Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
EDIT: Disney style happy ending here.
Problem solved. There is hope for those of us that know better, but against better judgment go ahead without the correct safeguards and back-ups. Time to purchase that long over due external USB HDD.
End
I know this is a long shot. But here's hoping.
Long story short.
I installed a shiny new DVD copy of xandrox desktop 4 on my computer. Mistake number one was letting it install in the 'free' space on my spare drive and telling it to leave windows alone without checking the partition layout physically myself. Mistake number two, hitting the 'finish' button and letting it install without again thoroughly inspecting the details. All mistakes realised when computer would not boot anything.
So now after some playing I have restored my grub, booted up. And now can't mount my HDD with all my favourite IPTV shows, and assorted stuff I could do with out, but choose not to give up finding them somewhere there.
So without further rambling.
Code:
$ sudo fdisk -l
Disk /dev/sda: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sda1 * 1 1960 15743668+ 7 HPFS/NTFS
/dev/sda2 1961 3265 10482412+ a5 FreeBSD
/dev/sda3 3266 3396 1052257+ c W95 FAT32 (LBA)
/dev/sda4 3397 4890 12000555 5 Extended
/dev/sda5 3397 3645 2000061 82 Linux swap / Solaris
/dev/sda6 3646 4890 10000431 83 Linux
Disk /dev/sdb: 164.6 GB, 164696555520 bytes
255 heads, 63 sectors/track, 20023 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdb1 3397 4890 12000555 5 Extended
/dev/sdb5 * 3397 4890 12000523+ 83 Linux
Disk /dev/sdc: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sdc1 * 1 13054 104856223+ 7 HPFS/NTFS
/dev/sdc2 13055 30401 139339777+ 7 HPFS/NTFS
The 160GB (sdb) drive is the one that had the stuff on it. I also am hoping that the data could be hiding there somewhere within the logical partition still as that is the end of the drive it was in before I had a mischief. I vaguely remember watching an episode of hak5 where the idea of restoring partitions that had been mischiefed was discussed, but alas that was within the afore mentioned partition.
Any help or heckling is more than welcome. I know I should have backed it up if it were dear to me. But I didn't realise how much I loved it till it was gone. Such an age old story that one.
First: do not do anything that might cause a write to that disk. There is a good chance the data will be recoverable---but any writes will reduce the odds.
Does the partitioning on the other two drives make sense?--ie does it appear to match what you intended and is everything on sda and sdc working?
The first thing that grabs me is that the extended partition on sdb has the same parameters as the one on sda. Does that make sense in terms of the steps you went through? More generally, can you think of what you might have done that would have affected sdb? eg any diddling with the mbr while changing the grub setup.
It seems quite possible that the only thing wrong with sdb is the partition table.
Try this:
dd if=/dev/sdb bs=1 skip=446 count=64|hexdump -C
Post the results here
If you want to jump-start the analysis, these 64 bytes are the primary partition table. Do the same thing for sda and sdc.
For the format of the entries, go here. What we are looking for is evidence of correct entries that have been glitched.
sudo dd if=/dev/sdb bs=1 skip=446 count=64|hexdump -C
64+0 records in
64+0 records out
64 bytes (64 B) copied, 0.000207 seconds, 309 kB/s
00000000 00 00 c1 ff 05 fe ff ff 44 78 40 03 56 3a 6e 01 |........Dx@.V:n.|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000040
Quote:
Originally Posted by pixellany
First: do not do anything that might cause a write to that disk. There is a good chance the data will be recoverable---but any writes will reduce the odds.
The first thing that grabs me is that the extended partition on sdb has the same parameters as the one on sda. Does that make sense in terms of the steps you went through? More generally, can you think of what you might have done that would have affected sdb? eg any diddling with the mbr while changing the grub setup.
Now that you mention it, yes. That occurred to me as well, but I think I may have already made the situation worse.
What I noticed when I first booted up was that sda appeared to be mirrored over sdb except for the unallocated space at the end of the drives. I deleted the partition information for the first few partitions then realised that I was probably just making things worse. So I stopped. First thing I did after that was restore my grub from sda3 (being my grub partition) to the MBR.
Using:
Code:
grub> root (hd0,2)
grub> setup (hd0)
That's the only didling I did promise.
There was nothing in the first 50-60GB of sdb when I started all this the only partition with anything in it was the first logical of the drive (sdb5). sdb5 was ~105GB+ I can't be entirely sure as I had re-organized a few things over the weekend trying to streamline the computer and make it better-er. Hence why sda1 is a 100GB partition dedicated to my MP3s and sdb2 was going to be the home to all the multimedia that is now playing hide and seek with me.
The recovery od data in your disk sdb can be easy, hard or impossible. It depends on any record you keep for the previous partition table and how much writing you have done on the disk since.
A complete destruction of the partition can hardly affect the content inside the partition. I have in the past had the partition tables of several hard disks, with 60+ partitions inside, nuked and rebuilt the whole thing with almost no loss. You can look upon the partition table as the content page of a book or the door bell system of a multistory building with residential flats. The loss of the content page does not affect the interior of a book nor the loss of the door bells could change the residences.
The partition table is only 16 bytes per partition situates between the 447th to 510th bytes of the first sector (512 bytes called the MBR) in the disk.
In your case the first slot (4 slots representing the 4 primary partitions) has been used up as an extended partition. Its starting point in the hard disk is the 3,397th cylinder and the end boundary is at 4,890th cylinder, representing 12 out of the 160Gb space. Thus the sdb has about empty space of 3,396 cylinders in front of the only logical partition sdb5, which matches exactly the extended partition envelope sdb1, and there is a trailing 20,023-4890 = 15,133 cylinder of empty space. In term of capacity these are 27Gb empty, 12Gb occupied and 121Gb empty hard disk spaces.
