|
Help recovering deleted partitions on external drive.
Whilst burning .img files to sd card, I stupidly plugged in my external drive to backup, which became /dev/sdb instead of the sdcard. This meant I wrote the Nook UsbHostpatch to my external drive by accident (only 50mbish). Whilst this couldn't have had long enough to properly overwrite all my files ( a 300gb disk), part way through, my computer crashed.
When I restarted I realised what I'd done. First time round running testdisk (using the intel/pc option) it quickly gave a huge amount of read errors, and found no partitions (not even the one that I can see in nautilus – a partition named boot, with the files that I wrote onto it, and which the Disk utility lists as being FAT (32 bit version). After unmounting, removing, and remounting, I ran testdisk again.It didn't give read errors this time. Short version found nothing, so I ran deeper search. This soon said: “Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD) Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD) FAT32 0 0 1 229 119 18 3686400 [boot] ” It didn't manage to find my previous file system/ partition. Back in the main menu, it's giving data about the disk as: Disk /dev/sdb - 320 GB / 298 GiB - WD 3200BMV External CHS 38913 255 63 - sector size=512 I think the external drive was previously ntfs, since I had used it with windows, as well as linux. Is there anything else I can try? Is it worth changing the numbers for cylinders/ sectors?Cheers. |
ok so I ran gpart on it, and got a huge number of
"* Warning: read error (EIO) near sector(624884511), skipping..." (many many more like this, too many to post here) I'm guessing that's a bad sign and the drive maybe a gonner, but I'd still like to recover whatever data I can. Is there still any way I can get the partition table back? |
OK, so i had a look at what PhotoRec was saying, and it came up with this:
Disk /dev/sdc - 320 GB / 298 GiB (RO) - WD 3200BMV External Partition Start End Size in sectors > Unknown 0 0 1 38913 80 63 625142448 [Whole disk] P FAT32 0 0 1 38913 80 63 625142448 [boot] I'm guessing that here the 'unknown' partition maybe the one I accidentally overwrote. I don't have another disk as big as this one I can copy this to, but I've just ordered one so I will try that in a few days time, but if its still possible to rescue the partition table and this disk that would be ideal - does that look like it would still be possible? Cheers. |
You overwrote the Master Boot Record and Partition Table space on your WD (and more but OK). When you run testdisk give it the "/debug /log" switches so you have a log to read (or post) later on. As long as you don't write anything to the disk you can safely set CHS values when configuring testdisk. You can make testdisk write a clean Master Boot Record and Partition Table to the disk. That contradicts the previous line and while overwriting usually shouldn't be done on victimized media but well, it's gone anyway.
|
This is the log from I think the first time I ran testdisk yesterday:
Sat Feb 8 13:56:25 2014 Command line: TestDisk TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org OS: Linux, kernel 3.12-1-amd64 (#1 SMP Debian 3.12.6-2 (2013-12-29)) x86_64 Compiler: GCC 4.8 Compilation date: 2013-10-17T13:40:45 ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none User is not root! Hard disk list Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WD 3200BMV External, FW:1.75 Partition table type (auto): None Disk /dev/sdb - 320 GB / 298 GiB - WD 3200BMV External Partition table type: Intel Interface Advanced Interface Advanced Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 Current partition structure: No partition is bootable search_part() Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 Results interface_write() No partition found or selected for recovery search_part() Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 FAT32 at 0/0/7 FAT1 : 32-3624 FAT2 : 3625-7217 start_rootdir : 7218 root cluster : 2 Data : 7218-3686393 sectors : 3686400 cluster_size : 8 no_of_cluster : 459897 (2 - 459898) fat_length 3593 calculated 3593 heads/cylinder 64 (FAT) != 255 (HD) sect/track 32 (FAT) != 63 (HD) set_FAT_info: name from BS used FAT32 at 0/0/7 FAT32 0 0 1 229 119 18 3686400 [boot] FAT32, blocksize=4096, 1887 MB / 1800 MiB Partition not added. Results interface_write() No partition found or selected for recovery simulate write! write_mbr_i386: starting... write_all_log_i386: starting... No extended partition Interface Advanced Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 Current partition structure: No partition is bootable search_part() Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 Search for partition aborted Results interface_write() No partition found or selected for recovery simulate write! write_mbr_i386: starting... write_all_log_i386: starting... No extended partition Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 Current partition structure: No partition is bootable search_part() Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63 Search for partition aborted Results interface_write() No partition found or selected for recovery simulate write! write_mbr_i386: starting... write_all_log_i386: starting... No extended partition TestDisk exited normally. --- Should I set heads to 255 and sectors to 63? And If I set it to create a new MBR as ntfs might that help it find the old partitions/files? and when you say, 'well, its gone anyway' do you think there's no chance of me getting this stuff back? Cheers for the help. |
Quote:
Quote:
Quote:
|
Ok thanks, sorry for the slow reply. I'm trying to find enough time to do this properly so that I don't mess things up further/ so that I have a whole day when I can leave my laptop running...
How do I go about creating a new MBR? Is it the same idea as this? http://www.cgsecurity.org/wiki/Menu_MBRCode I wasn't sure, because this has never been a disk I boot from... -- I also find something on the TestDisk wiki which said this: Recovery of reformatted partition If the partition has been reformatted to another file system (FAT32 formatted as NTFS or vice-versa), run TestDisk, select the hard disk and the partition type choose Advanced select the partition choose Type, enter the value corresponding to the previous filesystem choose Boot choose RebuildBS List If you can see your files, choose Write and confirm In Analyse, choose to rewrite the partition with the correct partition type. Return to TestDisk main page -- is that something similiar/ worth trying first? Cheers. |
Quote:
Quote:
|
Ok thanks a lot.
|
Latest attempts
Ok so I know this now pretty long ago...well I at last got round to having another go at recovering this data. I ran testdisk on the .iso again, choosing intel/pc partition, and after having written that new mbr to and having 'deleted all data in the partition table'.
Running the full disk scan I got no results, nothing found: Disk /media/usb0/copy-external1.iso - 320 GB / 298 GiB - CHS 38914 255 63 No partition 0 0 1 38913 254 63 625153410 (actually i failed to get it produce logs unfortunatelly...) I guess this means there's nothing else I can do to get that stuff back? I'm pretty sure that devices/heads/sectors are set as they would have been originally for the device: i.e. it's a device i bought off the shelf, so would have been ntfs, which explains the 254 / 63? Alas, I will mourn my data, unless anyone has any other miraculous ideas! Cheers. |
| All times are GMT -5. The time now is 04:21 PM. |