LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices


Reply
 
Search this Thread
Old 02-08-2014, 10:57 AM   #1
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Rep: Reputation: Disabled
Help recovering deleted partitions on external drive.


Whilst burning .img files to sd card, I stupidly plugged in my external drive to backup, which became /dev/sdb instead of the sdcard. This meant I wrote the Nook UsbHostpatch to my external drive by accident (only 50mbish). Whilst this couldn't have had long enough to properly overwrite all my files ( a 300gb disk), part way through, my computer crashed.

When I restarted I realised what I'd done. First time round running testdisk (using the intel/pc option) it quickly gave a huge amount of read errors, and found no partitions (not even the one that I can see in nautilus – a partition named boot, with the files that I wrote onto it, and which the Disk utility lists as being FAT (32 bit version).

After unmounting, removing, and remounting, I ran testdisk again.It didn't give read errors this time. Short version found nothing, so I ran deeper search. This soon said:

“Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
FAT32 0 0 1 229 119 18 3686400 [boot]


It didn't manage to find my previous file system/ partition.

Back in the main menu, it's giving data about the disk as:

Disk /dev/sdb - 320 GB / 298 GiB - WD 3200BMV External
CHS 38913 255 63 - sector size=512

I think the external drive was previously ntfs, since I had used it with windows, as well as linux.

Is there anything else I can try? Is it worth changing the numbers for cylinders/ sectors?Cheers.
 
Old 02-08-2014, 12:11 PM   #2
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Original Poster
Rep: Reputation: Disabled
ok so I ran gpart on it, and got a huge number of
"* Warning: read error (EIO) near sector(624884511), skipping..." (many many more like this, too many to post here)

I'm guessing that's a bad sign and the drive maybe a gonner, but I'd still like to recover whatever data I can. Is there still any way I can get the partition table back?
 
Old 02-08-2014, 12:17 PM   #3
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Original Poster
Rep: Reputation: Disabled
OK, so i had a look at what PhotoRec was saying, and it came up with this:

Disk /dev/sdc - 320 GB / 298 GiB (RO) - WD 3200BMV External

Partition Start End Size in sectors
> Unknown 0 0 1 38913 80 63 625142448 [Whole disk]
P FAT32 0 0 1 38913 80 63 625142448 [boot]


I'm guessing that here the 'unknown' partition maybe the one I accidentally overwrote. I don't have another disk as big as this one I can copy this to, but I've just ordered one so I will try that in a few days time, but if its still possible to rescue the partition table and this disk that would be ideal - does that look like it would still be possible?

Cheers.
 
Old 02-08-2014, 12:51 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 28,447
Blog Entries: 54

Rep: Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243
You overwrote the Master Boot Record and Partition Table space on your WD (and more but OK). When you run testdisk give it the "/debug /log" switches so you have a log to read (or post) later on. As long as you don't write anything to the disk you can safely set CHS values when configuring testdisk. You can make testdisk write a clean Master Boot Record and Partition Table to the disk. That contradicts the previous line and while overwriting usually shouldn't be done on victimized media but well, it's gone anyway.
 
Old 02-09-2014, 06:36 AM   #5
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Original Poster
Rep: Reputation: Disabled
This is the log from I think the first time I ran testdisk yesterday:



Sat Feb 8 13:56:25 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.12-1-amd64 (#1 SMP Debian 3.12.6-2 (2013-12-29)) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-17T13:40:45
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WD 3200BMV External, FW:1.75

Partition table type (auto): None
Disk /dev/sdb - 320 GB / 298 GiB - WD 3200BMV External
Partition table type: Intel

Interface Advanced

Interface Advanced

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/0/7
FAT1 : 32-3624
FAT2 : 3625-7217
start_rootdir : 7218 root cluster : 2
Data : 7218-3686393
sectors : 3686400
cluster_size : 8
no_of_cluster : 459897 (2 - 459898)
fat_length 3593 calculated 3593
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/0/7
FAT32 0 0 1 229 119 18 3686400 [boot]
FAT32, blocksize=4096, 1887 MB / 1800 MiB
Partition not added.

