[SOLVED] Recover Lost Linux Logical Partitions

[3guesses]

OK, well without going into too much detail, I have a laptop with a 320GB SATA drive which I have been using to evaluate a number of Linux distros. Rather foolishly, I used Disk Manager in Windows XP to try to create another logical partition and it completely borked the partition information. I have spent the best part of the last 48 hours trying to rectify the situation using a combination of cfdisk (used to create most of the partitions originally) and testdisk 7.0 but I still have 5 Linux-installed partitions in the middle of the disk missing. I have been using GRUB4DOS to handle booting all of these installations, so I used menu.lst as my reference point for what was installed to which partition - here is a summary:

Code: Select all

sda   Installation
===   ============
 1    BIOS_RVY
 2    System Reserved
 3    Windows XP Pro SP3

 5    Puppy Slacko 5.7
 6    Linux Lite 2.0
 7    Xubuntu 12.04.3
 8    Tiny Core 5.3
 9    antiX 13.2
10    Slackware 14.1
11    Knoppix 7.2.0
12    linux swap
13    Xubuntu 14.04.1
14    Linux Mint 17 Qiano
15    PC Linux OS 2014
16    Vector Linux 7.0
17    Zorin OS 5
18    Fedora 20.1
19    PC Linux OS Installer
20    PC Linux OS 2014
21    Zorin OS 9
22    Puppy 6.0
23    MX-14
24    Xubuntu 14.04.1

I appear to have managed to recover all of these apart from sda14-18 (Linux Mint 17 Qiano, PC Linux OS 2014, Vector Linux 7.0, Zorin OS 5, Fedora 20.1). Here is the output from cfdisk as per the current partition table:

Code: Select all

                                  cfdisk (util-linux 2.21.2)

                                     Disk Drive: /dev/sda
                              Size: 320072933376 bytes, 320.0 GB
                     Heads: 255   Sectors per Track: 63   Cylinders: 38913

    Name         Flags        Part Type    FS Type             [Label]          Size (MB)
 -------------------------------------------------------------------------------------------
                                           Unusable                                  1.05   *
    sda1                       Primary     ntfs                [BIOS_RVY]        10737.42   *
    sda2                       Primary     ntfs            [System Reserved]       104.86   *
    sda3                       Primary     ntfs           [($) ONYX XP Pro ]     10001.95   *
    sda5                       Logical     ext4           [Puppy Slacko 5.7]      5000.98   *
    sda6                       Logical     ext4             [Linux Lite 2.0]      5000.98   *
    sda7                       Logical     ext4            [Xubuntu 12.04.3]      5000.98   *
    sda8                       Logical     ext4              [Tiny Core 5.3]      5000.98   *
    sda9                       Logical     ext4                [antiX 13.2]       5000.98   *
    sda10                      Logical     ext4             [Slackware 14.1]     10001.95   *
                               Logical     Free Space                                1.34   *
    sda11        NC            Logical     reiserfs          [Knoppix 7.2.0]      4194.37   *
                               Logical     Free Space                                1.02   *
    sda12                      Logical     swap                                   1048.61   *
    sda13                      Logical     ext4            [Xubuntu 14.04.1]      8003.20   *
                               Logical     Free Space                                0.01   *
    sda14                      Logical     Linux                                  8003.20
    sda15                      Logical     Linux                                  8003.20
    sda16                      Logical     Linux                                  8003.20
    sda17                      Logical     Linux                                  8003.20
    sda18                      Logical     Linux                                  8003.20
    sda19                      Logical     ext4            [PClos Installer]      8381.57
    sda20                      Logical     ext4           [PC Linux OS 2014]      8381.57
    sda21                      Logical     ext4                [Zorin OS 9]       8003.20
    sda22                      Logical     ext4           [Puppy Slacko 6.0]      1003.49
    sda23                      Logical     ext4           [antiX 14.2-MX PA]      8003.20
    sda24                      Logical     ext4            [Xubuntu 14.04.1]      8003.20
                               Logical     Free Space                           169180.18   *

Note that I have created the sda14-sda18 partitions just so that the installations on the later partitions work.

