LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Restoring data form swap partition - possible? (https://www.linuxquestions.org/questions/linux-newbie-8/restoring-data-form-swap-partition-possible-939584/)

Blank... 04-13-2012 12:49 AM
Restoring data form swap partition - possible?
 
Good morning everyone

My problem is: during installation (bodhi linux) i’ve chosen the wrong partition for swap. Partition with 80 GB of data (real data, not games, movies…). Is there any way to restore them?
At the time it is still a linux swap partition, Gparted says it is completely empty, i don't see it in linux. Didn't want to format it to ntfs (to try some windows undelete program), until i see what to do.
I tried testdisk, but just like gparted it finds it, sees it as a linux swap, but no data. Even after “deeper search”.
I uninstalled bodhi so it wouldn't start writing on that swap partition and currently am running windows (and slax from live CD).

Any way to restore data, or are they gone forever?

Thanks in advance!

Tinkster 04-13-2012 01:00 AM
Hi, welcome to LQ!

If bodhi ran a mkswap against it (most distros will) chances are it zero'd everything
out. You could try just changing the partition type to what it was before the bodhi
install (that's non-destructive, it just changes a few bytes in the partition table)
using slax; just switch from 82 to whatever it was, and try running testdisk again ...


If that still says nuh you may be sh*t out of luck, or try an expensive
professional service (the kind of people who get data off physically defunct HDDs).

And this emphasises the need for back-ups, even in this day and age.


Cheers,
Tink

Blank... 04-13-2012 02:33 AM
Quote:
Originally Posted by Tinkster (Post 4651595)
Hi, welcome to LQ!
Thanks, although considering my disaster start with linux, i'm not sure how long i'll stay :D

Your suggestion helped me google this out:

http://forums.techguy.org/linux-unix...swap-file.html

I'll try it in a couple of hours when i get home, and report back.

syg00 04-13-2012 03:29 AM
mkswap only writes a few sectors at the front of the partition - so the majority is left untouched. Once Bohdi started it may have actually used the swap - as may any liveCD. "used the swap" in this context probably means "some (more) data lost".
You don't say what the type of filesystem was on there previously.

NTFS is pretty robust if there is only minimal damage - I have also had some success with ext[34] without any external tools. Also (internal) RAID on btrfs. Depends ...
A LOT.

Forensic tools may work to get the majority back if you're lucky, but it's hard to have confidence in the results unless you can verify the data recovered. And it will take a similar amount of (currently free) space, and time. Maybe days.

Blank... 04-13-2012 04:03 PM
I tried to follow along, but can't get it. Problem is sda disk. It should have two partitions, and it did, until i ran "mkdir /mnt/sda2" when trying to mount sda5, after i ran cfdisk for the first time. Sda2?! Why don't i think before hitting enter?
Now, fdisk lists me this, looks like three partitions:

Code:
root@ubuntu:/home/ubuntu#  fdisk -l

Disk /dev/sda: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders, total 156301488 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x8d3c8d3c

  Device Boot      Start        End      Blocks  Id  System
/dev/sda1  *          63    8401994    4200966    7  HPFS/NTFS/exFAT
/dev/sda2        8402056  156280319    73939132    f  W95 Ext'd (LBA)
/dev/sda5        8402058  156280319    73939131    7  HPFS/NTFS/exFAT

Disk /dev/sdb: 300.1 GB, 300090728448 bytes
255 heads, 63 sectors/track, 36483 cylinders, total 586114704 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb4c74c34

  Device Boot      Start        End      Blocks  Id  System
/dev/sdb1              63  586099394  293049666    7  HPFS/NTFS/exFAT
root@ubuntu:/home/ubuntu#
Notice that cfdisk did change sda5 to NTFS, but i can't mount it.

Code:
root@ubuntu:/home/ubuntu# mount -t ntfs /dev/sda5 /mnt/sda5
NTFS signature is missing.
Failed to mount '/dev/sda5': Invalid argument
The device '/dev/sda5' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
root@ubuntu:/home/ubuntu#


Not only that, but cfdisk still sees it as swap (and no that third phantom partition).

Code:
cfdisk (util-linux 2.19.1)

                                                          Disk Drive: /dev/sda
                                                    Size: 80026361856 bytes, 80.0 GB
                                          Heads: 255  Sectors per Track: 63  Cylinders: 9729

      Name                Flags              Part Type        FS Type                    [Label]                  Size (MB)
 --------------------------------------------------------------------------------------------------------------------------------------
      sda1                Boot                Primary          ntfs                                                  4301.83         
                                              Pri/Log          Free Space                                                0.04        *
      sda5                NC                  Logical          swap                                                  75713.68        *
                                              Pri/Log          Free Space                                              10.84        *


        [ Bootable ]  [  Delete  ]  [  Help  ]  [ Maximize ]  [  Print  ]  [  Quit  ]  [  Type  ]  [  Units  ]
        [  Write  ]

                                              Quit program without writing partition table

However, even though it says "swap" when i try to change it's type, type is 83, not 82:


Code:
                                                      cfdisk (util-linux 2.19.1)

                                                          Disk Drive: /dev/sda
                                                    Size: 80026361856 bytes, 80.0 GB
                                         
 01 FAT12                18 AST SmartSleep        56 Golden Bow            9F BSD/OS                DE Dell Utility
 02 XENIX root            1B Hidden W95 FAT32      5C Priam Edisk          A0 IBM Thinkpad hiberna  DF BootIt
 03 XENIX usr            1C Hidden W95 FAT32 (LB  61 SpeedStor            A5 FreeBSD              E1 DOS access
 04 FAT16 <32M            1E Hidden W95 FAT16 (LB  63 GNU HURD or SysV      A6 OpenBSD              E3 DOS R/O
 
  <CUT>

        Enter filesystem type: 83
I tried to change it to 7 (again), but - no go. This is what it says:

Code:
                                                      cfdisk (util-linux 2.19.1)

                                                          Disk Drive: /dev/sda
                                                    Size: 80026361856 bytes, 80.0 GB
                                          Heads: 255  Sectors per Track: 63  Cylinders: 9729

      Name                Flags              Part Type        FS Type                    [Label]                  Size (MB)
 --------------------------------------------------------------------------------------------------------------------------------------
      sda1                Boot                Primary          ntfs                                                  4301.83
                                              Pri/Log          Free Space                                                0.04        *
      sda5                NC                  Logical          swap                                                  75713.68        *
                                              Pri/Log          Free Space                                              10.84        *


        [ Bootable ]  [  Delete  ]  [  Help  ]  [ Maximize ]  [  Print  ]  [  Quit  ]  [  Type  ]  [  Units  ]
        [  Write  ]
                Wrote partition table, but re-read table failed.  Run partprobe(8), kpartx(8) or reboot to update table.
                                            Toggle bootable flag of the current partition

The only option, from the three bolded ones above, that i know how to do is - reboot. But that does nothing, everything just stays like it is. Fdisk says NTFS id 7, cfdisk says swap but 83.
I'm running Lubuntu live CD btw. (if that has anything to do with anything, this is my first real contact with linux).


This is how Partition Table Doctor in Windows saw it:

http://img585.imageshack.us/img585/2082/53248956.jpg
http://img713.imageshack.us/img713/5740/73288388.jpg


After trying to fix it:

http://img252.imageshack.us/img252/6690/56531911.jpg



What can i do? Can i do anything?

Thanks in advance!


All times are GMT -5. The time now is 05:02 AM.