LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 08-05-2009, 07:04 PM   #1
theblang
LQ Newbie
 
Registered: Aug 2009
Posts: 6

Rep: Reputation: 0
Accidentally deleted NTFS partition with GParted


I meant to delete the partition on a USB stick using GParted, instead I made the big mistake of deleting the NTFS partition on my 500gb external drive. I desperately need to fix this; the external is my central storage and contains a massive amount of files I would really hate to lose. I know I could data carve if worst comes to worst; but, restoring the partition table data would save me hours and hours of work. I have heard a lot of mention about testdisk; however, it does not seem to find any partitions when I run the search. Does anyone have any other suggestions?
 
Old 08-05-2009, 07:24 PM   #2
pljvaldez
LQ Guru
 
Registered: Dec 2005
Location: Somewhere on the String
Distribution: Debian Wheezy (x86)
Posts: 6,094

Rep: Reputation: 281Reputation: 281Reputation: 281
You can also try using gpart (not to be confused with GParted).
 
Old 08-05-2009, 08:14 PM   #3
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
Did you also format a new partition on it?

If you only repartitioned, you could use "losetup" to try to mount the ntfs partition. If it was the first partition on the disk, try:
sudo /sbin/losetup -fs </dev/sd#> -o $((63*512))

Use the device node for the disk, such as /dev/sdb. This command will respond with which loop device was used. For Windows XP and Linux, the first partition nearly always starts on block 63. Let's assume that it replies "loop0".

sudo file -s /dev/loop0

This will indicate the filesystem of the partition. If it says bootable partition or NTFS, you can try mounting the loop device.

sudo mkdir /mnt/recover
sudo mount -t ntfs /dev/loop0 /mnt/recover

If there is more than one partition on the disk, you can use:
df /mnt/recover
or
df /dev/loop0
to get the size of the first partition. The next one will be above it, but may start rounded up at the next cylinder.

One tip is to use a block size of 512 for both fdisk and df. This is especially important for the first partition, because it doesn't start on a cylinder boundary. Write down the offsets used for losetup for each partition. They can be used with "fdisk -u" to repair the partition table.
 
Old 08-05-2009, 09:44 PM   #4
mushroomboy
Member
 
Registered: Jan 2006
Distribution: Debian Testing ALWAYS!!!
Posts: 363

Rep: Reputation: 43
I did this before, only I was working with ipodlinux... Blech, I'd say get some raw data readers and try to recover files.... Normally you don't get everything, but if you do it before using the drive again you can get quite a bit. I've recovered hdds that even had a quick format done, believe me when you delete the data isn't usually gone. Though if you use a zeroing program...

Last edited by mushroomboy; 08-05-2009 at 09:45 PM.
 
Old 08-05-2009, 10:23 PM   #5
theblang
LQ Newbie
 
Registered: Aug 2009
Posts: 6

Original Poster
Rep: Reputation: 0
Thanks so much for your response! I grabbed GPart, it gives me a seek failure error when trying to run it with the -f option though.
 
Old 08-06-2009, 01:35 AM   #6
theblang
LQ Newbie
 
Registered: Aug 2009
Posts: 6

Original Poster
Rep: Reputation: 0
jschiwal, thanks so much for your comments. When I ran testdisk it said it found a backup NTFS partition, I choose to restore it. In addition, it asked to rebuild the boot table, I think. Unfortunately, this didn't work. I am afraid this might have even done more damage, I am not sure. I got GPart to work correctly and it is scanning right now. I know the data is still there, what I don't know is what was deleted when I misused GPartition and/or what was overwritten when I tried to repair using testdisk. This drive contains years worth of files, organized on top of that. Restoring this partition would be so much better for me than data carving it. In addition, I would really like to do it for the learning experience. Any comments that could point me in the somewhat right direction would be so greatly appreciated!
 
Old 08-06-2009, 04:19 AM   #7
mushroomboy
Member
 
Registered: Jan 2006
Distribution: Debian Testing ALWAYS!!!
Posts: 363

Rep: Reputation: 43
Well depending on your resources, you might have wanted to do a HDD dump, I know 500G is a large dump, but with the size of HDDs these days it can be done, that way you could have ran other programs to "fix it" and if things went bad just use a program to do a re-write... Though I know in all honesty this may not be helpful in your case. Just if you ever have something like this happen on a smaller HDD you might be able to do it. I remember when back when I used to do dumps of Xbox HDDs so I could insert files, you always made a 10G dump of the HDD, incase the file insertion to fatx didn't work. =S But yeah, that's only a method you can do if you have the resources.
 
Old 08-06-2009, 10:46 AM   #8
theblang
LQ Newbie
 
Registered: Aug 2009
Posts: 6

Original Poster
Rep: Reputation: 0
I actually do have the resources. I should NOT have used the testdisk program last night. I got ansy thinking it would work after hearing so many people talk about it recovering their partitions. Right now I am in our school's computer forensics lab imaging the hdd onto a 1 TB hdd (using FTK imager). I will definitely wait for it to image before I try anything else. I do need some insight on where to go from here though. I am beginning to think data carving is going to be my only option. If that is the case I could really use some suggestions on software.
 
