LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   Accidentally deleted NTFS partition with GParted (https://www.linuxquestions.org/questions/linux-software-2/accidentally-deleted-ntfs-partition-with-gparted-745430/)

mushroomboy 08-07-2009 02:57 PM

Ahh well it's good you have the resources to image, other than data carving I'm not too good at partition recovery since I've never had to do that thankfully. =) Hope things go well.

theblang 08-07-2009 03:59 PM

jay73, Could you tell me how you went about using fdisk to rebuild the partition table manually?

I used the deeper search option in testdisk. It found an ntfs backup partition and I wrote it to the hdd. Unfortunately, this did not fix the problem so I am afraid I may have done something incorrectly. Now if I go to the Advanced option I see an NTFS partition. If I try to undelete the partition testdisk tells me the file system is corrupt. If I go to the Boot Sector Recovery option and click on Rebuild BS or Rebuild MFT it tells me they match identically.

I know the file system information is written on the beginning of the hdd. It was an external storage drive and had only one partition. I know it was probably a matter of a few bytes being changed when I deleted the partition and that all of my data is still fine. Actually doing the repair, however, is a bit (no pun intended) too complex for me. I am imagining in my head the makeup of the NTFS file system. Somewhere is a MFT with pointers to all my files / fragments of files. I am really hoping that when I used testdisk originally to write the backup NTFS partition it found that I did not screw up the MFT or any other important tables in the file system header.

Any insight or direction from someone who knows more about this area would be greatly appreciated. I not only want to get my data back without having to data carve, but more importantly I would like to learn more on this area.

P.S. This is interesting. I went to Rebuild Boot Sector and this time it seems to be searching through the mft cylinder by cylinder. I wonder if this is rebuilding the mft?

unSpawn 08-07-2009 04:48 PM

Simply said, a DOS-compatible harddisk layout consists of a Master Boot Record, a Partition Table, (some cruft until the start of the first partition) and the partitions. The MBR resides in the first 512 blocks of the disk and tells the BIOS where to look for the next command to hand control over to. If testdisk is asked to write a clean MBR it will only affect that area. The PT starts at 446 blocks into the disk. If testdisk is asked to write a PT it will only affect that area. So testdisk would or could not have written into your NTFS partition to cause corruption if you let it write a MBR or PT. As far as I know the MFT and backup MFT only have bearing on the NTFS filesystem structure (like a superblock would for Ext{2,3}) and have no bearing on recovering your NTFS partition.

To recover a disk containing 1 partition that spans the whole disk you can use fdisk, delete any existing partitions (note this only affects the PT, not the disks contents), create a new partition and make it occupy the whole disk, change the type to (0x)7, write out the changes, quit. Worked OK for me. If none of this works then I suggest you give us some more detailed information like the output of 'testdisk /list /debug /log' after you have written the changes to the disk.


All times are GMT -5. The time now is 07:48 AM.