LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices

Reply
 
Search this Thread
Old 12-17-2007, 04:23 PM   #1
Exeis
LQ Newbie
 
Registered: Jul 2005
Distribution: Slackware 10.2 + Slax 5.1.8 + Knoppix 5.0.1 + LFS 6.3
Posts: 24

Rep: Reputation: 15
Question How do you recover data from lost partition?


I have a desktop running Windows XP with a 200 GB Hardisk. A logical drive (25 GB) was accidentally deleted from an extended partition. No partitions were created or deleted after the accident (in other words, there has been no modification to the hard disk's contents since the problem occurred). Is there any Linux utility\tool\software that I can use to either recover the partition or at least be able to extract the lost data on to another hard disk? I plan to use a LiveCD since, linux is so much more manageable than Win32.

thanks.


P.S. Using some demos, i did manage to find the sector number that the lost partition began. There were 8 partitions (hda1 hda2 hda3 hda4<hda5 hda6 hda7 hda8>) and I recovered only hda1-6 with cfdisk and testdisk. Hda7 is FAT32 and hda8 was NTFS 3.1 (Windows XP SP2).
 
Old 12-17-2007, 04:59 PM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,485

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
Testdisk was going to be my suggestion. I'm surprised it missed some - did you use search in addition to analyse ??.

I'm also a bit confused. First you say you lost (just) one logical - in the postscript you imply you lost hda6, hda7 AND hda8.
 
Old 12-17-2007, 06:42 PM   #3
jeenam
Member
 
Registered: Dec 2006
Distribution: Slackware 11
Posts: 144

Rep: Reputation: 15
Try gpart.

http://www.t2-project.org/packages/gpart.html

It is included with SystemRescueCD.

Last edited by jeenam; 12-17-2007 at 06:43 PM.
 
Old 12-18-2007, 01:35 AM   #4
Electro
Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
I suggest use PhotoRec from CGSecurity. It does not need a working partition table to start with. It starts at sector 1 and then stops at the end of the disk.
 
Old 12-18-2007, 11:49 AM   #5
Exeis
LQ Newbie
 
Registered: Jul 2005
Distribution: Slackware 10.2 + Slax 5.1.8 + Knoppix 5.0.1 + LFS 6.3
Posts: 24

Original Poster
Rep: Reputation: 15
testdisk didn't seem to recognize the missing extended partition, hda4 (it encompasses the rest of the drive space besides hda1-3) that had logical drives hda5, hda6, hda7, and hda8. In fact, it only detected hda6 and hda8 as FAT 32, suggesting five primary partitions. I manually, with cfdisk, put back hda4 and simply guessed on the sizes and locations of had5 and hda6 to restore them (which proved the partition table of the HDD was only broken). I guessed and checked with a couple of demos. I believe hda7 and hda8 are damaged in such a way that the data is intact, but not so much the FS structures.

With a demo, i did manage to figure out the exact sector that hda8 begins (also know the approximate size of either 25GB). I wonder if there is such a utility for partitions that allow manipulation of the start and stop of partitions by sectors.

But, I'll try gpart.

P.S. Sorry for the confusion. I'm really after hda8, and hda5,hda6, and hda7 aren't too important. Originally, the partitions were like this at the accident:

hda1 hda2 hda3 hda4< --- hda6 --- --- >

the "---" signifies the gaps and missing partitions.
 
Old 12-19-2007, 12:24 AM   #6
Electro
Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
Usually when the partition table goes the file system loses its pointers and information, so file system utilities have to be run to fix the file structure. When this happens there is a possibility of losing data. I do not recommend using Testdisk while PhotoRec will get most of data back with out screwing around with the partition table and file system. PhotoRec does not use the partition table. It finds the header of the file formats that it knows and re-constructs the files. It may take a while to scan the disk, but it should work.
 
Old 12-19-2007, 04:36 AM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,485

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
On the contrary, deleting a partition has no effect on the filesystem. Or data.
Partition table entries (all of them, on "classic" DOS layouts) are basically just extent start and end. Logicals (being a linked list) have the potential to damage data if they are inappropriately redefined.

testdisk and photorec come from the same people, and function similarly in that they go looking for "signatures" to determine what (and where) might be on the disk.
Both tremendous pieces of work.

I must say it appears we are not being given all of the story here by Exeis - things keep changing with each new post.

Last edited by syg00; 12-19-2007 at 04:41 AM.
 
Old 12-19-2007, 04:36 AM   #8
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,485

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
Duplicate post - deleted.

Last edited by syg00; 12-19-2007 at 04:42 AM.
 
Old 12-19-2007, 04:10 PM   #9
Exeis
LQ Newbie
 
Registered: Jul 2005
Distribution: Slackware 10.2 + Slax 5.1.8 + Knoppix 5.0.1 + LFS 6.3
Posts: 24

Original Poster
Rep: Reputation: 15
what syg00 said about logicals as a linked list seems interesting...

as a safety precaution (heeding syg00 warning about logical drives...), I'm using a demo to recover the data in the lost partition to another partition on another physical disk. Tedious, yes, but at least the demo *only* reads the drive to extract data from it, if that's how it works in general. I'm 'backing up the data' before doing any changes to the hard disk, in case I worsen the situation.

I'm still going to test out gpart on another machine to see if it'll work for my situation.

P.S. my knowledge on disk geometry and partitioning is limited, hence I apologize if things I've said aren't consistent. Plus, i guess there were some details of the problem that I thought might not be significant.

Normally, this accident wouldn't be a problem, had the partitions been deleted by cfdisk. Before the accident, I had added another logical drive (hda9)via cfdisk since there was about 87GB of free space in the extended partition(hda4). My mistake was that, under Windows XP, I used the built-in disk management utility of Windows to remove hda9 (since I noticed that hda9 didnt have enough capacity). This caused hda5, hda7, and hda8 to 'disappear'. Lesson learned: 1.) Backup before partitioning of any kind 2.) Use same utility to add or remove partitions.

It's one of the reasons I don't like using Windows... there is so much the OS does that the user can't monitor that can be monitored in linux. ("more power to the user" in linux!)
 
Old 12-19-2007, 05:46 PM   #10
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,485

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
When you're dicking around with disks, "dd" the whole disk off to another. Screw around with the copy. That way you can always restart - or try something different.

I don't know what Windoze disk manager would have done in that situation; I never use it.
 
  


Reply

Tags
data recovery, extract


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover Lost Data VeryConfused General 5 08-30-2007 02:01 PM
Howto recover lost and formatted data on lost partitions. Sören Schneider LinuxQuestions.org Member Success Stories 2 04-05-2006 07:38 AM
formatted my c:, linux boot data lost, how could i recover sas_tvr Linux - General 1 01-18-2005 07:56 AM
How to recover data on lost partitions Red Squirrel General 12 03-20-2004 01:37 PM
Data Lost! Is It Possible To Recover? rddreamz Linux - Newbie 3 11-17-2003 11:15 PM


All times are GMT -5. The time now is 09:34 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration