Urgent. Need to recover a partition
 

First, here is a link to the problems I was having that led to MY error.

http://www.linuxquestions.org/questi...70#post2840070


Now to make a long story short, I accidentally in the terminal, put in mkswap /dev/sda1. I meant to put in mkswap /dev/hda1. At the time I did this /dev/sda1 was mounted to /media/disk. I did not format it or delete it and make a swap, I just put in mkswap /dev/sda1.

I need that back, all of the information on that partition. How do I do this? Gparted is telling me that it sees it as a swap partition with free space.

I am pissed. If it wasn't for the idiotic problems I was having with the Ubuntu swap and uuid then I wouldn't have had to do anything and in turn make an idiotic mistake like this.

I am doing some research now. I have installed TestDisk and PhotoRec. Now since I only did mkswap and did not format that partition as swap before that, is it possible I just screwed up the partition table and not the actual information, even though gparted is telling me that it is all freespace?

I am using testdisk to analyze /dev/sda1 I will add an edit here with the results. I never did this before and after making that one letter mistake (S and H are not even next to each other on the damn keyboard,) I am very worried about doing anything. So any help would be greatly appreciated. Also no one worry. If you offer help and it still doesn't work, etc, it was my fault to begin with, concerning /dev/sda1, and that is where any blame lies.

EDIT: After I posted this I checked (2) with the P option and all my files and folders are there. So Should I select L next and Load Back Up?
Edit: Edit: I choose the Load Back Up, L, and there is nothing there. All my files and folders are there, so I need to this in order.

Ok this is what got when I analyzed /dev/sda,

(((I added the numbers 1-5)))

I am guessing that (2) is what I need to restore? (1) is what I currently have. Also I have XP on a partition that it did not pick up, and I could care less about loosing that partition. I don't use XP for much other then games now a days.

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Partition Start End Size in sectors
(1)D Linux Swap 0 1 1 16214 254 63 260493912
(2)D Linux 0 1 1 16214 254 63 260493912
(3)* FreeBSD 16215 0 1 17744 254 63 24579450
(4)D Linux 17745 0 1 19456 254 63 27503280
(5)D Linux 17867 0 1 19456 254 63 25543350



(1)
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
SWAP2 version 1, 133 GB / 124 GiB


(2)
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
EXT3 Large file Sparse superblock Backup superblock, 133 GB / 124 GiB

(3)
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
12 GB / 11 GiB

(4)
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
EXT3 Large file Sparse superblock Recover, 14 GB / 13 GiB


(5)
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
EXT3 Large file Sparse superblock, 13 GB / 12 GiB

Ok. I am really lost now. I can analyze the partition like I said and it shows all my files and folders there. But I have no idea how to get them back. It seems that I just overwrote the partition table and not the actual data. I could really use some help here, lol.

Mmmmm - testdisk is for restoring deleted partitions. It scans the disk looking for "eyecatchers" that indicate (possible) partition begin/end.
But it only updates the partition table.

What you did was wipeout the beginning of the partition - the filesystem meta-data. The files themselves are likely to still be there - most if not all. I did a quick test, and mkswap only appears to smash the first 4k - to build a map of the swapspace, and write an id at the end. Even most of that 4k looks to be mostly untouched (been a while since I looked at the mkswap code though, so this is just observation).

You need a tool to scan for file "eyecatchers" - photorec would be a good start, then you might have to use a forensic tool like Foremost. Will take a while (as in days possibly) - ext2/3 is probably best supported; I've had very little luck trying to recover NTFS.

After I analyzied sda1 I looked at the (2) and I checked all the files and folders. They do appear to be there. Let me try what you suggested. I ran photorec to restore data but it was just extracting data, ex. videos, and putting them somewhere else (I told it in the /home/mydirectory/) The few things it recovered where still good. I was able to play a video. I just stopped it because I don't have the room to get all that data on my home directory.


Thanks for the help.

After all this is restored I am going to take a break and go over my alphabet and learn that H and S are different letters that look nothing alike, lol.

