cgsecurity.org

Posted: **01 Sep 2019, 02:21**

Hello all and thank you in advance for reading this,

[Short version]
The single partition on my 3TB drive disappeared.
I used Testdisk which found it, I thought I wrote out the partition correctly, but after restart, I have about 8 new partitions of varying sizes, none of them have my data and none of them have the name of the original partition which Testdisk found.
Can this be fixed?

[Full story]
Four drives are in my system:
sda - 540GB SSD - Bootable Linux Mint
sdb - 240GB SSD - Bootable Windows 10
sdc - 3TB HDD - Personal data (about 900GB used)
sdd - 1TB portable USB HDD (I was going to use this as a backup)

In Linux Mint, I used parted to partition sdd (the USB). I then created an ext4 file system on it with makefs.
I didn't think I did anything wrong but obviously I broke something.

I continued using my linux system for a few hours with no issues; sda and sdc were both intact and usable.
I then rebooted to Windows to play a game for about an hour. No issues there.
When I rebooted back to Linux, it was no longer able to complete startup.
sda is still bootable, Linux Mint startup begins, but can not complete.

[Troubleshooting]
I grabbed a USB flash drive with the Mint ISO on it and booted into the system.
sda is intact and automounts.
sdc does not automount. DISKS showed the drive was just unpartitioned space.
I used TestDisk. In the search result list it showed multiple entries with the correct partition name.
I chose the top entry, which had a size of ~970GB, then went to the next screen, then chose "Write".
After it completed, it advised to restart.
After restart, I have about 8 partitions with unrecognizable names and random sizes.

[Notes and Next steps]
I don't care about repairing sda (the OS partition) at all. There is nothing of value there. I'm OK with a full OS reinstall.

I ran Photorec to try and extract the files. It still saw the original partition.
I let it run for 13 hours (about 40% complete) until it filled the USB drive, then I stopped it.
It found files, but obviously not all of them. There are also tons of unusable files.

[Questions]
Are there other options in TestDisk I should run to get back the original partition?
Can it delete these new partitions? Have I screwed anything up beyond repair?
Are there other tools that I should consider (including paid tools)?

Thank you, thank you, and thank you again for any help you can offer.

Posted: **02 Sep 2019, 06:22**

Can you list all the partitions you had before the problem and copy/paste the testdisk.log file ?

Posted: **02 Sep 2019, 17:41**

Mr. Grenier, thanks for answering this personally and thanks for making this tool!

Originally, before the problem, there was one non-encrypted ext4 partition on the 3TB HDD named "DANDATALIVE".
As you can see from the log, there are now 15 partitions, none of them have that name.

I just ran an analyze in TestDisk now and this is the result (adding everything in case it's helpful):

Code: Select all

OS: Linux, kernel 4.15.0-58-generic (#64-Ubuntu SMP Tue Aug 6 11:12:41 UTC 2019) x86_64
Compiler: GCC 7.2
ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       5860533168 sectors
/dev/sda: user_max   5860533168 sectors
/dev/sda: native_max 5860533168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       468862128 sectors
/dev/sdb: user_max   468862128 sectors
/dev/sdb: native_max 468862128 sectors
/dev/sdc: LBA, LBA48 support
/dev/sdc: size       976773168 sectors
/dev/sdc: user_max   976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM008-2DM166, S/N:Z505GERH, FW:CC26
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SA400S37240G, S/N:50026B7782650C8D, FW:SBFKB1D2
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - CT500MX500SSD4, S/N:1903E1E4537E, FW:M3CR023

Partition table type (auto): None
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM008-2DM166
Partition table type: EFI GPT

Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P Mac HFS                107756833  113062911    5306079 []
 2 P Mac HFS               1793031388 1793182655     151268
 3 P Mac HFS               1794591676 1794742943     151268
 4 P Mac HFS               1795728264 1796158767     430504
 5 P Mac HFS               1796666668 1797097171     430504
check_FAT: Unusual media descriptor (0xf8!=0xf0)
Warning: number of heads/cylinder mismatches 4 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 17 (FAT) != 63 (HD)
 6 P MS Data               1798202980 1798223718      20739 [NO NAME]
 7 P Mac HFS               1805858656 1805875033      16378 [untitled 2]
 8 P Mac HFS               1805875036 1805891413      16378 [untitled 2]
check_FAT: Unusual media descriptor (0xf8!=0xf0)
Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
 9 P MS Data               1809916900 1809921571       4672 [NO NAME]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
10 P MS Data               1811531804 1811534683       2880 [EFISECTOR]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
11 P MS Data               1817200652 1817203531       2880 [EFISECTOR]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
12 P MS Data               1825809972 1825812851       2880 [EFISECTOR]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
13 P MS Data               1825812852 1825815731       2880 [EFISECTOR]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
14 P MS Data               1831865776 1831868655       2880 [EFISECTOR]
Warning: number of heads/cylinder mismatches 2 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 18 (FAT) != 63 (HD)
15 P MS Data               1831868656 1831871535       2880 [EFISECTOR]

But if I click "Quick Search", it will find multiple copies (8?) of the DANDATALIVE partition.