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
---
Should I set heads to 255 and sectors to 63? And If I set it to create a new MBR as ntfs might that help it find the old partitions/files?

and when you say, 'well, its gone anyway' do you think there's no chance of me getting this stuff back?

Cheers for the help.
 
Old 02-11-2014, 01:12 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 28,447
Blog Entries: 54

Rep: Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243
Quote:
Originally Posted by iamsorandom View Post
Should I set heads to 255 and sectors to 63?
If those are the devices original settings, yes.


Quote:
Originally Posted by iamsorandom View Post
And If I set it to create a new MBR as ntfs might that help it find the old partitions/files?
What adding a generic MBR and PT does is keep testdisk from looking at it so a deep search may yield more relevant results.


Quote:
Originally Posted by iamsorandom View Post
and when you say, 'well, its gone anyway' do you think there's no chance of me getting this stuff back?
Uh, sorry, I meant only the MBR, PT and amount of data overwritten. If you can re-establish the partitions boundaries you may be able to use a spare super block.
 
Old 02-16-2014, 06:58 AM   #7
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Original Poster
Rep: Reputation: Disabled
Ok thanks, sorry for the slow reply. I'm trying to find enough time to do this properly so that I don't mess things up further/ so that I have a whole day when I can leave my laptop running...

How do I go about creating a new MBR? Is it the same idea as this? http://www.cgsecurity.org/wiki/Menu_MBRCode
I wasn't sure, because this has never been a disk I boot from...

--


I also find something on the TestDisk wiki which said this:

Recovery of reformatted partition
If the partition has been reformatted to another file system (FAT32 formatted as NTFS or vice-versa),
run TestDisk,
select the hard disk and the partition type
choose Advanced
select the partition
choose Type,
enter the value corresponding to the previous filesystem
choose Boot
choose RebuildBS
List
If you can see your files, choose Write and confirm
In Analyse, choose to rewrite the partition with the correct partition type.
Return to TestDisk main page

--

is that something similiar/ worth trying first?

Cheers.
 
Old 02-16-2014, 07:30 AM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 28,447
Blog Entries: 54

Rep: Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243Reputation: 3243
Quote:
Originally Posted by iamsorandom View Post
How do I go about creating a new MBR? Is it the same idea as this? http://www.cgsecurity.org/wiki/Menu_MBRCode
I wasn't sure, because this has never been a disk I boot from...
Yes.


Quote:
Originally Posted by iamsorandom View Post
I also find something on the TestDisk wiki which said this (..) is that something similar/ worth trying first?
Sure. This only affects the MBR and Partition Table, not what data remains. Just to be sure do set the correct CHS values before writing please and don't forget to add the "/debug /log" switches so we can read along should that be necessary.
 
Old 02-16-2014, 07:32 AM   #9
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Original Poster
Rep: Reputation: Disabled
Ok thanks a lot.
 
Old 04-28-2015, 06:02 AM   #10
iamsorandom
LQ Newbie
 
Registered: Feb 2014
Posts: 7

Original Poster
Rep: Reputation: Disabled
Latest attempts

Ok so I know this now pretty long ago...well I at last got round to having another go at recovering this data. I ran testdisk on the .iso again, choosing intel/pc partition, and after having written that new mbr to and having 'deleted all data in the partition table'.

Running the full disk scan I got no results, nothing found:

Disk /media/usb0/copy-external1.iso - 320 GB / 298 GiB - CHS 38914 255 63
No partition 0 0 1 38913 254 63 625153410

(actually i failed to get it produce logs unfortunatelly...)

I guess this means there's nothing else I can do to get that stuff back? I'm pretty sure that devices/heads/sectors are set as they would have been originally for the device: i.e. it's a device i bought off the shelf, so would have been ntfs, which explains the 254 / 63?

Alas, I will mourn my data, unless anyone has any other miraculous ideas!
Cheers.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Need advice recovering deleted partition on failing drive Diogones Linux - Hardware 8 11-13-2012 05:26 AM
Recovering a deleted partition table while partitions still mounted suger Linux - General 5 01-02-2006 01:31 AM
Installing SuSE on an external FireWire drive: YaST can't edit partitions on drive kivimaki Linux - Distributions 2 09-13-2004 08:52 PM


All times are GMT -5. The time now is 03:50 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration