All data on HD lost after convert NTFS to EXT3
 

Hi,

I've decided to convert my NTFS partition to ext3 and use it for backup of some important data
As a result of this operation - I'm no more able to access my data :-(

/dev/hda is primary "system" disk with Ubuntu on it, hdc is "home" disk : hdc1 NTFS (40GB), hdc2 ext2 (80GB) end hdc3 swap (500M).

hdc1 was not mounted so I executed:
# fdisk /dev/hdc1
delete partition 1, recreate new primary 1 using same sectors (1 to 5000), set it to 83
did "w"
got message with something like "kernel will use the old table since reboot" but haven't take care of it :-(
tried
# mkfs.ext3 -v /dev/hdc1 - with no problems
# mount -t ext3 /dev/hdc1 /home/backup
copied loads of important data from /dev/hdc2 into it (20GB)

a bit after problems started : unable to delete files from hdc2 partition (got strange message "can't delete, system is read-only") so I decided finally to reboot and - the catastrophe !!!

/dev/hdc1 is unrecognized
/dev/hdc2 was impossible to mount,

-> I can't find my important data, both hdc1 and hdc2 seems to be destroyed !

-> fsck problems on /dev/hdc2 .... try to run fsck manually, so i did
# fsck -y /dev/hdc2 .... lot of errors / corrections, ....
once system rebooted again, I've find only

drwx------ 18 root root 16384 2005-12-18 13:44 lost+found/

with lot of strange think in it :

....
c-wSrwS-wt 1 3748322825 752322315 113, 107 1914-05-22 04:02 #9925
br-S-w-rwt 1 2391552555 2042450954 47, 133 1960-04-06 04:47 #9930
c----w---- 1 2437318542 3325671714 121, 236 1988-04-06 10:49 #9974
brwxr-Sr-x 1 1648846991 2448306852 79, 64 2026-03-02 00:37 #9992
.....

when tried to redo fsck
# e2fsck -vf /dev/hdc2
the result looks friendly :



e2fsck 1.38 (30-Jun-2005)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

575595 inodes used (5%)
50943 non-contiguous inodes (8.9%)
# of inodes with ind/dind/tind blocks: 44798/2952/1017
14229853 blocks used (71%)
0 bad blocks
0 large files

494569 regular files
37713 directories
5814 character device files
23278 block device files
242 fifos
2931 links
13568 symbolic links (10919 fast symbolic links)
402 sockets
--------
578517 files


on the other side
# fsck.ext3 -f /dev/hdc1 gives me
e2fsck 1.38 (30-Jun-2005)
Couldn't find ext2 superblock, trying backup blocks...
fsck.ext3: Bad magic number in super-block while trying to open /dev/hdc1

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>





Is there any hope to get back my data ?

Thanks in advance for any help,
Vladimir

I really couldn't help if there was a way through linux to get your stuff back, but if you want you could try out steve gibsons Spin Rite program. You'll need access to a windows box to make the boot CD/disc and it will scan your hard drive (it supports almost all formats) and try to fix and recover your data.

Its 89 dollars though, so there is a price and no guarantee it works.

So what made you think you could just reformat and convert your NTFS to EXT3 and expect no data loss? Windows by default doesn't or can't recognize EXT3 filesystems so depending on how you formmatted this partition and whatever tool you used, all of your data is most likely gone. You'd need some type of data recovery program to get your data back from the sounds of it.

You DELETED the partitions and then made new ones? Thats not converting. Thats formatting your hard drive.

Exactly why I posted my first response.. ;)

Yeah I realized what he wrote after you posted :p I thought he had just corrupted a convert with patition magic or something :p

Thank for responses.

Unfortunately I see that I've not explained correctly the problem (sorry for my english :-(

I expected that data on NTFS (hdc1) will be removed, that's fine.
What I've not expected is that this operation will corrupt my existing ext2 partition (hdc2) !

I will try to find s.one with steve gibsons Spin Rite program - thanks for that.

Could someone also help me repair it using linux ?
Thanks, V.

There are a number of live distros that contain the tools necessary to attempt recovery of lost files..

http://www.frozentech.com/content/li...cue&sort=&sm=1

The coroners toolkit is one such set of tools.
http://www.fish2.com/tct/FAQ.html

Basincally you are looking at forensics work..
http://www.forinsect.de/forensics/forensics-links.html


and before you start any attempt at forensics you should get a blank HD (if the blank drive is not new, you should 'zero' out the drive before copying an image to it.. ) mount the damaged HD READ ONLY and make a bit for bit image (hint in Linux use dd for this) of the drive you are planning to work on. and then work on the copy or image you created, not the original drive.


good luck...

Well if you formatted the drive as ext(n) the data is toast. You may recover some files here and there but the vast majority are likely zeroed out. The MFT is definitely going to be toast so you may want to try R-Tools as that software will be your very best chance of recovering data. Check it out at http://www.r-tt.com/

It is the ONLY data recovery software I've had success with. Whatever you do stay away from Stellar Phoenix (I've posted about that piece of *&%@ company previously in other threads). It will not work and they WILL refuse to refund your money.