Try to recover my accidentally deleted Ubuntu volume

lilzz · 03-25-2016, 07:13 PM

I have A dual booted system with Ubuntu and window. I accidentally deleted the volume of Ubuntu in my window but the partition is still there but only marked as free.
I have bootable Linux USB AND I go into Ubuntu but I can't see my old volumes or old files.

Should I recover that deleted volumne from bootable USB Ubuntu or from window side? And how?

yooy · 03-25-2016, 07:22 PM

Quote:

Should I recover that deleted volumne from bootable USB Ubuntu or from window side? And how?

Niether, rocovering should start from bootable USB flash and attempted with test disk. But first decide if you are to rescue files or Dual boot config.

lilzz · 03-25-2016, 07:36 PM

Quote:

Originally Posted by yooy

Niether, rocovering should start from bootable USB flash and attempted with test disk. But first decide if you are to rescue files or Dual boot config.

I want rescue the dual boot config and files both. But files priority.

Yes, I have a bootable USB flash already with Ubuntu which allows me to boot into new ubuntu (not the ubuntu I lost)

So, now I install the test disk into the booted ubuntu and run it for recovery?

I enclosed a picture of the newly booted from the USB flash and I ran fdisk.

Can anyone see where my (lost and original Ubuntu volume)?

rknichols · 03-25-2016, 09:15 PM

It's "testdisk", not "test disk". You can install it in Ubuntu if you first enable the "universe" component.

What you really should have for these situations is SystemRescueCd, which is a bootable image that includes recovery tools like testdisk and photorec plus a lot more.

That said and looking at your screen capture, you probably had 55GB Ubuntu partition starting at sector 183140352 and ending at sector 291704831. Unfortunately, fiddling with logical partitions is dangerous because it involves writing secondary partition tables to the drive, and putting one of those in the wrong location could overwrite critical data, such as a filesystem header. You're a lot safer letting testdisk locate the missing partition and reconstruct the partitioning.

lilzz · 03-26-2016, 07:37 PM

OK,I started test disk and the following picture shows.

Are partition E extended and Linix swap are the ones I accidentally deleted??

But there is no option for me to undelete.

There is only image creation. Is it possible for me to recover the deleted partition?
How?

rknichols · 03-26-2016, 09:44 PM

No, those aren't your lost partitions. That screen is showing the ones that are still in the partition table.

That screen looks like you got into "Advanced Filesystem Utils". That's not where you want to be. Go back to the previous screen and select the "Analyze" function. It will run for a while and hopefully discover your missing partition.

lilzz · 03-27-2016, 08:34 AM

Ok, I use analyze function under test disk. And here it shows at picture 1.
Every one marked as D,deleted?

Under picture 2 is when I hit enter on any Linux partition or any one and it says nothing no partition found to recover.why?

Is that means no way to recover?

Picture 3 shows the Volume I accidentally deleted and now marked as green free space. That's Linux partition got messed up.

rknichols · 03-27-2016, 10:51 AM

In that first screen, you use the left/right arrows to change the partition characteristics from "D" to any of "*", "P", or "L". That's going to be "*" (bootable primary) for the first partition, "P" for the second, "L" for each of the two Linux partitions, and "P" for that last NTFS partition. Press <Enter> to continue, and the next screen will allow you to write out the new partition table.

Everything is there, including your missing partition. The new partition table will have slightly different limits than you had originally for the extended partition, but that's harmless. All the logical drives will be in the right place.

BTW, that Linux partition at CHS (11399 244 46) is right at LBA 183140352, where I guessed it would be. I was slightly off for the ending sector, though.

lilzz · 03-27-2016, 04:51 PM

OK, I try to change from D to the following. However, the Linux Swap won't allow me to change to L(structure: bad) . Only Linux is OK to be changed to L.
How do I go from here?

rknichols · 03-27-2016, 07:47 PM

Strange. There is no space for the required secondary partition table between your Linux partition and the swap partition. I don't know how it got that way since testdisk would be picking up the required size for the Linux partition from the filesystem super block it found.

Easiest thing to do at this point is just to delete the swap partition since you can always re-create it later. You should then be able to write out the new partition structure and access your files. Creating a new swap partition in the free space and running mkswap on it is straightforward, but be sure your files are OK first. I suggest running "e2fsck -n -f /dev/sda5" to ensure that the filesystem is OK. Do include the "-n" option so that e2fsck won't try to "fix" anything.

lilzz · 03-28-2016, 09:06 PM

Quote:

Originally Posted by rknichols

Strange. There is no space for the required secondary partition table between your Linux partition and the swap partition. I don't know how it got that way since testdisk would be picking up the required size for the Linux partition from the filesystem super block it found.

