[SOLVED] Damaged partition table. How to restore it?

reddhawk · 2017-03-11 15:20:51

Hi guys, I accidentally issued this command:

mkfs.ext2 /dev/sda

After 2 seconds, it was obviously already too late. I canceled the command, but still my partition table is corrupted and my possibility to access the files inside gone.

So I gave a try to TestDisk and it found all the partitions previously present on my disk. The type of the partition table is mbr.

The only partition that I need is the 10th entry. I have the backup of everything but the the NTFS partition.. I don't care about the OS inside, but I care about some files inside it.

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
 D FAT16 >32M               0  32 33    32 194 34     524288 [NO NAME]
 D Linux                   35  79 45   133  23 18    1570816
 D Linux                  133 218 22  2744 175 55   41943040
 D Linux                 2121 109 37 82047  57 58 1284007936
 D Linux                82047  57 59 82177 196  3    2097152
 D Linux                82177 196  4 82308  79 11    2097152
 D HPFS - NTFS          82308  79 12 82365 172 47     921600
 D Linux                82308  79 12 82438 217 19    2097152
 D FAT32 LBA            82365 172 48 82378 108 34     204800 [NO NAME]
>D HPFS - NTFS          82438 217 20 121601  57 56  629143552

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 657 GB / 612 GiB

So, if I press P and try to copy the files inside it from this terminal, it says:

No file found, filesystem may be damaged.

My intention would be to restore the partition back in place and then try some other tool.

So, what's the best way to proceed from here in your opinion?

Last edited by reddhawk (2017-03-12 02:03:09)

Slithery · 2017-03-11 16:48:42

The quickest and easiest method is to just reformat the partition and restore all the data from your backup.

reddhawk · 2017-03-11 16:52:48

slithery wrote:

The quickest and easiest method is to just reformat the partition and restore all the data from your backup.

Which backup? How do I perform it?

ua4000 · 2017-03-11 17:03:14

Why should a mkfs.ext2 on /dev/sda1 damage the partition table?

This would be only the case if you have specified /dev/sda.

The only damage is the data inside your 1st partition - you don't need to restore the partition table - this would make things more worse.

Last edited by ua4000 (2017-03-11 19:06:25)

reddhawk · 2017-03-11 19:34:44

Yeah, sorry. I wrote the wrong command in the first post. I did

mkfs.ext4 /dev/sda

Also I found a backup of the files I had on Linux, but not a backup of the files I had on Windows. So now I have to restore that partition.

Editing the first post.

EDIT:
If possible the situation is even worse now. This is a timeline of what happened.

> All the partitions were healthy
> I launched a mkfs.ext4 /dev/sda (breaking the partition table) and I canceled it after 2 seconds
> I found the old partitions map using testdisk as you can see in the first post
> I realized I had a backup of the ext4 partition so I created a new GPT partition table and new partitions
> I realized I don't have a backup of that NTFS partition
> testdisk is not finding those partitions anymore, so I started a deep scan which is probably gonna take a long time
> I am now wondering if I can still do something about it

I spent 300+ hours on some of those files I need to get back. I feel depressed.

Last edited by reddhawk (2017-03-11 19:55:02)

Slithery · 2017-03-11 19:50:23

reddhawk wrote:

slithery wrote:
The quickest and easiest method is to just reformat the partition and restore all the data from your backup.
Which backup? How do I perform it?

The regular backup that you make of your computer. I don't know which method you use.

Last edited by Slithery (2017-03-11 19:51:49)

reddhawk · 2017-03-11 19:58:49

slithery wrote:

The regular backup that you make of your computer. I don't know which method you use.