The fdisk command list all the 100+ partitions it supports including the hidden ones so I don't think there is any more partition to be displayed, especially the slot 1 (sdb1) has been used up as the extended partition. All OSs proceed to use the next empty slot in accending order when being asked to creat a partition in a hard disk.
If you have the original record of the partition table you can use any Live CD, boot it up and use "cfdisk" to delete sdb5 (sdb1 will disappear automatically) and then reconstruct the original partition table. Without any formatting and on a reboot all your data will be back with only the damaged portion betweem the already-written area of between 3397 to 4890 cylinders. If the sdb1 has not been formatted or written on then you can get back 100% of the original data.
If you have no recollection of the partitioning scheme then may God has mercy on your disk.
There is several free downloadable programs, mostly based on Dos, that you can use to "recover" part or even the whole of a erased partition table. Some of these programs assemble the filing index and try to rebuild the boundaries back. One of them is called "testdisk" so Google it and have a try.
It is a PC standard to toggle one of the bit (can't remember which) in the byte describing the partition type. Most partition type get "1" added to the type number.
For example the Type 5, 7 & 83 denoting extended, NTFS and Linux will be hidden
by corresponding Type 15, 17 & 93.
FreeBSD can see a5 partition but not Type b5 when it is hidden.
My point is these hidden partitions are all supported by Linux and fdisk will report them even the operating systems themself can't see some of them. Fdisk will not report a partition only if there is no entry in the relevant slot of the partition table. Therefore the partitions are not hiding. Their records in the partition table have been emptied or the owner cannot identify them from the existing partitions.
On Friday the partition scheme was something like:
sdb1 25GB Windows NTFS
sdb2 25GB Kubuntu ext3
sdb5 105GB Data NTFS <--- This being my glorious data that is AWOL.
with the remainder being unallocated, I do seem to remember that sda1&2 were not quite an even 25GB but very close.
Therefore the partitions are not hiding. Their records in the partition table have been emptied or the owner cannot identify them from the existing partitions.
So I wrote over the partition table. Hopefully I didn't write over the data too then.
Reading Saikee's post makes me wonder why more people don't advocate making backups of partition tables...
sdb5 was 105+GB and now it is ~12GB----not a good sign
I'm confused about this:
Quote:
There was nothing in the first 50-60GB of sdb when I started all this the only partition with anything in it was the first logical of the drive (sdb5). sdb5 was ~105GB+
Are you saying that sdb was partitioned with only one logical partition (at the end)?
BTW, does the current sdb5 have **anything** on it?
On Friday the partition scheme was something like:
sda1 25GB Windows NTFS
sda2 25GB Kubuntu ext3
sda5 105GB Data NTFS <--- This being my glorious data that is AWOL.
with the remainder being unallocated, I do seem to remember that sda1&2 were not quite an even 25GB but very close.
And now sdb5 is a Linux partition and not NTFS.....
This is not looking good...This means that at least the last 12 GB of the old sdb5 were re-formatted.
BUT, the remainder still could be intact
You may want to consider engaging a data recovery specialist. Otherwise, you need to find a utility that is designed for recovering from NTFS and start searching at about 48 GB into the drive.
I'm confused about this:
Are you saying that sdb was partitioned with only one logical partition (at the end)?
I just removed sdb1 & 2 from the partition scheme while I was organising and never got around to formatting and putting any data there. And as I couldn't stretch the sdb5 logical partition to encompass the complete drive due to the first section being primary, I left them be for the time being figuring i'd find something to do to them later.
Quote:
Originally Posted by pixellany
BTW, does the current sdb5 have **anything** on it?
Code:
$ls /mnt/sdb5
bin dev etc initrd media opt root srv tmp var
boot disks home lib mnt proc sbin sys usr vmlinuz
PS:
While you are pondering your next moves, why not get your order placed for two USB external drives to use for backup.
Already fired up to go to the next computer fair and buy a backup drive. I've also considered a xBox running linux of course as a media station to doubly back up all the multimedia I "had" collected.
edit: Cheers for the help pixellany & saikee. I'll go looking for a utility program to recover the data tomorrow. Hopefully I'll have some luck.
I just removed sdb1 & 2 from the partition scheme while I was organising and never got around to formatting and putting any data there. And as I couldn't stretch the sdb5 logical partition to encompass the complete drive due to the first section being primary, I left them be for the time being figuring i'd find something to do to them later.
Code:
$ls /mnt/sdb5
bin dev etc initrd media opt root srv tmp var
boot disks home lib mnt proc sbin sys usr vmlinuz
So sdb5 was NTFS and 100+GB, Now it is Linux and 12GB--and has Linux installed on it. I'd say that the first 88GB are maybe recoverable--the last 12--probably not
Update: This morning I set to searching the internet for HDD recovery tools using geeks best friend Google. I found many tools that promise to deliver for a fee (small price to pay if it recovers my precious), so I did what anyone would do. Downloaded a demo that will scour the HDD in question and return all data that can be recovered from it if you upgrade to the fee paid product.
Now being as I am a devious bugger I have scanned my drive and discovered that all data seems to be there and complete. I was thinking of using the details I have been graciously given by this R-Studio demo to just use fdisk to create a partition with the correct parameters for said data.
I was wondering, if anybody out there with any experience thought that was enough information to construct just that one partition. Nothing else on that disk is 'needed'.
edit: I'm not being lazy, I am just on my lunch break. Just a link toward a helping hand would suffice
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.