Code: Select all

search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63

block_group_nr 1

recover_EXT2: part_offset problem

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/22356, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732566646
recover_EXT2: part_size 5860533168
     MS Data                        0 5860533167 5860533168 [DANDATALIVE]
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 3000 GB / 2794 GiB
Partition not added.

block_group_nr 3

recover_EXT2: part_offset problem

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/22356, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732566646
recover_EXT2: part_size 5860533168
     MS Data                        0 5860533167 5860533168 [DANDATALIVE]
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 3000 GB / 2794 GiB
Partition not added.

But when I hit Stop, it shows the originally listed unwanted partitions:

Code: Select all

HFS magic value at 6707/140/59
part_size 5306079
     Mac HFS                107756833  113062911    5306079 []
     HFS blocksize=524288, 2716 MB / 2590 MiB

HFS+ magic value at 111611/10/44
part_size 151268
     Mac HFS               1793031388 1793182655     151268
     HFS+ blocksize=2048, 77 MB / 73 MiB

HFS+ magic value at 111708/42/11
part_size 151268
     Mac HFS               1794591676 1794742943     151268
     HFS+ blocksize=2048, 77 MB / 73 MiB

HFS+ magic value at 111778/233/16
part_size 430504
     Mac HFS               1795728264 1796158767     430504
     HFS+ blocksize=4096, 220 MB / 210 MiB

HFS+ magic value at 111837/83/35
part_size 430504
     Mac HFS               1796666668 1797097171     430504
     HFS+ blocksize=4096, 220 MB / 210 MiB
FAT12 at 111932/244/29
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 111932/244/29
     MS Data               1798202980 1798223718      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB

HFS magic value at 112409/128/8
part_size 16378
     Mac HFS               1805858656 1805875033      16378 [untitled 2 ]
     HFS blocksize=4096, 8385 KB / 8189 KiB

Posted: **03 Sep 2019, 02:05**

There is a recent thread titled

Recover ext4 partition deleted & overwritten

I followed your advice in that thread

TestDisk should be able to find the partition using Deeper Search (TestDisk, Analyse, Quick Search, Stop, Deeper Search...) using the ext4 backup superblock.

I got similar results as the other poster.
It says the harddisk seems too small.
Then it says "The following partitions can't be recovered", and lists the correct partition 9 times.

Then there is a Continue button that I haven't pressed because I don't know which partition to choose or what will happen.

Is PhotoRec the only next step?
In your opinion, would a commercial data recovery software product be able to recover any data in a situation like this?

Posted: **03 Sep 2019, 17:35**

DansDisks wrote: 03 Sep 2019, 02:05 There is a recent thread titled
Recover ext4 partition deleted & overwritten

I followed your advice in that thread
TestDisk should be able to find the partition using Deeper Search (TestDisk, Analyse, Quick Search, Stop, Deeper Search...) using the ext4 backup superblock.

I got similar results as the other poster.
It says the harddisk seems too small.
Then it says "The following partitions can't be recovered", and lists the correct partition 9 times.

Then there is a Continue button that I haven't pressed because I don't know which partition to choose or what will happen.

You have to look inside!

https://www.cgsecurity.org/wiki/TestDis ... e_recovery
https://www.cgsecurity.org/testdisk.pdf

Is PhotoRec the only next step?

No.

In your opinion, would a commercial data recovery software product be able to recover any data in a situation like this?

Maybe.

Posted: **03 Sep 2019, 18:52**

Thanks for the reply and the links to the docs.
I made sure to read them and search for similar posts before posting.
Since my issue doesn't match the docs, and at stake for me is 20 years of family memories, photos, and financial data, I am trying to be extremely careful and ask lots of questions as I go.
I'm also doing other research on my own and not simply waiting for someone to give me an answer.
What I need most is help understanding what is even possible.

Your response to my asking if commercial software would help was "Maybe".
Are you (or anyone) able to elaborate?
Do you have experience in knowing what situations it is helpful?
Do you have experience with any commercial products? (FOSS or otherwise)
What factors affect the outcome?
Is it an impossible question to answer without more info? What info would be needed?
Without more knowledge from experts, like maybe you are, I can't ask better questions or find solutions.

You have to look inside!

I looked inside each found partition.
None of them produced any files or gave the option to write out or repair anything.

What I am having trouble understanding is that I only had one partition to start with but it recovered 15.
Also, the quick and deep searches find the original partition, but show it to me 8 or 9 times.
The examples in the docs seem so straightforward, Search, maybe search again, see your partition, click Write. That's not my situation.

I think I've learned that these are backup copies of what's known as the superblock.
On one screen, TestDisk says it can not restore the partitions. Does that mean I'm done with this tool and should move forward? Or is there a repair option that I haven't seen yet?
On another screen (the one to press "p" to check files), TestDisk tells me that it can't find files and that the file system may be corrupt.
On some screens it mentions running efsck.
Is it possible to repair a filesystem without a partition? Or with these invalid partitions?
If I run the suggested efsck will it break it further? Or cause data loss?

This has turned into a lot of rambling, if you read it all, thanks and I'm sorry.
My main goal here is just to gain knowledge so I can help myself, and maybe others in the future.