Here is the output from testdisk 7.0:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P HPFS - NTFS              0  32 33  1305 138 49   20971520
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
 2 P HPFS - NTFS           1305 138 50  1318  74 36     204800
 3 P HPFS - NTFS           1318  74 37  2534  74 36   19535040
 4 E extended LBA          2534  74 37 38912 254 63  584423937
No partition is bootable
 5 L Linux                 2534  75 37  3142  74 36    9767457 [Puppy Slacko 5.7]
   X extended              3142  74 37  3750  74 36    9767520
 6 L Linux                 3142  75 37  3750  74 36    9767457 [Linux Lite 2.0]
   X extended              3750  74 37  4358  74 36    9767520
 7 L Linux                 3750  75 37  4358  74 36    9767457 [Xubuntu 12.04.3]
   X extended              4358  74 37  4966  74 36    9767520
 8 L Linux                 4358  75 37  4966  74 36    9767457 [Tiny Core 5.3]
   X extended              4966  74 37  5574  74 36    9767520
 9 L Linux                 4966  75 37  5574  74 36    9767457 [antiX 13.2]
   X extended              5574  74 37  6790  74 36   19535040
10 L Linux                 5574  75 37  6790  74 36   19534977 [Slackware 14.1]
   X extended              6790 116  1  7300  99 31    8192110
11 L Linux                 6790 117 48  7300  99 31    8192000 [Knoppix 7.2.0]
   X extended              7300 131  1  7427 254 59    2048063
12 L Linux Swap            7300 132  1  7427 254 59    2048000
   X extended              7427 254 60  8400 254 59   15631245
13 L Linux                 7428   0 60  8400 254 59   15631182 [Xubuntu 14.04.1]
   X extended              8401   0  1  9373 254 63   15631245
No ext2, JFS, Reiser, cramfs or XFS marker
14 L Linux                 8401   1  1  9373 254 63   15631182
14 L Linux                 8401   1  1  9373 254 63   15631182
   X extended              9374   0  1 10346 254 63   15631245
No ext2, JFS, Reiser, cramfs or XFS marker
15 L Linux                 9374   1  1 10346 254 63   15631182
15 L Linux                 9374   1  1 10346 254 63   15631182
   X extended             10347   0  1 11319 254 63   15631245
No ext2, JFS, Reiser, cramfs or XFS marker
16 L Linux                10347   1  1 11319 254 63   15631182
16 L Linux                10347   1  1 11319 254 63   15631182
   X extended             11320   0  1 12292 254 63   15631245
No ext2, JFS, Reiser, cramfs or XFS marker
17 L Linux                11320   1  1 12292 254 63   15631182
17 L Linux                11320   1  1 12292 254 63   15631182
   X extended             12293   0  1 13265 254 63   15631245
No ext2, JFS, Reiser, cramfs or XFS marker
18 L Linux                12293   1  1 13265 254 63   15631182
18 L Linux                12293   1  1 13265 254 63   15631182
   X extended             13266   0  1 14284 254 63   16370235
19 L Linux                13266   1  1 14284 254 63   16370172 [PClos Installer]
   X extended             14285   0  1 15303 254 63   16370235
20 L Linux                14285   1  1 15303 254 63   16370172 [PC Linux OS 2014]
   X extended             15304   0  1 16276 254 63   15631245

Note that it doesn't list all of the partitions! (Is this a limitation of testdisk?)

At this point, I should add that I guessed at the sizes of partition sda13-18 - basically, after recovering the other partitions cfdisk said I had 48019.19MB free space between the linux swap (sda12) and the PC Linux OS Installer (sda19) partitions, which - as can be seen - almost exactly equates to 6 x 8000MB partitions created with cfdisk (they get created at 8003.20MB in size). I initially tried creating them contiguously (leaving the remaining 0.01MB free space between sda18 and sda19) but that didn't work, so I tried creating them starting at the end of that free space (as per current configuration) but that hasn't worked either. I should also add that Puppy Slacko 6.0 (at sda22) is the only recovered install which won't boot (complains about a missing "init", Ithink).

