Cant recover formatted partition, strange freebsd partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
index91
Posts: 1
Joined: 25 Nov 2015, 05:01

Cant recover formatted partition, strange freebsd partition

#1 Post by index91 »

Hello everyone. I've got a problem with a partition and all my data is lost.
I accidently formatted it. The partition has a ext4 filesystem and after that format nothing's been written over, or at least i think so. This happend during a OS installation and fortunately i aborted before the installer start writing data, but unfortunately after or during the format process of that partition.
Since i didn't succeed with testdisk i tryed with photorec, and it started recovering a lot of files, but i realized that it was a mess because the directory structure and the names of the files are simply forgetten, its a mess, its my last choice.
I thought...well, if i can recover with photorec, why not giving another chance to testdisk, and here i am.

I runned testdisk from a Live USB OS and folled the normal procedure:
-Created a new log.
-Selected a hard disk.
-Selected an intel type partition.
-Selected the Analyse option.
-Detected all the partitions correctly
Image
-Did a quick Search
-Selected the partition that matches the one i want.
Image
-This appears.
Image

I realized my testdisk version was old, so i downloaded the last version, thats why the previus screenshots are from a previous version.

-Deep Search and after a while, selected the partition.
Image
-Hit p and shows no content :(
Image
-Other partitions can be recovered, i can even see files from 2013.
Image

-So, i think there must be some problem with that FreeBsd partition that appears at the bottom, it has no sense at all, it has like thousand of terabytes of size. I've never created that partition, dont use that type of filesystems.
Image

What do you think?
Hope you can help me, thank you all.
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Cant recover formatted partition, strange freebsd partit

#2 Post by Fiona »

Looks like that your partition table ist still intact?
http://s15.postimg.org/d0ggre397/Screen ... _39_05.png
At the left side, you can watch which partition is P (primary), * as active and L are your logical partitions.
After Quick and Deeper Search, there is no reason to set an extended partition, because if you have logical partitions, testdisk will recognize it and sets the extended partition at the write display automatically.

Unfortunately after Quick Search, the status of your partitions, are they're primary, active and logical, is not displayed.
Might be possible that you've to select it and set the status using the right or left arrow key on your keyboard.
You can watch it at the left side.
When no partition is set for recovery, at the Write menu you you can get such message:
http://s11.postimg.org/enogrjnkj/Screen ... _41_22.png
After running Deep Search, all partitions appear as deleted:
http://s11.postimg.org/s6zdkh74z/Screen ... _45_42.png
You should select each partition and press p to have a try to list your files.
You must set it as * (Star is primary and active) bootable, P for primary and L for logical.
An example is your current partition structure here:
http://s15.postimg.org/d0ggre397/Screen ... _39_05.png
In your case, your second partition is bootable!
It's important otherwise your computer won't boot.
In TestDisk it's important to write all required partitions into the partition table.
If any required partition is not set for recovery or forgotten, it will be missing after recovery.
Always, the complete number of partitions must be written into the partition table.

Currently it looks like that you already have all partitions in your partition table?
To "Write" your partitions, would only make sense, when TestDisk found your affected partition with all data on it.
After Deeper Search, you should select each partition and press p to have a try to list your files.
Otherwise there is no necessity to write your partition table again.

Somehow your affected partition after Quick- and Deeper Search appears than an ext4-partition but it's empty.
The end and the size of your partition after Quick- and Deeper Search differ slightly from your partition in your partition table-
You can watch the values here:
15553...83...19...38913...70...5
http://s30.postimg.org/jrz7n7bsx/Screen ... _40_58.png
It's the result after Quick and Deeper Search.
The current partition in your partition table (current partition structure) is:
15553...83...19...38913...66..33
http://s15.postimg.org/d0ggre397/Screen ... _39_05.png
Datarecovery software would be a safe solution.
If you'd like to keep file names and folder you can try commercial datarecovery software.
Otherwise you can run TestDisk / Advanced (select your affected partition) and Superblock to have a try to repair your file system using fsck.
Procedure is explained here:
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
I'm not as much a Linux tech savvy but I've seen that it works on ext4-partitions too!

Red listed files are deleted ones.
You can hide them by pressing h for hide.
Pressing h again, they will reappear.
Should only be used if you accidentally deleted any files and you'd like to recover them.
Info here:
http://www.cgsecurity.org/wiki/TestDisk ... e_for_ext2

Fiona
Locked