Posted: **03 Sep 2019, 20:20**

DansDisks wrote: 03 Sep 2019, 18:52 Thanks for the reply and the links to the docs.
I made sure to read them and search for similar posts before posting.
Since my issue doesn't match the docs, and at stake for me is 20 years of family memories, photos, and financial data, I am trying to be extremely careful and ask lots of questions as I go.

Not copying the defective disk is not being extremly careful but rather risky.

I'm also doing other research on my own and not simply waiting for someone to give me an answer.
What I need most is help understanding what is even possible.

Your question is not sufficient specific and would fill a whole book about "what is even possible".

Your response to my asking if commercial software would help was "Maybe".
Are you (or anyone) able to elaborate?

Different software uses different algorithms and a varying extent of evaluating the remaining information on the disk.
You have to try it out.

Do you have experience in knowing what situations it is helpful?

Again, that is not a specific question.

Do you have experience with any commercial products? (FOSS or otherwise)

FOSS is not "commercial".

What factors affect the outcome?

The extent and the location of dammage.

Is it an impossible question to answer without more info? What info would be needed?
Without more knowledge from experts, like maybe you are, I can't ask better questions or find solutions.

This forum provides mainly support for Testdisk and Photorec.

You have to look inside!
I looked inside each found partition.
None of them produced any files or gave the option to write out or repair anything.

You did not provide information on having used the p-key to examine each of the partition found.

What I am having trouble understanding is that I only had one partition to start with but it recovered 15.

It is useless to speculate how an accident happened, there are countless possibilities.

Also, the quick and deep searches find the original partition, but show it to me 8 or 9 times.
The examples in the docs seem so straightforward, Search, maybe search again, see your partition, click Write. That's not my situation.

The examples tell you to look inside as well. You did not specify the way you partitioned and formated your disc before.
Maybe even MBR-style, most likely GPT-style. You did not provide information about the size of the file system that you installed.

I think I've learned that these are backup copies of what's known as the superblock.
On one screen, TestDisk says it can not restore the partitions. Does that mean I'm done with this tool and should move forward? Or is there a repair option that I haven't seen yet?

On another screen (the one to press "p" to check files), TestDisk tells me that it can't find files and that the file system may be corrupt.
On some screens it mentions running efsck.
Is it possible to repair a filesystem without a partition? Or with these invalid partitions?
If I run the suggested efsck will it break it further? Or cause data loss?

Wrong question, wrong approach. Make a copy, better make two copies.
Try running the efsck on your working copy. Keep the failed disk and one of two copies as a backup.

Code: Select all

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/22356, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 732566646
recover_EXT2: part_size 5860533168
     MS Data                        0 5860533167 5860533168 [DANDATALIVE]
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 3000 GB / 2794 GiB
Partition not added.

Assuming you created one big partition on the drive, the above seems worth trying.

Posted: **03 Sep 2019, 21:02**

I appreciate all of your feedback. Thank you.

Posted: **04 Sep 2019, 15:19**

I rarely visit this forum but I received a PM today which proved to be Russian spam.

Reading this thread I see that Windows and Ubuntu are mixed presumably in dual boot mode.

I have a Dell tower purchased about a year ago with Windows 10 factory installed. I added a new partition into which I installed Ubuntu in dual boot mode (partitions sharing the same physical disk drive - 1TB).

However I have read several horror stories of dual boot Ubuntu configuration being lost because of a Windows 10 update. Windows 10 simply does not respect any alien Linux partitions and my conclusion is that it is safer to keep Windows 10 and Ubuntu in two separate physical drives, not sharing the same nest.

My guess is that you might have suffered this Windows update effect - i.e. neighbouring Linux configuration being changed, with possibly an added recovery partition introduced by Windows.

As another recovery gameplan you might try installing R-Linux on your bootable Windows 10 to see if you can inspect Linux filesystem in other partitions.

https://www.r-studio.com/free-linux-recovery/

It is rather foolish to keep your precious data in one location as you have found. Also my own conclusion is not to share Windows and Ubuntu in the same physical drive.

You refer to 900GB in a 3TB HDD.

I would try to recover these into your 1TB external USB drive.

I would purchase yet another USB drive so you have a second copy and keep it offsite (protect against risks of fire and flood). Understand the principles of data redundancy and backup. Spread around your data.

Posted: **06 Sep 2019, 01:31**

That's an interesting theory about Windows update causing the issue.
Windows Build 1903 has been causing problems with various programs for a few months.
I'll look into that.

Your other advice, which I already do, is good.
My Linux and Windows file systems are on separate physical hard disks.
My data drive is also a separate disk.
My backup drive is yet another separate disk; a USB portable drive which does not remain connected to the system.
Everything just happened to get corrupted at the same time, during a backup refresh session.

Backing up the 900GB from the 3TB to the 1TB USB drive was already attempted and was not successful because more than 900GB is recoverable.
I assume this is due to files in the trash.
R-Studio is on my list of software solutions that I'm evaluating, thanks for the suggestion.

cgsecurity.org

I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?

Re: I recovered unexpected, unwanted partitions - Is my original partition still recoverable?