I am not sure what "eyecatchers" are. I did a quick Google and LQ search, which I usually do instead of asking 101 questions, lol, but I am not finding info on that. How would I use photorec to search for these "eyecatchers?"


Also I installed foremost. In the terminal I ran sudo foremost /dev/sda It appears to be working, but taking a bit of time.

I am new to data recovery and TestDisk, PhotoRec and ForeMost. I am sure my hands on crash course training with this will be helpful in the future for other problems that pop up but for now I am learning as I go.

Edit: There is probably around 50GB of data that I am trying to get back.

Just checked the output folder for foremost. It is working and keeping them organized. Problem is I am probably going to run out of room.

The forensic tools (photorec included) go looking for known file headers. Don't worry about it - that's the job of the software.
"eyecatcher" is just a term - something to catch your eye as you're looking at data.

Ok, I understand what you mean by eyecatchers now, lol.

This is a serious learning experience for me.

Here is a question. If all my folders and files are still there and I screwed up file meta-data by mkswap, could I do the same in reverse for an ext3 and maybe get things back or are the pointers,or what ever is needed, not going to be there?

Meta-data is actually the names of all your data, not the data themselves. So if your meta-data were lost, then the files will still be there but they'll be "anonymous" as their names were swept off the disk. If you use photorec, it will retrieve everything but it will re-name each file using a combination of numbers and letters.

If your meta-data are not screwed, however, you may be able to recover the whole partition at once without too much trouble. I had a little accident myself a while ago - I wiped my partition table. What I did was launch testdisk to determine the exact "contours" (end and start) of each partition, then I re-created them exactly as they were using fdisk from the command line. Now I'm not quite sure whether that's all that was needed but I believe it was. Then again, I only wiped the partition table, I didn't change any partition type numbers (switching from a regular Linux partition to swap does involve changing types). What I would NOT do under any circumstances is re-format to ext3: this will not put back your meta-data but it will overwrite them with a new, empty "registry" (that is, assuming that those data are still there- if they aren't, then there isn't really much to overwrite anyway).

I am using foremost. It is recovering a lot so far but like you said it is renaming them with numbers and letters.

Let me add this from testdisk. I can go into each folder and see the data in there, including other folders and files, etc. Everything is still there and named.

I have testdisk open. I can see this when I view the folders, (Edit: also thanks for the heads up on the ext3. I am going to see what I can save that I really need or want first, however long this will take, then I will try what you said above.)

drwxrwxr-x 0 1000 4096 26-Jul-2007 21:14 ..
drwxrwxr-x 0 0 16384 29-Jun-2007 22:56 lost+found
drwxrwxr-x 1000 1000 4096 22-Jul-2007 19:43 All Music
drwxrwxr-x 1000 1000 4096 27-Jul-2007 22:37 .Trash
-rw-r--r-- 1000 1000 12527070 26-Jul-2007 21:10 webmin_1.350_all.deb
drwxrwxr-x 1000 1000 4096 26-Jul-2007 21:14 Linux Stuff
drwxrwxr-x 1000 1000 4096 27-Jul-2007 16:10 My Website
drwxrwxr-x 1000 1000 4096 26-Jul-2007 21:14 zip
drwxrwxr-x 1000 1000 4096 21-May-2007 14:41 Website All
drwxrwxr-x 1000 1000 4096 27-Jul-2007 22:59 Pictures
drwxr-xr-x 1000 1000 4096 26-Jul-2007 04:18 Backup_All
drwxrwxr-x 1000 1000 12288 26-Jul-2007 04:21 exe
drwxrwxr-x 1000 1000 4096 27-Jul-2007 16:10 Documents
drwxrwxr-x 1000 1000 4096 26-Jul-2007 04:20 Cd Backup
drwxrwxr-x 1000 1000 4096 3-Jul-2007 16:02 Burn All

I want to make sure I get this right before I try it, I mean completely have it figured out.