I have used testdisk 7.0 (both Quick Search and Deeper Scan) to try to identify these missing sda13-18 partitions but to no avail. I'm now out of ideas so hoping somebody more expert can suggest some new approaches.

Thanks for any help,

3g

[3guesses]

No experts with any suggestions???

I've now used cfdisk to delete all of the partitions between Knoppix 7.2.0 (sda11) and PCLinuxOS Installer (sda19) and then created a single logical partition in that free space which I analysed using R-Studio: it found all of the installed systems in that space with the following results:

Code: Select all

Partition         Offset (sect)   Size (sect)   Start (sect)   End (sect)

HDD vol #11          117280831				
Xubuntu 14.04.1        2050048      15630856      119330879    134961735
Linux Mint 17         17680971      15631176      134961802    150592978
PCLinuxOS 2014        33312216      15631176      150593047    166224223
Vector Linux 7.0      48943461      15631176      166224292    181855468
Zorin OS 5 32bit      64574706      15631176      181855537    197486713
Fedora 20             80205951      15631176      197486782    213117958

It's a shame that R-Studio was able to locate those installations but TestDisk couldn't. Anyway, now I effectively have the information for the remaining missing partitions (expressed in sectors), how do I go about re-creating them? cfdisk asks for partition information in MB, whereas to add a partition in TestDisk you have to specify head/cylinder/sector...

3g

[Fiona]

Sry for late.
If you don't get an answer, you can push your topic or write a PM.
Deleting partitions and creating another one is not helpful.
Datarecovery software reads underlying data, that's why creating and formatting wouldn't be necessary.
TestDisk works Intel standard and displays alignment of partitions by cylinder, heads, sectors.
So only the start and size of a partition displayed by sectors doesn't help as much either.
You can navigate through testdisk by using page up and page down keys and arrow keys.
Did you try it?
As far as I know, there shouldn't be any limit?
You should run Analyse, Quick and Deeper Search.
Especially the results after Quick and Deeper Search are important.
A message like, partitions can't be recovered is only a message when a partition ends after the disk limit and has no significance.
Important are always the results.
If a partition is diplayed twice means, there is either a problem with the boot sector or superblock.
Example:

No ext2, JFS, Reiser, cramfs or XFS marker
18 L Linux 12293 1 1 13265 254 63 15631182 // it's a message about the superblock related to the partition below
18 L Linux 12293 1 1 13265 254 63 15631182

Especially Deeper Search can find partitions by the backup of the boot sector and Superblock.
Can you run a complete diagnose on Analyse / Quick and Deeper Search and copy and paste the content of your testdisk.log into your next post?
Can you try TestDisk 7.1WIP?
I've no idea about your current OS?
It's advisable not to write to your affected disk anymore.

Fiona

[3guesses]

Hi Fiona,

Thanks for taking a look at this. I'll respond to some of the points you raise:

- Deleting and re-creating partitions (in cfdisk) is how I managed to recover half a dozen lost partitions, so it was helpful! It's also non-destructive (as far as data goes), so at the very least it's not harmful.
- I was running TestDisk in a very large window, so there was no need to scroll up and down (it only filled half the screen with the initial partition list).
- I did run Analyse, Quick Search and Deep Search - helped me recover a few more partitions.
- What is TestDisk 7.1WIP?
- I'm running Windows XP SP3

Anyway, I have downloaded and run the free 30-day trial copy of BootIt Bare Metal v1.31d and used the Undelete function there to recover the 6 missing partitions, so my particular problem is now solved albeit 5 days later... Still, I have learnt quite a bit (especially never to use Windows Disk Management to try to create partitions!), but I am still surprised/disappointed that TestDisk couldn't locate/recover those 6 missing partitions.

Cheers,

3g

[3guesses]

BTW, reading another website forum, I might have been able to recover the partitions using the Linux parted command, which might be of use to someone else. For example, to recover the Xubuntu 14.04.1 (sda13) I should have been able to do the following (numbers taken from my second post):

Code: Select all

sudo parted /dev/sda
rescue 119330879 134961735

I haven't tested this, but I might try deleting the partitions again just to try it out

3g