Easiest thing to do at this point is just to delete the swap partition since you can always re-create it later. You should then be able to write out the new partition structure and access your files. Creating a new swap partition in the free space and running mkswap on it is straightforward, but be sure your files are OK first. I suggest running "e2fsck -n -f /dev/sda5" to ensure that the filesystem is OK. Do include the "-n" option so that e2fsck won't try to "fix" anything.

OK, using e2fsck to check /dev/sda5 means I have go into the linux. how do you know sda5 is the linux partition I deleted by accident?

So, I used a linux bootable USB to boot into Ubuntu and ran frisk -l is display all the volumes and indeed sda5 is there. So my deleted files should be inside?

rknichols · 03-28-2016, 09:25 PM

That looks like you never wrote out the new partition table from testdisk. You've got to go back into testdisk, run "Analyze" again, set the partition characteristics to "*" (bootable primary) for the first partition, "P" for the second, "L" for first Linux partition, "D" (deleted) for the Linux swap partition that is involved in the conflict, and "P" for that last NTFS partition. Then press <Enter> to go to the next screen, from which you will be able to write out the updated partition structure.

yancek · 03-28-2016, 09:37 PM

sda5 is your swap partition and not a system or data partition. If you look at the output of fdisk in your last post and check the start and end columns for sda3, the Extended partition you will see it starts at: 183140350 and ends at 299995135. The only logical partition you have is the swap on sda5 which begins at 291706880. Your Linux system was on sda5 previously and when you deleted it, the swap which had been sda6 became sda5. That's the way it works with logical partitions. So your former Linux partition started at 183140350 and ended at 291706879. How you recover that with testdisk or some other utility, I don't know. Good luck with it. Watch out for that Delete button.

lilzz · 03-29-2016, 12:51 AM

Quote:

Originally Posted by rknichols

That looks like you never wrote out the new partition table from testdisk. You've got to go back into testdisk, run "Analyze" again, set the partition characteristics to "*" (bootable primary) for the first partition, "P" for the second, "L" for first Linux partition, "D" (deleted) for the Linux swap partition that is involved in the conflict, and "P" for that last NTFS partition. Then press <Enter> to go to the next screen, from which you will be able to write out the updated partition structure.

OK,
use test disk to write out the new partition done that.

use e2fsck to check files don't that.

What's the next step? I reboot but my dual boot feature is gone. (maybe I use window rescue before and it messed it up?)
My ultimate goal is able to boot into my old Linux. (not the the bootable USB I am currently deployed)

rknichols · 03-29-2016, 08:48 AM

Excellent! The filesystem looks good. I'm no expert on GRUB 2, but a Google search for "grub 2" and "reinstall" yields How to Repair, Restore, or Reinstall Grub 2 with a Ubuntu Live CD.

You're now without a swap partition. Making a new one is most easily done after booting your old installation:

Code:

$ sudo fdisk /dev/sda

Command (m for help): n
All primary partitions are in use.
Adding logical partition 6
First sector (291708928-299993087, default 291708928): 
Last sector, +sectors or +size{K,M,G,T,P} (291708928-299993087, default 299993087): 

Created a new partition 6 of type 'Linux' and of size 4 GiB.

Command (m for help): t
Partition number (1-6, default 6): 
Partition type (type L to list all types): 82

Changed type of partition 'Linux' to 'Linux swap / Solaris'.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

You will then need to format the swap partition with the same UUID that the old one had. First, run "sudo fdisk -l /dev/sda" to verify that your 4 Gigabyte swap partition is /dev/sda6. Then:

Code:

$ grep swap /etc/fstab
UUID=ae896e24-2e38-4368-8aef-07f44492689d  swap       swap    defaults        0 0
$ sudo mkswap -U ae896e24-2e38-4368-8aef-07f44492689d /dev/sda6

substitute the UUID displayed by that grep command in that mkswap command. Then you should be able to run:

Code:

$ sudo swapon -av
swapon /dev/sda6
swapon: /dev/sda6: found swap signature: version 1d, page-size 4, same byte order

swapon: /dev/sdb6: pagesize=4096, swapsize 4241489920, devsize=4241489920