LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 05-21-2007, 04:36 AM   #1
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Rep: Reputation: 23
HDD partition lost. xandros DVD + me = lost data


EDIT: Disney style happy ending here.
Problem solved. There is hope for those of us that know better, but against better judgment go ahead without the correct safeguards and back-ups. Time to purchase that long over due external USB HDD.
End

I know this is a long shot. But here's hoping.

Long story short.
I installed a shiny new DVD copy of xandrox desktop 4 on my computer. Mistake number one was letting it install in the 'free' space on my spare drive and telling it to leave windows alone without checking the partition layout physically myself. Mistake number two, hitting the 'finish' button and letting it install without again thoroughly inspecting the details. All mistakes realised when computer would not boot anything.

So now after some playing I have restored my grub, booted up. And now can't mount my HDD with all my favourite IPTV shows, and assorted stuff I could do with out, but choose not to give up finding them somewhere there.

So without further rambling.
Code:
$ sudo fdisk -l

Disk /dev/sda: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        1960    15743668+   7  HPFS/NTFS
/dev/sda2            1961        3265    10482412+  a5  FreeBSD
/dev/sda3            3266        3396     1052257+   c  W95 FAT32 (LBA)
/dev/sda4            3397        4890    12000555    5  Extended
/dev/sda5            3397        3645     2000061   82  Linux swap / Solaris
/dev/sda6            3646        4890    10000431   83  Linux

Disk /dev/sdb: 164.6 GB, 164696555520 bytes
255 heads, 63 sectors/track, 20023 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1            3397        4890    12000555    5  Extended
/dev/sdb5   *        3397        4890    12000523+  83  Linux

Disk /dev/sdc: 250.0 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1   *           1       13054   104856223+   7  HPFS/NTFS
/dev/sdc2           13055       30401   139339777+   7  HPFS/NTFS
The 160GB (sdb) drive is the one that had the stuff on it. I also am hoping that the data could be hiding there somewhere within the logical partition still as that is the end of the drive it was in before I had a mischief. I vaguely remember watching an episode of hak5 where the idea of restoring partitions that had been mischiefed was discussed, but alas that was within the afore mentioned partition.

Any help or heckling is more than welcome. I know I should have backed it up if it were dear to me. But I didn't realise how much I loved it till it was gone. Such an age old story that one.

Last edited by lein; 05-22-2007 at 05:08 AM.
 
Old 05-21-2007, 05:19 AM   #2
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
First: do not do anything that might cause a write to that disk. There is a good chance the data will be recoverable---but any writes will reduce the odds.

Does the partitioning on the other two drives make sense?--ie does it appear to match what you intended and is everything on sda and sdc working?

The first thing that grabs me is that the extended partition on sdb has the same parameters as the one on sda. Does that make sense in terms of the steps you went through? More generally, can you think of what you might have done that would have affected sdb? eg any diddling with the mbr while changing the grub setup.

It seems quite possible that the only thing wrong with sdb is the partition table.

Try this:
dd if=/dev/sdb bs=1 skip=446 count=64|hexdump -C
Post the results here

If you want to jump-start the analysis, these 64 bytes are the primary partition table. Do the same thing for sda and sdc.
For the format of the entries, go here. What we are looking for is evidence of correct entries that have been glitched.

Last edited by pixellany; 05-21-2007 at 05:21 AM.
 
Old 05-21-2007, 05:47 AM   #3
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Original Poster
Rep: Reputation: 23
Code:
sudo dd if=/dev/sdb bs=1 skip=446 count=64|hexdump -C

64+0 records in
64+0 records out
64 bytes (64 B) copied, 0.000207 seconds, 309 kB/s
00000000  00 00 c1 ff 05 fe ff ff  44 78 40 03 56 3a 6e 01  |........Dx@.V:n.|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000040
Quote:
Originally Posted by pixellany
First: do not do anything that might cause a write to that disk. There is a good chance the data will be recoverable---but any writes will reduce the odds.

The first thing that grabs me is that the extended partition on sdb has the same parameters as the one on sda. Does that make sense in terms of the steps you went through? More generally, can you think of what you might have done that would have affected sdb? eg any diddling with the mbr while changing the grub setup.
Now that you mention it, yes. That occurred to me as well, but I think I may have already made the situation worse.
What I noticed when I first booted up was that sda appeared to be mirrored over sdb except for the unallocated space at the end of the drives. I deleted the partition information for the first few partitions then realised that I was probably just making things worse. So I stopped. First thing I did after that was restore my grub from sda3 (being my grub partition) to the MBR.

Using:
Code:
grub> root (hd0,2)
grub> setup (hd0)
That's the only didling I did promise.

There was nothing in the first 50-60GB of sdb when I started all this the only partition with anything in it was the first logical of the drive (sdb5). sdb5 was ~105GB+ I can't be entirely sure as I had re-organized a few things over the weekend trying to streamline the computer and make it better-er. Hence why sda1 is a 100GB partition dedicated to my MP3s and sdb2 was going to be the home to all the multimedia that is now playing hide and seek with me.
 
