[Solved] Accidentally reformatted linux partition and worse installed new system

[wedgetail]

_steve
Yes you have just told me  

Continued
I did not have enough patience to wait for a full scan for the backup MBR I stopped the 1 hour scan after a few minutes found Winhex had already found a copy. Looked reasonable but since I had lost or overwritten the first sector with zeros I decided to take the found copy and use as boot sector. This at least has given something to experiment with I think.

Code: [Select]

[root@localhost gert]# fdisk -l /dev/sdb

Disk /dev/sdb: 500.1 GB, 500106780160 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x69205244

This doesn't look like a partition table
Probably you selected the wrong device.

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   ?       13578      119522   850995205   72  Unknown
Partition 1 does not end on cylinder boundary.
/dev/sdb2   ?       45382       79243   271987362   74  Unknown
Partition 2 does not end on cylinder boundary.
/dev/sdb3   ?       10499       10499           0   65  Novell Netware 386
Partition 3 does not end on cylinder boundary.
/dev/sdb4          167628      167631       25817+   0  Empty
Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order
[root@localhost gert]# fdisk /dev/sdb

old-polack
My next experiment would be to use fdisk to change the cylinders to agree with what originally was on /dev/sdb at least get the 3 partitions of NTFS right and then probably best delete the extended partition??

JohnBoy
Yes, about the "o" I am wondering if I don't need new RAM installed in my brain. I am going to test this later as writing an empty partition table seems to have filled at least the first sector with zeros.

I will go back and read up on TestDisk because I figured it would not find the backup MBR

[Was_Just19]

JohnBoy
Yes, about the "o" I am wondering if I don't need new RAM installed in my brain. I am going to test this later as writing an empty partition table seems to have filled at least the first sector with zeros.

I will go back and read up on TestDisk because I figured it would not find the backup MBR

You can tell Testdisk to keep looking for older tables if the first one or two it finds are not correct.
I have not had to go back very far myself, but have gone back a total of three ----  due to my own stupidity and using the wrong tools for the job initially. Testdisk saved the day in my case, thankfully   

regards.

[Old-Polack]

-steve
Thank you, not sure I will have room on my 500GB hard drive if I try out all those, many of the names I recogniose.  I will put on order a 1000GB drive just in case I get around to play more than I expected.

I have been a bit unlucky and actually lost the partition table on my /dev/sdb, perhaps should have waited until I got a new drive. The data loss here is not huge but a challenge, the partition table I think was over written in the boot sector. Since it was NTFS formats I know there is a MBR backup but I am not sure I have tracked such down before.  I have dealt with similar FAT16 and FAT32.   Bit of sidealley entertaining.   

You can use fdisk to recreate the partition table. Start with the o command to create a new DOS partition table. Use the n command to create a new p (primary) partition, using the same start and end cylinders as you posted above, for the first partition. Do the same for the next two partitions. Then create the extended partition to hold the remainder of the drive space, as mentioned before. Use the t command to change the ID for each of the first three partitions to 7.

At any time you can use the p command to see what the partition table looks like, at that point, and check for errors. If you spot any, use the d command to delete the errant partition, and any that follow it, and then the n command again to create  corrected partitions. All this takes place in memory only, so you can do and redo to your hearts content. When everything is finally correct, use the w command to actually write the partition table to the hard drive.

All your data should be intact, and your Windows installation should boot if you didn't remove the Windows boot code from the MBR as well. If you did, the fixmbr app from a Windows CD will restore that. If you have an old Win98 boot floppy and a floppy drive, you can run fdisk /mbr to also replace the Win boot data. Many of the various rescue CDs available from the net will also contain apps to restore the Windows boot code.

[wedgetail]

JohnBoy
When I went to the site for Testdisk I recognised I had been there before.  I have testdisk installed on this system,  I may even have installed it for 'bit of a run'. I don't recall if it was pre-installed on my 2010. Great program.

old-polack
Your instructions excellent, I carried out the sequence you describe and I have a very good record and still debating if I should attach it for others to have a look at. I recorded the konsole output as I went along.

I tested the use of the "o" option in fdisk while it says make an empty DOS partition you get a bonus when you write this to the disk, the only thing I can see in the boot sector jus about 4 bytes towards the end, could have been the start of the partition table, I did not hang around it looked like very empty sector.

The partition table came up as expected, the 3 primary and last was extended partition.

What I have done then was to run testdisk which found the previous layout of 8 partitions with first one bootable I wrote this table to the drive and it looks fine, later I discovered that the bootcode could have been written on its own, I may need this later but it will be some time before the drive gets in a bootable position. The drive automounts and I can read it.

Situation is: I have the drive as:

Code: [Select]

[root@localhost gert]# fdisk -l /dev/sdb

Disk /dev/sdb: 500.1 GB, 500106780160 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xb4810b4e

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1        1913    15366141    7  HPFS/NTFS
/dev/sdb2            1914        5737    30716280    7  HPFS/NTFS
/dev/sdb3            5738       21672   127997887+   7  HPFS/NTFS
/dev/sdb4           21673       60801   314303692+   f  W95 Ext'd (LBA)

Thumbs up for testdisk if that provides the boot code then most drive recovery seems covered with a Linux installation, I will check this further.

How do you recommend a bit clone of my remodelled /dev/hdx partition

[wedgetail]

Final ?

