LinuxQuestions.org - Wrote over partition- recovery possible?

- Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)

- - Wrote over partition- recovery possible? (https://www.linuxquestions.org/questions/linux-general-1/wrote-over-partition-recovery-possible-945015/)

Wrote over partition- recovery possible?

I was setting up a dual boot and accidentally wrote over my Win7 partition with a boot partition. I tried recovering with TestDisk but that made matters worse, I didn't pay close enough attention to the block size and restored essentially a blank partition table.

Now GParted reads no partition and the entire disk as unallocated space. However, the data is still intact (at least my storage partition) as I was able to boot into a live environment and mount all of the partitions; as well as access the data on a storage partition.

Is there any way to recover my partition table? Can I re-write it manually? I remember fairly accurately what the setup was. I appreciate any help

tl;dr: wrote over Win7 OS partition, TestDisk recovery deleted partition table, can access data off live CD. Possible to recover partition table?

Quote:

Originally Posted by FLCL (Post 4678610)

Now GParted reads no partition and the entire disk as unallocated space. However, the data is still intact (at least my storage partition) as I was able to boot into a live environment and mount all of the partitions; as well as access the data on a storage partition.

:scratch:
Let's see something like (as root)

Code:

fdisk -l

parted -l

The safer way would be to make a backup copy of the hard drive on another drive, so that you are able to go back in case of problem.
Even a copy of the master boot sector or the partition table data would be useful.
Unfortunately, rewriting the partition table overwrites the old one. There is no backup copy automatically kept on drive.

You can rebuild the partition table if you know exactly the start and size of the partitions. changing something on the partition table with fdisk doean't change the filesystem and partition content it self. So, if the partition content is always on drive, it is probably recoverable.

Testdisk could detect partition entries, if they are still on the drive (however, the first partition start is highly possible to be overwritten by the new boot partition).

You can use
fdisk -lu
(as root) to list the partition table in sector precision.
Take into account that win7 usually creates partitions aligned to MiB as default, instead of the cylinder alignment in older operating systems.

GParted uses parted to detect the partitions. Try to use the latest GParted livecd, nevertheless you can try older versions too. You never know...

If you are able to restore the original partition table, perhaps you can use recovery software to restore (at least partially) the file system content. The MFT of the ntfs file system isn't located on the start of the partition, so it is very probable that it is intact.
If you can't restore the partitions, it is possible to try file recovering with photorec (it tries to recover files by scanning directly on the drive space, even in the case of broken file systems).

Quote:

Originally Posted by masterclassic (Post 4678675)

You can rebuild the partition table if you know exactly the start and size of the partitions.

Here is the read-out from fdisk -lu

Code:

Disk /dev/sda: 320.1 GB, 320072933376 bytes



255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors



Units = sectors of 1 * 512 = 512 bytes



Sector size (logical/physical): 512 bytes / 512 bytes



I/O size (minimum/optimal): 512 bytes / 512 bytes



Disk identifier: 0xb4c83bd7







  Device Boot      Start        End      Blocks  Id  System



/dev/sda1  *        2048      206847      102400    7  HPFS/NTFS



Partition 1 does not end on cylinder boundary.



/dev/sda2          206848  307701759  153747456  83  Linux



/dev/sda3      307701760  307910599      104420  83  Linux



/dev/sda4      307910610  625153409  158621400    f  W95 Ext'd (LBA)



/dev/sda5      307910668  328230907    10160120  83  Linux



/dev/sda6      328232960  625139711  148453376    7  HPFS/NTFS

/dev/sda2 is where Windows was installed. Windows still attempts to boot but is unable and gives an error code 0xc000000f (likely due to the partition table and partial overwrite). Should I try using bootrec to try to recover MBR? I should mention that Grub was installed but Linux wasn't (realized this issue and stopped). Thanks

Your Windows install is borked even if there is only a partial overwrite of the system partition. bootrec.exe will not help here. Backup your data and make a fresh install.

Well, it was worth a shot even if I saw it coming lol. Thanks for the assistance everyone

The problem is that the disk content is altered. If just the partition table is damaged, it would be highly possible to recover it with testdisk. If the partition content is changed, chances unfortunately decrease for success.

The boot error comes from the fact that the boot code in the MBR tries to boot from a location where it doesn't find a valid boot loader.
Fixing boot is normally possible with the install dvd of windows, using a boot recovery option. However, if the start of the file system is broken, I can't see how it would be able to repair it.

About recovering files, I could obly think on a bit copy of the disk, to attempt it later.

A last thought: did you try to see if the win7 partition is accessible (readable) from any linux live cd?