This is what it says in fdisk for /dev/sda1

Disk /dev/sda1: 255 heads, 63 sectors, 16214 cylinders

Nr AF Hd Sec Cyl Hd Sec Cyl Start Size ID
1 00 0 0 0 0 0 0 0 0 00
2 00 0 0 0 0 0 0 0 0 00
3 00 0 0 0 0 0 0 0 0 00
4 00 0 0 0 0 0 0 0 0 00


Now this is the information I got from testdisk for the (2), as I numbered them in an above reply here, this is where all my folders and files are which I can see when I analyze it.


CHS Cylinders 19457 Heads 255 sectors 63

----------start--------------end----------size in sectors
Linux--0--1--1--16214---254---63----260493912


Is this what you mean, or am I getting close to it?

Yes, that's exactly what I meant. But as implied in my previous post, recreating partitions is only useful when their size or position was changed; if that's not the case and they were only reformatted, then the fdisk trick won't help much at all, you'll simply end up with what you have now.

btw, one odd thing I noticed about testdisk is that its start and end positions are one off; I believe I had to add 1 to both to get it right.

One question. You said I would just end up with what I have now? So if I stop foremost and do this and it doesn't work, then I should be able to start foremost again and get the data?

Or right after I post this foremost will complete, which it did. I only have a fraction of what is on there.

Fdisk didn't work. It may not work because of what you mentioned or I may not have done it correctly.

Foremost didn't get a lot of data, but it did get several GB. I am running PhotoRec, which has 5 1/2 hours left (already ran for 35 minutes.) It seems to be finding a lot of stuff. Luckily what it is doing is creating folders that are 500 files (size of each folder varies, it only goes by the file number.) So to make sure I have room, I am moving each folder when it gets completed and photorec moves on to the next one. Fortunately I have a lot of room, about 60-70 GB, with both my home and var partitions. But I have to stay up and make sure I get at least half of whats recovered on var (In size.) I have about 40 GB, maybe a little more then that, of data.

Then I am going to wait and see if anyone else has any ideas on what I might be able to do. I won't use SDA at all.

I've never used foremost but I have used photorec and I must say that I was fairly impressed. It failed to recompose some of my movies but otherwise it did a great job. It also lets you specify file types by extension so that it can work a bit more selectively if that's what you want. On the other hand, it doesn't show any contents; all you get to see is a counter ticking by while it's doing its best to fish it all up again.

As for fdisk giving you what you already have, yes, that's correct. But you need to make sure that the limits are exactly as they were - and you need to avoid reformatting. But again, if the partition limits weren't moved, it won't do anything at all. If you ever kill your partition table, that's when you'd have most to expect from it. Possibly also right after a partition was deleted. Neither of these actions tampers with the meta-data so everything is still there: both the data and the meta-data; the only thing that has changed is that your MBR has forgotten where to search for them. Recovery is a simple as restoring the (missing entries from) the partition table by entering them in fdisk. This is quite different from a reformat, which will erase at least the meta-data. You may use fdisk to shift the limits all you want, it won't restore the meta-data - because it was never meant to do that kind of thing.

Edit: I was typing this up just as you made your latest post so sorry if some of this information has lost its interest. Yes, photorec does an extremely thorough job and it does take plenty of space to store the back-ups. However, it will never dig up more than the actual contents of the partition in question. For example, if a 50GB partition was only 10% full, the back-ups will be 5GB rather than 50. Well actually, a bit more, because it tends to blow up certain files. For example, pictures or movies may get encoded to a completely different format. For example,a limited numbers of my pictures came out as bitmaps of 2MB while the original was more like 100Kb...