Old 05-21-2007, 05:47 AM   #4
saikee
Senior Member
 
Registered: Sep 2005
Location: Newcastle upon Tyne UK
Distribution: Any free distro.
Posts: 3,398
Blog Entries: 1

Rep: Reputation: 113Reputation: 113
The recovery od data in your disk sdb can be easy, hard or impossible. It depends on any record you keep for the previous partition table and how much writing you have done on the disk since.

A complete destruction of the partition can hardly affect the content inside the partition. I have in the past had the partition tables of several hard disks, with 60+ partitions inside, nuked and rebuilt the whole thing with almost no loss. You can look upon the partition table as the content page of a book or the door bell system of a multistory building with residential flats. The loss of the content page does not affect the interior of a book nor the loss of the door bells could change the residences.

The partition table is only 16 bytes per partition situates between the 447th to 510th bytes of the first sector (512 bytes called the MBR) in the disk.

In your case the first slot (4 slots representing the 4 primary partitions) has been used up as an extended partition. Its starting point in the hard disk is the 3,397th cylinder and the end boundary is at 4,890th cylinder, representing 12 out of the 160Gb space. Thus the sdb has about empty space of 3,396 cylinders in front of the only logical partition sdb5, which matches exactly the extended partition envelope sdb1, and there is a trailing 20,023-4890 = 15,133 cylinder of empty space. In term of capacity these are 27Gb empty, 12Gb occupied and 121Gb empty hard disk spaces.

The fdisk command list all the 100+ partitions it supports including the hidden ones so I don't think there is any more partition to be displayed, especially the slot 1 (sdb1) has been used up as the extended partition. All OSs proceed to use the next empty slot in accending order when being asked to creat a partition in a hard disk.

If you have the original record of the partition table you can use any Live CD, boot it up and use "cfdisk" to delete sdb5 (sdb1 will disappear automatically) and then reconstruct the original partition table. Without any formatting and on a reboot all your data will be back with only the damaged portion betweem the already-written area of between 3397 to 4890 cylinders. If the sdb1 has not been formatted or written on then you can get back 100% of the original data.

If you have no recollection of the partitioning scheme then may God has mercy on your disk.

There is several free downloadable programs, mostly based on Dos, that you can use to "recover" part or even the whole of a erased partition table. Some of these programs assemble the filing index and try to rebuild the boundaries back. One of them is called "testdisk" so Google it and have a try.
 
Old 05-21-2007, 06:00 AM   #5
saikee
Senior Member
 
Registered: Sep 2005
Location: Newcastle upon Tyne UK
Distribution: Any free distro.
Posts: 3,398
Blog Entries: 1

Rep: Reputation: 113Reputation: 113
It is a PC standard to toggle one of the bit (can't remember which) in the byte describing the partition type. Most partition type get "1" added to the type number.

For example the Type 5, 7 & 83 denoting extended, NTFS and Linux will be hidden

by corresponding Type 15, 17 & 93.

FreeBSD can see a5 partition but not Type b5 when it is hidden.

My point is these hidden partitions are all supported by Linux and fdisk will report them even the operating systems themself can't see some of them. Fdisk will not report a partition only if there is no entry in the relevant slot of the partition table. Therefore the partitions are not hiding. Their records in the partition table have been emptied or the owner cannot identify them from the existing partitions.
 
Old 05-21-2007, 06:01 AM   #6
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Original Poster
Rep: Reputation: 23
Thank goodness for scrap pieces of paper.

On Friday the partition scheme was something like:
sdb1 25GB Windows NTFS
sdb2 25GB Kubuntu ext3
sdb5 105GB Data NTFS <--- This being my glorious data that is AWOL.

with the remainder being unallocated, I do seem to remember that sda1&2 were not quite an even 25GB but very close.

Last edited by lein; 05-21-2007 at 06:19 AM.
 
Old 05-21-2007, 06:05 AM   #7
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Original Poster
Rep: Reputation: 23
Quote:
Originally Posted by saikee
Therefore the partitions are not hiding. Their records in the partition table have been emptied or the owner cannot identify them from the existing partitions.
So I wrote over the partition table. Hopefully I didn't write over the data too then.
 
Old 05-21-2007, 06:15 AM   #8
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
Reading Saikee's post makes me wonder why more people don't advocate making backups of partition tables...

sdb5 was 105+GB and now it is ~12GB----not a good sign

I'm confused about this:
Quote:
There was nothing in the first 50-60GB of sdb when I started all this the only partition with anything in it was the first logical of the drive (sdb5). sdb5 was ~105GB+
Are you saying that sdb was partitioned with only one logical partition (at the end)?

BTW, does the current sdb5 have **anything** on it?
 
