Could use help trying to recover files from possibly hosed partition
Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Could use help trying to recover files from possibly hosed partition
Hello, I've been using Linux for a few years and have managed to find what I need searching (including this great site) until now. I have managed to mess up a substantial partition and don't want to possibly make a bad situation worse by bungling around an area I know next to nothing about. I'll try to explain it fully.
Case. I finally built a new PC (750GB internal HDD, 4GB RAM). I'm used to Kubuntu so I installed that (10.04 x86_64bit); partitioned sda1 1GB swap / sda2 OS 20GB ext4 / balance sda3 home ext4 for time being. Everything runs sweet. My old PC (very, PIII, but more recent 500GB internal HDD) partitioned sda1 486.31MB swap / sda2 OS 22.82GB ext4 / balance (442.46GB) sda3 home ext3 (ext3 because /home was inherited from an earlier install prior to Kubuntu going ext4). Old PC was having PSU prob. I don't have an external HDD or any other large HDD and not enough DVDRs for 280GB or so of data current in /home. So I backed up what I could risking the old PC working long enough. Got the critical stuff, business etc. There remained some 150GB or so, years of pictures, videos, info on car repairs etc (some but by no means all on semi annual DVDR backups). Free space current in new PC's /home partition ~500GB. So I took out the HDD from the old PC and put it in the new in order to copy the remainder then use it in the new PC; made sure BIOS of new PC indicated this 2nd drive did not have boot priority. The correct install booted.
To my surprise (maybe not yours?) during boot with zero indication, Kubuntu decided to use the 2nd HDD's /home partition for its new 442.46GB swap partition instead! I was horrified. I unmounted it immediately but... according to GParted the partition with all those files to copy is now:
/dev/sbd3 File System: unknown 442.46GB Used: --- Unused: --- no flags
I was surprised by kubuntu changing its partitions without input and assuming a ext3 file system on a secondary HD for a 442.46GB swap partition. But, mistake's on me. Call it a lesson. Now I need to know more but don't want to experiment unduly on this drive and possibly make things worse: What should I do next?
Thanks for reading all this.
Last edited by ClodHopper; 06-25-2010 at 12:28 AM.
Booting into single-user mode to check out what got mounted where would have been wise. Still wiser would have been using a live cd and rsync to move the files.
I'll tell you how your old disk became a swap partition.
1. you plugged in the Old Drive to your new system without thinking about what device path would be given to the drives.
2. Old Drive picked up by bios, udev then gave it the device path of where your swap was. Meanwhile the drive that had your swap partition was moved to a different device path.
3. Kubuntu boots and runs fstab... Goodbye Old Drive data.
So, at this point, you need to:
A. poke around the drive with parted and see if it can discover the old partition. (not gparted)
B. If that doesn't work, you need to experiment with mounting the partition using offset values. This might work, but will take some calculations and a meaningful effort at learning about partitions and filesystems. If this works, it will be many times quicker than option C. parted should give you some block boundaries to work with.
Note: A and B are not harmful to the disk data. You are just trying to discover beginning/end of disk partitions that you may be able to infer using the block data from parted.
C. use dd to make a disk image. Then use foremost (see sourceforge) to recover files. After foremost spends hours recovering files, you will spend 10x the hours foremost ran to figure out what's in each file found. You will need lots of disk space to do all of this, but you'll get it back.
If the swap was unused, it is possible though not likely that kubuntu did not do anything other than change the partition type in the partition table.
IN this case, changing the partition type to type 83 (ext3) COULD bring everything back, and I think the filesystem will automatically mount with an offset if the primary boot record is unavailable.
Distribution: Fedora on servers, Debian on PPC Mac, custom source-built for desktops
Posts: 174
Rep:
Wow. I pity you. I really don't think much is going to help if your machine thought it was a swap partition and then wrote to it, but give it a go. Ouch.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.