Not looking good for me  for the follwing reason.  I sorted out the side show with the NTFS partitions on the /dev/sdb guest drive I installed. Made a new 200GB partition /dev/sdb5

After some thinking took the plunge and connected the usb hard drive, /dev/sdc where I have the remodelled partition /dev/sdc1 then I used the dd command suggested previously

Code: [Select]

dd if=/dev/sdc1 of=/dev/sdb5 bs=4096 conv=notrunc,noerror

All went well and I removed the usb hard drive and went back to old-polack's suggestion about using the last superblock to recover the system. All this took some time, 2hours? as dd took about 6000 seconds,  but the outcome was the /dev/sdb5 seem restored after a lot of corrections and accessible.

The bad news was that it looked like XFCE that I have over written the partition with.

Now I am thinking that when XFCE was installed and reformatted the partition and then installed XFCE that all the superblocks ended up belonging to XFCE, ooops.  I no longer remember if I did set the partition allowed for XFCE. I thought I did because the second XFCE install I believe I did set about 10GB.

I may just try a few more superblock rebuilds.  I also ran photorec and searched out in empty space on text files, I gave up after about 10min which found about 1000 files. I opened a few and one confirmed that my data has been there but many files are unintellible.

Right now I have started up an older pc with 2009 and noticed that about 20% of my lost data can be recovered from here, a small consolation. Since 2009 is no longer supported I think I may seriously look at cleaning it out of the way and recover the space and prevent myself from getting tempted back here.  I will recover what I want and burn to DVD-R, they are bit hard to overwrite when done.

[OldJimbo]

I also ran photorec and searched out in empty space on text files, I gave up after about 10min which found about 1000 files. I opened a few and one confirmed that my data has been there but many files are unintellible.

That will be so with text  but run photorec specifically for image files first to regain any pictures, then by file type.

My sympathies! One of our tech people glitched the local server which then wrecked file system on remote back up... I was still checking and renaming files years later when I retired.

[Was_Just19]

All went well and I removed the usb hard drive and went back to old-polack's  suggestion about using the last superblock to recover the system. All this took some time, 2hours? as dd took about 6000 seconds,  but the outcome was the /dev/sdb5 seem restored after a lot of corrections and accessible.

You did not say on which HDD you did all this. Hopefully on the copy .....

Did you write zeros to the copy partition before the copy process?  You never mentioned it.

Hopefully you worked on the copy, and so can produce another one easily.

regards.

[wedgetail]

OldJimbo
Ouuccchh, that must have hurt. I did not have many pictures as we hold about 40GB of photos on the MS systems and only weeks ago my wife and I talked about cutting the required DVDs and seriously cull the collection.

I ran photorec out of curiosity and to gain a bit of experience, I have seen fair number of recommendations. I just wanted to see a few text files to convince myself that there was recognisable data, there was.

JohnBoy
Well I did mention for your benefit that I removed the USB hard drive before I started recovery action  
No I skipped the zero step as I understood that I was making a bit clone overwriting anything on the new partition?
Yes having removed physically the external hard drive there was no chance of causing more damage on the USB drive, but still plenty on the host pc but I escape serious damage.  Yes I can make another copy taking about 100 minutes, which by the way is not too bad for this old  USB hard drive.

General
Right now I am working on my previous workshorse PCLOS 2009 with some nostalgia as I sweatted a lot over that one too but it is time to say good by I really won't have the time to come back and play with it.  I do have good LiveCD of the base system, so that will have to do. So far I am getting rather fond of 2010.

Later tonight I will probably run another file system recover using the last but one superblock.

[Was_Just19]

JohnBoy
Well I did mention for your benefit that I removed the USB hard drive before I started recovery action   
No I skipped the zero step as I understood that I was making a bit clone overwriting anything on the new partition?
Yes having removed physically the external hard drive there was no chance of causing more damage on the USB drive, but still plenty on the host pc but I escape serious damage.  Yes I can make another copy taking about 100 minutes, which by the way is not too bad for this old  USB hard drive.

I guess when I have previous done a copy I have often used a destination that is larger than the original to be sure of getting everything ....  in which case I try to ensure there is nothing on the destination that does not belong to the original. Hence the zeroing of the destination first.
I have always tried not to make any changes at all to the original, choosing instead to work on the copy. When all data possible has been recovered I might try to resurrect the original ...  but most times not bother if the recovery has been successful.
Actually I much prefer if possible to clone the whole drive and work on that ....  if I have a suitable recipient to hand.
We all have different ways of working ....... keep at it 

regards.

[wedgetail]

Final !!!
I went back 3 superblocks from the end, the result pretty much the same. I find a workable system but XFCE is always there. I have now removed the guest drive so no more dd copies to be made. I have not reformatted the USB partition but I don't think I will wait much longer.  Too many other things to be done. The only thing I would have liked to do is and I may do this on the USB drive I will fill a lot of the drive with a pattern. Put a shorter version of of something on it and then see if I can recover as per old-poalck's instructions.

This would give me a bit more experience with DD.

I have cleaned up and found a small amount on one hard disk of the lost data a bit of consolation.  I will go through more backup stuff which I may have forgotten and recover a bit more.


JohnBoy
The idea of cleaning the whole partition beforehand is good, I think I might have done this if I had had some more time. I did end up with about 8-10% larger space than required I think but did not check deeper into that.