

[remy]

I forgot to post how this worked out.

Remy helped me and was able to recover 100% of the files using the marvelous Linux feature of mounting loopdevices.

Thanks fiona & remy. You helped me recover over 2TB of data.

Thank's for feedback ! I close your thread