Old 08-06-2009, 11:13 AM   #9
pljvaldez
LQ Guru
 
Registered: Dec 2005
Location: Somewhere on the String
Distribution: Debian Wheezy (x86)
Posts: 6,094

Rep: Reputation: 281Reputation: 281Reputation: 281
I've typically used foremost and photorec to recover files. The major downside is that you get a bunch of files named with random strings of numbers and an extention like "124234321.doc". Sometimes you can run scripts to search through the file metadata and restore filenames that way. So it works really well for photos since most cameras just name them gibberish anyway. But for documents it's more painful to go through each document to figure out what it is.
 
Old 08-06-2009, 12:28 PM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by theblang View Post
I should NOT have used the testdisk program last night. I got ansy thinking it would work after hearing so many people talk about it recovering their partitions.
Best not disrespect an application because it didn't work once and in your case. Especially not since sofar you haven't posted an exact account of what you've done.


Quote:
Originally Posted by theblang View Post
Right now I am in our school's computer forensics lab imaging the hdd onto a 1 TB hdd (using FTK imager). I will definitely wait for it to image before I try anything else. I do need some insight on where to go from here though. I am beginning to think data carving is going to be my only option. If that is the case I could really use some suggestions on software.
Kinda odd. If you know FTK Imager then you also know you that when you open a disk or image you can peruse the file tree in wndws explorer stylee. With that you would have a first assessment of the disks partitioning and the partitions "health". And you would like to have one because carving really is a last ditch effort.

Last edited by unSpawn; 08-06-2009 at 12:29 PM.
 
Old 08-06-2009, 01:31 PM   #11
theblang
LQ Newbie
 
Registered: Aug 2009
Posts: 6

Original Poster
Rep: Reputation: 0
unSpawn, My mistake. I was definitely not trying to disrespect the program. I was just stating I should not have used it before first imaging the hard drive. Testdisk did not find a partition with quick search; however, it found a backup ntfs partition with deep search. I then hit enter on the ntfs partition. It wrote it and asked me to restart. Unfortunately it did not fix the problem which leaves me wondering if I may have done something wrong, in which case I probably did more damage. If I load the hdd in FTK Imager I see a file tree consisting of a Partition 5, which has an unrecognized file system that contains 488,384,001 KB of unallocated space. The hex shows that this space definitely contains data. Also I see an Unpartitioned Space which contains a 0KB unallocated space folder and a 1KB MBR. I am not sure if this is the MBR for my file system before I deleted it, or if it is something testdisk wrote.

Last edited by theblang; 08-06-2009 at 01:36 PM.
 
Old 08-06-2009, 06:34 PM   #12
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by theblang View Post
I was just stating I should not have used it before first imaging the hard drive.
True but depending on the disk layout and what you did all may not be lost...


Quote:
Originally Posted by theblang View Post
Testdisk did not find a partition with quick search
BTW, you having access to your schools computer forensics lab, does that imply you get trained in forensics? Anyway. Once you successfully made your backup load testdisk again, select Intel Partitioning, Analyse but don't hit enter yet. At the bottom of the screen select "Backup", say no to Vista, and let testdisk run. Depending on how many partitions the disk contained testdisk will seek for the backup MFT (located at the end of the partition). If it found the copy then at the bottom of the result screen select "Write" and quit testdisk. If all went well then running 'ntfsinfo -v -mft /dev/devicenamepartition' should now return the MFT's contents and ntfs-3g will mount the partition without problems.
 
Old 08-06-2009, 06:52 PM   #13
jlinkels
LQ Guru
 
Registered: Oct 2003
Location: Bonaire, Leeuwarden
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 5,195

Rep: Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043Reputation: 1043
Isn't so that when you delete a partition, the partition table is changed and nothing else? I am not sure about more sophisticated programs like GParted, but I remember simpler programs like cfdisk. When I deleted a partition and recreated it, all my data was still there. A partition table is nothing more than a set of pointer to the first sector of a partition. Is is possible just to recreate that NTFS partition? Of course you should NOT format it. As a matter of fact only the start sector is relevant, so even if you can't remember the exact size it wouldn't do much damage.

jlinkels
 
Old 08-06-2009, 07:38 PM   #14
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Yeah, you're right, it should work that way provided nothing else was overwritten. Somehow I got Partition Table trouble during testing at which point ntfs-3g didn't want to mount it, ntfsinfo didn't see no NTFS and wndws decided to show the partition as the dreaded "RAW". Retesting it by letting Gparted delete the partition and restoring the PT from within testdisk did show a healthy and mountable NTFS partition. Beats me...
 
Old 08-06-2009, 07:43 PM   #15
jay73
LQ Guru
 
Registered: Nov 2006
Location: Belgium
Distribution: Ubuntu 11.04, Debian testing
Posts: 5,019

Rep: Reputation: 133Reputation: 133
Has happened to me before. When it did, I used testdisk to determine the start and end of the deleted partition, then I restored those manually using fdisk.

Deleting a partition only removes it from the partition table, nothing bad has happened until you overwrite it with a new filesystem.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Oops, I accidentally deleted my NTFS partition!!! How to recover? WindowBreaker Linux - Newbie 1 07-03-2009 07:28 PM
Gparted use from partition to be deleted? drmjh Linux - General 4 09-28-2008 08:53 AM
Accidentally Deleted Partition Table jani_fedora Linux - Hardware 3 03-27-2008 05:24 PM
Accidentally deleted debian partition PLZ HELP andymadigan Debian 7 09-01-2004 10:09 PM
accidentally deleted /boot partition, yet it boots timsch75 Linux - General 6 04-08-2004 02:51 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 10:07 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration