Wrote over partition- recovery possible?

FLCL · 05-15-2012, 03:22 AM

I was setting up a dual boot and accidentally wrote over my Win7 partition with a boot partition. I tried recovering with TestDisk but that made matters worse, I didn't pay close enough attention to the block size and restored essentially a blank partition table.

Now GParted reads no partition and the entire disk as unallocated space. However, the data is still intact (at least my storage partition) as I was able to boot into a live environment and mount all of the partitions; as well as access the data on a storage partition.

Is there any way to recover my partition table? Can I re-write it manually? I remember fairly accurately what the setup was. I appreciate any help

tl;dr: wrote over Win7 OS partition, TestDisk recovery deleted partition table, can access data off live CD. Possible to recover partition table?

syg00 · 05-15-2012, 03:39 AM

Quote:

Originally Posted by FLCL

Now GParted reads no partition and the entire disk as unallocated space. However, the data is still intact (at least my storage partition) as I was able to boot into a live environment and mount all of the partitions; as well as access the data on a storage partition.

Let's see something like (as root)

Code:

fdisk -l
parted -l

masterclassic · 05-15-2012, 05:00 AM

The safer way would be to make a backup copy of the hard drive on another drive, so that you are able to go back in case of problem.
Even a copy of the master boot sector or the partition table data would be useful.
Unfortunately, rewriting the partition table overwrites the old one. There is no backup copy automatically kept on drive.

You can rebuild the partition table if you know exactly the start and size of the partitions. changing something on the partition table with fdisk doean't change the filesystem and partition content it self. So, if the partition content is always on drive, it is probably recoverable.

Testdisk could detect partition entries, if they are still on the drive (however, the first partition start is highly possible to be overwritten by the new boot partition).

You can use
fdisk -lu
(as root) to list the partition table in sector precision.
Take into account that win7 usually creates partitions aligned to MiB as default, instead of the cylinder alignment in older operating systems.

GParted uses parted to detect the partitions. Try to use the latest GParted livecd, nevertheless you can try older versions too. You never know...

If you are able to restore the original partition table, perhaps you can use recovery software to restore (at least partially) the file system content. The MFT of the ntfs file system isn't located on the start of the partition, so it is very probable that it is intact.
If you can't restore the partitions, it is possible to try file recovering with photorec (it tries to recover files by scanning directly on the drive space, even in the case of broken file systems).

FLCL · 05-15-2012, 03:46 PM

Quote:

Originally Posted by masterclassic

You can rebuild the partition table if you know exactly the start and size of the partitions.

Here is the read-out from fdisk -lu

Code:

Disk /dev/sda: 320.1 GB, 320072933376 bytes

255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0xb4c83bd7



   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *        2048      206847      102400    7  HPFS/NTFS

Partition 1 does not end on cylinder boundary.

/dev/sda2          206848   307701759   153747456   83  Linux

/dev/sda3       307701760   307910599      104420   83  Linux

/dev/sda4       307910610   625153409   158621400    f  W95 Ext'd (LBA)

/dev/sda5       307910668   328230907    10160120   83  Linux

/dev/sda6       328232960   625139711   148453376    7  HPFS/NTFS

/dev/sda2 is where Windows was installed. Windows still attempts to boot but is unable and gives an error code 0xc000000f (likely due to the partition table and partial overwrite). Should I try using bootrec to try to recover MBR? I should mention that Grub was installed but Linux wasn't (realized this issue and stopped). Thanks

TobiSGD · 05-15-2012, 04:05 PM

Your Windows install is borked even if there is only a partial overwrite of the system partition. bootrec.exe will not help here. Backup your data and make a fresh install.

FLCL · 05-15-2012, 04:18 PM

Well, it was worth a shot even if I saw it coming lol. Thanks for the assistance everyone

masterclassic · 05-16-2012, 11:58 AM

The problem is that the disk content is altered. If just the partition table is damaged, it would be highly possible to recover it with testdisk. If the partition content is changed, chances unfortunately decrease for success.

The boot error comes from the fact that the boot code in the MBR tries to boot from a location where it doesn't find a valid boot loader.
Fixing boot is normally possible with the install dvd of windows, using a boot recovery option. However, if the start of the file system is broken, I can't see how it would be able to repair it.

About recovering files, I could obly think on a bit copy of the disk, to attempt it later.

A last thought: did you try to see if the win7 partition is accessible (readable) from any linux live cd?