LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 09-26-2011, 03:43 AM   #1
DarkWinterNights
LQ Newbie
 
Registered: Sep 2011
Posts: 3

Rep: Reputation: Disabled
Lost EXT4 Encrypted Partition


Hello,

As I have scoured the web, I find I am not alone in having erased a partition accidentally. However, in my search I have yet an approach that works for me as of yet.

I recently used Gparted to remove a couple of partitions I had on a drive (the contents of all the partitions I cannot recall, but the one in particular I am interested in was an encrypted EXT4), and then allocated a new NTFS partition over top of it. The particular partition was about halfway through the volume. Beyond additional storage space, this volume is otherwise unused.

I of course then realized that I had made a tremendous blunder when trying to locate the partition I had thought was on a different drive. I had started copying some files onto the drive but immediately stopped and unmounted the filesystem to prevent further data loss (the new data is irrelevant to me as I have copies and can destroy it).

After googling around and searching, I've found some documents indicating TestDisk may be appropriate for recovering this filesystem, but unfortunately a "Deep Search" of the volume reveals only the new partition I overwrote it with (basically a quick format).

Things are seemingly a little bleak - there was some important documents among the documents stored there (this partition made up the home directory of my computer prior to a reformat a while ago).

Has anyone else encountered a similar situation they have been able to recover from? Or any other software packages I may want to try?

Thanks in advance.
 
Old 09-26-2011, 04:04 AM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 19,253

Rep: Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395Reputation: 3395
How did you create the NTFS filesystem ?. If done from Linux (mkfs.ntfs) it zeroes the space first prior to doing the format of the filesystem metadata.
"(basically a quick format)" makes it sound like you did it from Windoze - I don't know what that mangles, but I believe it leaves most of the space untouched. Which in a normal environment might give you some hope of scraping the remnants of your files with something like photorec. But with a (probably) truncated encrypted f/s, I wouldn't like your chances - especially as all the metadata was probably at the beginning.
One of the forensic tools might help, but it would be a long shot.
 
Old 09-26-2011, 11:22 AM   #3
qlue
Member
 
Registered: Aug 2009
Location: Umzinto, South Africa
Distribution: Crunchbangified Debian 8 (Jessie)
Posts: 747
Blog Entries: 1

Rep: Reputation: 172Reputation: 172
You might be able to use testdisk to recover the partition. Photorec (included with Testdisk) won't help you, however, as the partition is encrypted.
 
Old 09-26-2011, 09:41 PM   #4
DarkWinterNights
LQ Newbie
 
Registered: Sep 2011
Posts: 3

Original Poster
Rep: Reputation: Disabled
Hi all,

Thanks for your replies.

Indeed, everything I've done is from Ubuntu specifically; kind of surprised I forgot such an obviously significant detail. I left TestDisk overnight to probe the drive in question and it came back to me (again) after a deep search with just the NTFS partition I had created earlier in addition to a Linux partition starting at 1 that is 1032 sectors in size; this isn't the partition I was looking for, and doesn't appear to hold anything meaningful (and wasn't a partition I would have created being so small).

I kinda realized I shot myself in the foot having encrypted the data - successfully making it unrecoverable especially with a number of other tools, but I guess that's the price of security. Ultimately, I suppose I have some paper copies of most of my documents at work, although I was hoping to save myself the headache of sifting and reorganizing, especially since I'm not entirely sure what is missing.

I'll probably try on of the trial versions of some of the other recovery software to see if it can help, but much of it appears to be Windows based, which to me suggests it won't play nice with most of the ext partitions that existed before (unless it indiscrimitately restores the data as it is).

I'm open to any other ideas and will post back with results if I have success with any other software package to hopefully help the next hapless dumb-dumb who repeats my mistakes. :P
 
Old 09-28-2011, 08:06 AM   #5
snooly
Member
 
Registered: Sep 2011
Posts: 124

Rep: Reputation: Disabled
It's probably gone. I've previously deleted partitions, and recreated them with the same settings, and sometimes even that doesn't work. I did that on purpose, trying to make more primary partitions available. And sometimes it doesn't work.

You did much more, you deleted the partition, then smashed it by making new partitions, making filesystems, and writing data to those filesystems. If you don't know exactly where your partitions were before, you've got no chance. Even if you do know, your chances aren't much better.

Do you have backups? If not, maybe next time you will.
 
Old 10-01-2011, 01:55 AM   #6
DarkWinterNights
LQ Newbie
 
Registered: Sep 2011
Posts: 3

Original Poster
Rep: Reputation: Disabled
Hi again,

Indeed, I nearly had a heart attack after I realized what drive I was actually writing to. I had a backup, but it was poorly maintained (actually, at this point in time, this partition was serving as the backup). I had accumulated too many discs and was in the process of amalgamating some of them. :P From the get-go I suspected I really didn't have much of a chance given all I had done, but thought I'd post just in case to get some additional insight. Fortunately, reviewing the paper copies at work, I realized the data was more dated than I had thought so ultimately I lost nothing of any real importance; I'm fortunate I had this mishap on something relatively insignificant.

Turns out, I was able to recover an otherwise lost partition, but not the one I was looking for. :P The encrypted partitions were basically lost in entirety, but the later partitions that weren't appearing in TestDisk appeared in a free Windows tool called EaseUS Partition Recovery (I tried a couple, and this one had the most success in this scenario), but is limitted in what kinds of partitions it can view.

I thought I would share the conclusion just for finality and anyone else looking for their options. Both TestDisk and EaseUS turned out to to do fairly decent jobs, just unfortunate with how late I realized my error - I could have potentially saved more had I noticed sooner lol. Hopefully a lesson learned on my part. :P
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] I need help converting a vfat extended partition into a ext4 partition zorro70 Linux - General 6 02-15-2011 09:55 PM
[SOLVED] Space available on ext4 partition jbcoats Linux - General 2 05-15-2010 04:27 AM
I may have lost my encrypted partition Syl Ubuntu 3 04-10-2010 04:26 PM
ext4 and / partition Pedroski Linux - Hardware 7 11-04-2009 08:44 PM
Ext4 partition corrupted by resized NTFS Vista C:\ partition? graviton-boson Linux - Newbie 2 03-16-2009 02:26 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 01:03 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration