Altered partition on an external disk - possible to recover data?

Retor · August 29, 2010, 12:56am

I have a 250 GB external disk, where there was store a hundred and something GB of data. Pictures, music, documents and TV-shows. It was FAT32.

In an attemt to make an live USB drive with openSUSE, I did exactly what I shoulden’t do: I mistook the external disk for the the USB drive.

Now the external disk has a 700 mb linux partition, while 232.2 GB is unpartitioned.

TestDisk from CGSecurity is looking to see if there is a lost partition table there, somewhere.

Is there anything I can do? There was no formating, so the data is still there (except for those 650 mb that was overwritten).

Is there any way to rebuild the old partition?

Output from “fdisk -l”:

Disk /dev/sdc: 250.1 GB, 250059350016 bytes
64 heads, 32 sectors/track, 238475 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x54688ed3

Device Boot Start End Blocks Id System
/dev/sdc1 * 1 683 699392 83 Linux

Disk /dev/sdc1: 716 MB, 716177408 bytes
64 heads, 32 sectors/track, 683 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x54688ed3

 Device Boot      Start         End      Blocks   Id  System

/dev/sdc1p1 * 1 683 699392 83 Linux

please_try_again · August 29, 2010, 1:25am

hmmm … You can still wipe out the partition table or delete the partitions with fdisk and create a Fat32 partition on the entire disk. As long as you don’t format anything, it will only modify the partition table. Unfortunately (not sure if I correctly remember) the file allocation table (FAT) is located in the first sectors of the partition and has been overwritten by the Linux partition ( /dev/sdc1 occupies sectors 1 to 683), so even if your data is still there, the filesystem doesn’t know where. You need to apply a FAT32 reparing tool on that partition. … but there is no garanty it will get back all your files.

martin_helm · August 29, 2010, 1:49am

There was recently a discussion here about data recovery, I saved one of the
suggestion made there (just in case):

> Try PhotoRec program.
> ‘PhotoRec - CGSecurity’ (http://www.cgsecurity.org/wiki/PhotoRec)

> There is a package in Packman repository.

I can not comment if that works or how good it is, but look at it to judge
yourself if you want to try it.

user · August 29, 2010, 3:16am

On 2010-08-29 01:06, Retor wrote:
>
> I have a 250 GB external disk, where there was store a hundred and
> something GB of data. Pictures, music, documents and TV-shows. It was
> FAT32.
>
> In an attemt to make an live USB drive with openSUSE, I did exactly
> what I shoulden’t do: I mistook the external disk for the the USB drive.
>
>
> Now the external disk has a 700 mb linux partition, while 232.2 GB is
> unpartitioned.
>
> TestDisk from CGSecurity is looking to see if there is a lost partition
> table there, somewhere.
>
> Is there anything I can do? There was no formating, so the data is
> still there (except for those 650 mb that was overwritten).
>
> Is there any way to rebuild the old partition?

What tools and what sequence did you use to commit the crime? >:-)

If you only used fdisk, then recovery is easy. If you used also a format tool, like mkfs, then
recovery is problematic, partial at most.

>
> Output from “fdisk -l”:
>
> Disk /dev/sdc: 250.1 GB, 250059350016 bytes
> 64 heads, 32 sectors/track, 238475 cylinders
> Units = cylinders of 2048 * 512 = 1048576 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disk identifier: 0x54688ed3
>
> Device Boot Start End Blocks Id System
> /dev/sdc1 * 1 683 699392 83 Linux
>
> Disk /dev/sdc1: 716 MB, 716177408 bytes
> 64 heads, 32 sectors/track, 683 cylinders
> Units = cylinders of 2048 * 512 = 1048576 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disk identifier: 0x54688ed3
>
> Device Boot Start End Blocks Id System
> /dev/sdc1p1 * 1 683 699392 83 Linux

Wow. You made a partition, and inside this partition created a second partition table with another
partition. See how this second table only sees “683 cylinders”? This partition table occupies
probably what would be the boot sector of what was the FAT partition.

I wonder how you managed to do that.
Was that intentional, for the live?

I would create an image copy of the entire disk, and probably work on that copy.

I would try running gpart to see if it finds the exact extents of the original partition table, and
if it does, then I would create it. Otherwise, create it as it probably should be, the maximum size
(your guess).

The next step I would try fsck and hope for the best. If this fails, then I would recreate from the
image, and try again repeating the procedure, but this time with some specialized recovery tool out
there instead of fsck.

–
Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” GM (Elessar))

Retor · August 29, 2010, 11:13am

Thank you, all. Will attempt these things. Right now i’m writing disk to iso.

The plan was to make a USB live drive, based on the openSUSE Live disk, using Imagewriter as instructed here: SDB:Live USB stick - openSUSE

How that works in datail, I do not know.

I think so. It was a drag and drop procedure, so imagewriter handled the heavy lifting.

Will do, and update when I know more.

Retor · August 29, 2010, 5:40pm

Update: I’ve made an ISO image of the disk. But was unable to mount it as a device, and therefor was not read by partition tools. So far it’s just for backup.

I’m running PhotoRec now, but the outcome is so-so. There are no files names, nor folder names. I’m allmost half way, and have 98 000 files that are unsorted. But this will help: After Using PhotoRec - CGSecurity

It reads all the data as a long stream and tries to guess what the bits and bytes are, and divide them into files and reconstruct it. mp3-s are cut or starts in the middle. Most of the data is spit out as txt-files (94 200 of the 98 000 files so far). Here an example of one:
“SSQPOOQQMNWXPMNSPOPQPSSPNSOKFJSYTPSTQVWVY
[WOSZ_XQPQSQSQQXXTVWXY\ZPMTSTSOMKJILMPTT[\ TOOLJPXYYYYYXX[XWWZZYTTYZYVXZYWVVSQSQPVWY
YVTTPNSTXZ\YTQPMNQTTQPNOOLMNKMLJMOTQOPQPOM
HIIKTVPMOQONLMMLMPPSQOOPQSMNQSTVVQOSSSPNNQY
VTSPOOTWXVONNMLNMMKOPQQOQQSQPONMOSWTPPPQO
LNTTQPPPOOPQQQPPONQPOSXVPNOPPSWSWWWZXQSTW
TQQWWTQSTPNNSYWQTVY[TQSPOVVPSVX[ZWSTYVPXYS
NVYXWTPPSOOPTTSSTPQTWTQOPQTSNKMQTSPQSSPOQV
PQSWMLg£”

(oh! Huzza! Just found some of the pictures from this summer. They’re spread all over the place, though. But readable and complete. And not sliced and divided like the MP3’s.)

I’m not sure what I’ll try next. But my plan is to do things that only read from the disk first, before I change anything and perhaps make matter worse. (For instance: There is suppose to be a backup boot sector (Advanced FAT Repair - CGSecurity), but if it is there, it might not be after I alter the partition tables once again.=

dvhenry · August 29, 2010, 6:44pm

I would have a close look at the tools here Programs, in fact I would use Parted Magic liveCD for this, by default it loads to RAM.

An .iso file is not what you want here, you want an exact copy. have a look at ‘man dd’

If you have no choice but to recover files from the actual damaged file system, please ensure it is mounted read only.

Retor · August 29, 2010, 8:49pm

Thanks. I’ll have a look at Parted Magic. It’s an external disk, so I didn’t think a liveCD would help - but will give it a try.

I couldn’t quite wrap my head around the instructions for dd, is there a … common command for what I need to do?

gogalthorp · August 30, 2010, 1:15am

dd is the common command

user · August 30, 2010, 2:28am

On 2010-08-29 21:06, Retor wrote:
>
> Thanks. I’ll have a look at Parted Magic. It’s an external disk, so I
> didn’t think a liveCD would help - but will give it a try.
>
> I couldn’t quite wrap my head around the instructions for dd, is there
> a … common command for what I need to do?

Supposing that /dev/sdc is where the damaged disk is, and that you have 300 GiB of free space in
/data/bigdirectory, the command would be:

dd if=/dev/sdc of=/data/bigdirectory/bigimage cbs=200M

(the cbs thing is optional, but faster run if you have that free memory)

The trick word for using that image as a disk is “loop devices”:

losetup /dev/loop1 /data/bigdirectory/bigimage

… stuff as needed, using “/dev/loop1” as you would use the disk

losetup -d /dev/loop1

Notice that this is not and ISO image. It is an image.
An ISO image is an image of an ISO disk, and you have a FAT32 disk, thus it is a FAT image.

A typical precaution with FAT disks was (this predates Windows) was to make a backup copy of the
Boot sector, FAT, and main directory tables, to a file, placed at the very end of the partition -
because there it is (hopefully) safe from most disasters, such as the current one, and very easy to
find.

In my MsDos days I think I made this with Norton or PcTools. It was possible to do that on every
boot (autoexec) or at the end, manually, same as we run a tool to park the HD heads. Oh tempora!

I’m sure there are tools nowdays to do the same.

–
Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” GM (Elessar))