Thanks. I am not going to give up with fdisk or trying to get SDA right yet. FIrst all I want to do is try and save as much as I can, just incase. I have a lot of MP3's, most of them I ripped from my cd's and some of them I bought from emusic (which I can redownload again if I sign up with them.) The most important are the personal pictures and various documents. If thats all I can save out of all this I will be happy.... though I would rather save all of it, lol. PhotoRec is doing a great job so far. Between PhotoRec and some of the files I got from Foremost, I may be doing good. But then comes the sorting and renaming, that should be complete sometime in late 2008.... lol

Don't tell me about it. It's been like two months since I accidentally formatted a 200GB data partition and I'm still working on it. The funny thing is that I'm now so sick and tired of the endless searching and naming and sorting that I frequently find myself deleting them by the dozens, just to see some progress - after all the trouble I went to recovering them :rolleyes:

LOL. I can see me doing that to.

Update. 12 hours later and I am almost done with pass 5. 5500 files found with PhotoRec so far.

Also if anyone has any ideas on what else I an try to restore sda please let me know. Once I get all of this done I want to try and do that again.

Edit: I just found this link I wanted to add here if anyone ever runs across this post in the future. It explains PhotoRec, gives you an idea of how to start sorting all the files it finds, etc.

http://www.linux.com/articles/56588


Edit Edit: Does anyone know how many passes PhotoRec makes? For space I have had to move some folders to other partitions, I hope this doesn't confuse PhotoRec and it starts recovering the same files over and over again.

I tend to bring it to a halt after the very first pass. It seems to me that is will run infinitely if you don't intervene. The first pass usually recovers more than enough. If you find that some vital files were left behind, you can always give it a new spin.

I am noticing that each pass is taking less and less time. I am going to let it go and see what happens but I only have about 20GB left for space, so once it gets to about 13GB then no matter what, I am done. I may run it for pictures only again, those I want to make sure I loose none (or at least a very few.) Its amazing the "junk" PhotoRec is finding. I have text files in several languages, some text files are lines with a few letters over and over again. I am wondering if it is finding stuff underneath, things I shredded before.

I am not looking forward to the next step, the sorting. I am going over how I am going to do this and part of it will be just trashing all the videos and mp3's (except for 1 or 2 videos if they where recovered.) I can always get them back again.

Can someone tell me the commands to mass delete ceratain file extensions, ex. *mid in each folder? No need to shred, just a simple delete. I am finding that the mp3's and midi's are really going to be a pain sorting through, many are not being recovered all that well. Also the websites I take care of I can just re-download through ftp so I will be getting rid of all html extensions as well, which many are junk anyways.

Thanks.


Edit: Also 1 more pass should do it. I was close to 55000 and thought it would get there fast. But what is happening is it slowed down a lot. Once pass 8 is done I will try a 9th pass. If the files pretty much stay at 54344 or a few over that then it looks like it is done. Then it is time for a break (WoW time, lol.)

Delete all of them like this: rm *mid

Thank you. I knew it was simple, but my mind seems to have taken a vacation, lol.

Well I am done getting what I can from that HD partition. Before I start using that HD again I am going to wait until later tonight (5 or 6 hours,) in the hopes someone will tell me a magical way to fix that partition, lol. Foremost and PhotoRec where life savers. There, for some reason, was still some files lost but over all I saved most of what I really needed or wanted (mostly.). I don't care about the rest.

Thank you everyone for the help.

(((Lesson. Never put off until tomorrow what you should back up today. I know enough to back up, thats common sense. I just kept putting it off and now look at the mess I was/am in, lol.)))

That partition is quite easy to fix.

Go to this thread, and follow the instructions for Post 50 and post the output here. Note that you will be extracting the MBR from sda and not from hda.

In fact, reading that thread should show you what you need to do to fix your partition. (Hint: an ext2/ext3 partition is identified by 0x83).

I checked out that post. It seems straight forward enough. Since I recovered all that I could I am not to worried if it fails, though I would love it if this works. I am cutting and pasting part of post #50 here and changing the hda to sda.

First two questions.

1- Can I do this from my installed Ubuntu or should I use my SystemRescueCD 0.3.5?
2 - sda is not bootable but this should work?

You can do it from ubuntu, and the fact that sda doesn't have a bootable partition on it doesn't matter.

OK. I am going to give this a try. I am vaguely familiar with hex editors (editing cheat codes for games, etc,) So lets see if I can do this right. Thanks.

LMAO.... Well,

I am not sure what I screwed up but I have decided to do something. I am setting up my older computer and teaching myself some new things. For ex. I am going to install Linux and probably Win98 and create problems and then see if I can fix them correctly (starting first with recreating this problem,) and doing that as many times as I need to until I get it right.

I somehow got the first partition to fill the whole drive (getting rid of the second partition.) No big deal, so I used the backup mbrimage.bin I created and put that back. I got all the correct sizes back but partition 2 is unallocated (I think I now what to do to fix that.) I just knew I was going to do something like that but it is helping me understand a few more things about this, which is why I want to set up my older computer and learn more.

Either way thank you.

Uhhh...

I guess I steered you a bit wrong. Post 50 told the person on that other thread how to fix her partition. Yours is different.

You would have wanted to change a type 82 to a type 83 partition.

What I really wanted you to do was post the contents of the MBR here on this board, as I had her do it on that other thread.

Ok. I misunderstood. I can still do that if it will still work?

It certainly should still work

Ok Give me a minute and I will post it. Now to make sure I understand this you want the contents of the file that I get using khexedit?

Ok. I wanted to give you the exact file I saved originally before I started messing with it, unless you want the one that is there now, (both?). So I uploaded it in pdf format here http://free-voices.net/print.pdf

I also added this, the actual file gz http://free-voices.net/mbrimage.bin.gz

Follow the instructions in post 42 of that other thread. This will give a hex listing of the MBR, and it will report what sfdisk -l has to say about the drive. The combination will give all the info needed to fix the partition table

actually that pdf works as well...wait a minute...

ok, I will leave that on and the gz file.

OK, from that pdf, you presently have only one partition defined on that hd. That partition is defined as a linux ext2/3 partition. Have you tried to mount it?

Even if the partition boundaries are messed up (and they might be; the second partition entry is completely zeroed out), we can still probably recover the partition table correctly so long as the first partition is correctly identified.

The file system is not the same as the partition; even if the partition has been redefined to cover the whole HD, the file system is the size of the old partition. So, try running fsck on /dev/sda1 and see if the file system can be recovered. If it can, then we'll work on getting the second partition back.

What does fdisk -l or sfdisk -l have to say?

$ sudo sfdisk -l /dev/sda1

Warning: start=63 - this looks like a partition rather than
the entire disk. Using fdisk on it is probably meaningless.
[Use the --force option if you really want this]


Also I can mount it but there is nothing there. I ran testdisk before and I could see all the files there, and folders.

The command is sudo sfdisk -l /dev/sda

Testdisk is often capable of identifying all the partitions on the drive and recovering the partition table.

Since sda1 is now identified as a Linux partition (not swap) if you run fsck on it you should be able to recover the superblock and restore the structure. Once this is done it shouldn't be hard to find the second partition and restore the partition table.

Ok I did

Sudo fsck /dev/sda1

/dev/sda1: recovering journal
/dev/sda1: clean, 11/16285696 files, 559099/32561739 blocks

Now what is the next step? testdisk again?

what does sfdisk -l say????

You need to force fsck to run: fsck -f /dev/sda1

Then you should be able to mount it and see your files.

Then, yes, run testdisk again, using the settings that cause it to search for partitions.

/dev/sda1: recovering journal
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/sda1: 11/16285696 files (9.1% non-contiguous), 559099/32561739 blocks


I am going to run testdisk now and see what it looks like. I can't mount it and see the files, do I need to reboot? It may have just been screwed up by lack of knowledge on my part. I will post the testdisk analysis as soon as it is done.

I think I did do something wrong between last night and now. I am not seeing anything except an empty partition, and old DesktopBSD partition and a small linux partition I think was DreamLinux. I am going to copy all of this thread and refer to it if this ever happens again, also to learn from it.

OH WAIT, lol. I forgot to do something with testdisk, it is searching it now. All I can say is Duh on my part, lol. I will show the results shortly.