Yeah, unfortunately I didn't make a backup of all the files. I'm wondering if I can make up for my past mistakes.

seth · 2017-03-11 22:13:56

If you didn't otherwise write to the disk, all you really need to do is to re-create the original partition table - the first partition is now likely compromised, but that should be it.
If you created a deviating PT and "used" the disk or, worse, created a new FS on the offset of the original NTFS partitions, you can start praying that your data can be recovered - but you'll get tons of anonymous files and file fragments (at best with proper extensions)

For the future:
1. Backup, cloud, github, whatever.
2. If you screw your data, DO NOT ATTEMPT TO RESCUE IT. You take a copy of the data and operate on that copy - notably if you don't know what you do. You fail? No problem, you still got a less broken copy around.

reddhawk · 2017-03-12 02:02:08

seth wrote:

If you didn't otherwise write to the disk, all you really need to do is to re-create the original partition table - the first partition is now likely compromised, but that should be it.
If you created a deviating PT and "used" the disk or, worse, created a new FS on the offset of the original NTFS partitions, you can start praying that your data can be recovered - but you'll get tons of anonymous files and file fragments (at best with proper extensions)
For the future:
1. Backup, cloud, github, whatever.
2. If you screw your data, DO NOT ATTEMPT TO RESCUE IT. You take a copy of the data and operate on that copy - notably if you don't know what you do. You fail? No problem, you still got a less broken copy around.

I'm reading this only now, but these are all gold advices. Thanks. For example I directly operated on the damaged disk but I should have done as you say, it's way safer.

I'm happy to say I recovered all the data I was searching for. I did as you say in the first part:

> After testdisk finished the deep scan (after hours), it found something like 30 old partitions previously created over the last years. One of these of the NFTS one I was searching for.
> I had testdisk restoring the partition and recovering NTFS boot sector from its backup.
> At this point some folders were still there, many not there at all or not entirely. Most of the files were organized in numbered folders with (fortunately) the original name and their extensions in the right place.
> Searching the name of the files through all of them, my files started to show up.

Thanks everyone, I'm marking the thread as solved.

JohnRobson · 2018-12-03 03:04:01

I already did several full upgrades using pacman, but twice (last time yesterday) my extended partition table (HOME) was damaged!!! But I recovered it with success

I always have backups of all my files and also have a copy of my Partition Structure, these are the commands:

# Backup only the Partition Table
$ sudo sfdisk -d /dev/sda > sfdisk_sda

# Restoring only the Partion Table (usually only this is necessary)
$ sudo sfdisk /dev/sda < sfdisk_sda

This is enough to recover your partition table, but if you also want the MBR:

# Backup MBR + Partition Table:
$ sudo dd if=/dev/sda of=mbr_sda bs=512 count=1

# Restoring only the MBR (without changing the Partition Table)
#$ sudo dd if=mbr_sda of=/dev/sda bs=446 count=1

# Restoring only the Partition Table (without changing the MBR)
#$ sudo dd if=mbr_sda of=/dev/sda bs=1 count=64 skip=446 seek=446

# Restoring the MBR + Partition Table
$ sudo dd if=mbr_sda of=/dev/sda bs=512 count=1

Last edited by JohnRobson (2018-12-03 03:04:32)

Arch Linux

#1 2017-03-11 15:20:51

[SOLVED] Damaged partition table. How to restore it?

#2 2017-03-11 16:48:42

Re: [SOLVED] Damaged partition table. How to restore it?

#3 2017-03-11 16:52:48

Re: [SOLVED] Damaged partition table. How to restore it?

#4 2017-03-11 17:03:14

Re: [SOLVED] Damaged partition table. How to restore it?

#5 2017-03-11 19:34:44

Re: [SOLVED] Damaged partition table. How to restore it?

#6 2017-03-11 19:50:23

Re: [SOLVED] Damaged partition table. How to restore it?

#7 2017-03-11 19:58:49

Re: [SOLVED] Damaged partition table. How to restore it?

#8 2017-03-11 22:13:56

Re: [SOLVED] Damaged partition table. How to restore it?

#9 2017-03-12 02:02:08

Re: [SOLVED] Damaged partition table. How to restore it?

#10 2018-12-03 03:04:01

Re: [SOLVED] Damaged partition table. How to restore it?

Board footer