Old 05-21-2007, 06:22 AM   #9
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
Quote:
Originally Posted by lein
Thank goodness for scrap pieces of paper.

On Friday the partition scheme was something like:
sda1 25GB Windows NTFS
sda2 25GB Kubuntu ext3
sda5 105GB Data NTFS <--- This being my glorious data that is AWOL.

with the remainder being unallocated, I do seem to remember that sda1&2 were not quite an even 25GB but very close.
And now sdb5 is a Linux partition and not NTFS.....
This is not looking good...This means that at least the last 12 GB of the old sdb5 were re-formatted.
BUT, the remainder still could be intact

You may want to consider engaging a data recovery specialist. Otherwise, you need to find a utility that is designed for recovering from NTFS and start searching at about 48 GB into the drive.
 
Old 05-21-2007, 06:24 AM   #10
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
PS:
While you are pondering your next moves, why not get your order placed for two USB external drives to use for backup.
 
Old 05-21-2007, 06:24 AM   #11
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Original Poster
Rep: Reputation: 23
Quote:
Originally Posted by pixellany
I'm confused about this:
Are you saying that sdb was partitioned with only one logical partition (at the end)?
I just removed sdb1 & 2 from the partition scheme while I was organising and never got around to formatting and putting any data there. And as I couldn't stretch the sdb5 logical partition to encompass the complete drive due to the first section being primary, I left them be for the time being figuring i'd find something to do to them later.
Quote:
Originally Posted by pixellany
BTW, does the current sdb5 have **anything** on it?
Code:
$ls /mnt/sdb5
bin   dev    etc   initrd  media  opt   root  srv  tmp  var
boot  disks  home  lib     mnt    proc  sbin  sys  usr  vmlinuz
 
Old 05-21-2007, 06:24 AM   #12
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
PS:
While you are pondering your next moves, why not get your order placed for two USB external drives to use for backup.
 
Old 05-21-2007, 06:26 AM   #13
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Original Poster
Rep: Reputation: 23
Quote:
Originally Posted by pixellany
PS:
While you are pondering your next moves, why not get your order placed for two USB external drives to use for backup.
Already fired up to go to the next computer fair and buy a backup drive. I've also considered a xBox running linux of course as a media station to doubly back up all the multimedia I "had" collected.


edit: Cheers for the help pixellany & saikee. I'll go looking for a utility program to recover the data tomorrow. Hopefully I'll have some luck.

Last edited by lein; 05-21-2007 at 06:51 AM.
 
Old 05-21-2007, 08:21 AM   #14
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
Quote:
Originally Posted by lein
I just removed sdb1 & 2 from the partition scheme while I was organising and never got around to formatting and putting any data there. And as I couldn't stretch the sdb5 logical partition to encompass the complete drive due to the first section being primary, I left them be for the time being figuring i'd find something to do to them later.
Code:
$ls /mnt/sdb5
bin   dev    etc   initrd  media  opt   root  srv  tmp  var
boot  disks  home  lib     mnt    proc  sbin  sys  usr  vmlinuz
So sdb5 was NTFS and 100+GB, Now it is Linux and 12GB--and has Linux installed on it. I'd say that the first 88GB are maybe recoverable--the last 12--probably not
 
Old 05-21-2007, 09:02 PM   #15
lein
Member
 
Registered: Jul 2006
Location: Australia
Distribution: Mint 14/16 & Raspbian
Posts: 73

Original Poster
Rep: Reputation: 23
Update: This morning I set to searching the internet for HDD recovery tools using geeks best friend Google. I found many tools that promise to deliver for a fee (small price to pay if it recovers my precious), so I did what anyone would do. Downloaded a demo that will scour the HDD in question and return all data that can be recovered from it if you upgrade to the fee paid product.

Now being as I am a devious bugger I have scanned my drive and discovered that all data seems to be there and complete. I was thinking of using the details I have been graciously given by this R-Studio demo to just use fdisk to create a partition with the correct parameters for said data.

Code:
Partition size:     105.7GB (221684337sec)
Partition offset:     47.7GB (99988623sec)
Cluster size: 4KB (8sec)
I was wondering, if anybody out there with any experience thought that was enough information to construct just that one partition. Nothing else on that disk is 'needed'.

edit: I'm not being lazy, I am just on my lunch break. Just a link toward a helping hand would suffice

Last edited by lein; 05-21-2007 at 09:05 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Howto recover lost and formatted data on lost partitions. Sören Schneider LinuxQuestions.org Member Success Stories 2 04-05-2006 06:38 AM
help! lost data... mount and new partition puhdy2005 Linux - General 3 11-07-2005 03:28 AM
Recovery of lost data from FAT32 partition... devis Linux - Software 1 07-11-2005 08:10 AM
HELP resized partition and lost all data wolfbeast2 Linux - Newbie 15 08-14-2004 07:05 PM
Data lost on other partition sonicspeedway Linux - Newbie 2 05-01-2004 02:49 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 06:29 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration