Restoring deleted .ext4 partition which was deleted with cfdisk

ArchCroUser · 2021-01-06 02:19:56

First of all, I'm sorry if this is the wrong subforum, I tried to post in System Administration but it would not let me, so if this is the wrong place, please move the post to the appropriate one.

Hello guys, after a year on Manjaro, I decided to make the jump to Arch, and I LOVE it. The install went great, but I screwed up. In my PC I have 2 drives: an SSD (/dev/sdb) and an HDD (/dev/sda). During the installation, i went through the process of creating the partition tables with cfdisk, and I accidentaly erased the partition from the HDD (/dev/sda),. When I realized this, i just exited cfdisk and did not create any new partitions on that drive, because I did not want to risk losing any chance of retrieving the files already there. I installed Arch, then KDE, and then I started looking for a way to retrieve the data from the drive, but nothing works.

I downloaded testdisk, and watched 20 videos on how to use it, done some deep scans and found some files (not sure what they are, random numbers), but was unable to write the files to the drive because in testdisk it detected the drive as "none" in regards to partition table.

I have been running gparted in the background for 2 hours now, searching for a filesystem on the drive, but I don't think it will work

I would really appreciate any help that I could get, and I know that there are other forum posts out there with this kind of issue, but I couldn't fix this with the solutions from there.

Omar007 · 2021-01-06 10:22:09

Before trying anything, DO NOT MAKE ANY CHANGES TO THE DRIVE! Make an image from the HDD (e.g. with dd) FIRST and either work on that copy or keep it as a backup copy in case you screw things up.

If anything you did has written to the disk, it's probably over already and you can forget about it. If you wrote nothing to the disk at all other than the partition delete (fdisk->d->w and no other writes whatsoever), you can just recreate the partition.
When creating the partition, you MUST use the same start and end sectors as it had before you removed it!
It should then prompt you that it found/contains a filesystem signature (e.g. vfat, btrfs or even crypto_LUKS) and asks if you want to keep the signature or not. KEEP THE SIGNATURE!!
At that point you should be able to mount the filesystem as usual (`mount /dev/sdXN /path/to/mountpoint`). And maybe run a fsck (or equivalent) to make sure everything is ok.

Last edited by Omar007 (2021-01-06 10:28:42)

2ManyDogs · 2021-01-06 13:31:36

Moving to Newbie Corner.

ArchCroUser · 2021-01-06 14:37:32

I don’t think i've written anything to the drive. I've been careful not to download anything to the drive, and not to do anything with testdisk. Only folder on the drive is "Lost+Found", which was there by default and is locked.

I am not too familiar with dd, but if I understand correctly, the HDD image i would need to create would have the size of the entire drive (or at least of the files that are on it, without free space), and my problem is, no matter how I flip it, the image will not fit onto my SSD, and I don't know if it would be safe to put the image on the drive (I know it sounds dumb, but better make sure).

I tried going into cfdisk to create the partition, but it said "Device already has .ext4 signature" (sorry if written wrong, translated from German), and when I got to the "select partition table" section, .ext4 was not offered, so I quit so as to not f*ck everything up.

Also, how do i know what the start and end sectors were before I deleted it? (The partitions were automatically generated during the Manjaro install a year ago)

Last edited by ArchCroUser (2021-01-06 14:39:30)

seth · 2021-01-06 15:06:06

with cfdisk, and I accidentaly erased the partition from the HDD (/dev/sda),. When I realized this, i just exited cfdisk and did not create any new partitions on that drive

cfdisk requires you to write the new partition table - it asks you and if you didn't say "yeah, sure. i fucked up but please make that permanent" nothing was actually changed on the disk.

What's the output of "fdisk -l"?

ArchCroUser · 2021-01-06 15:16:24

Thanks for the quick reply, Seth

fdisk -l /dev/sda says

Festplatte /dev/sda: 931,51 GiB, 1000204886016 Bytes, 1953525168 Sektoren
Festplattenmodell: WDC WD1003FZEX-0
Einheiten: Sektoren von 1 * 512 = 512 Bytes
Sektorgröße (logisch/physikalisch): 512 Bytes / 4096 Bytes
E/A-Größe (minimal/optimal): 4096 Bytes / 4096 Bytes

English (Sorry if some errors) :

Drive /dev/sda: 931,51 GiB, 1000204886016 Bytes, 1953525168 Sectors
Drive Model: WDC WD1003FZEX-0
Units: Sectors from 1 * 512 = 512 Bytes
Sectorsize (logical/physical): 512 Bytes / 4096 Bytes
E/A-Size (minimal/optimal): 4096 Bytes / 4096 Bytes

seth · 2021-01-06 15:23:31

LC_ALL=C fdisk -l

Is there no partition table at all? (There should™ be more output)

ArchCroUser · 2021-01-06 15:28:36

This is all I get:

Disk /dev/sda: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: WDC WD1003FZEX-0
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes

Disk /dev/sdb: 111.79 GiB, 120034123776 bytes, 234441648 sectors
Disk model: Samsung SSD 850
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: C7E9ED48-61D4-1C4E-ACB9-D6C062A74558

Device Start End Sectors Size Type
/dev/sdb1 2048 514047 512000 250M EFI System
/dev/sdb2 514048 234441614 233927567 111.5G Linux filesystem

seth · 2021-01-06 15:31:00

Please use code tags, https://bbs.archlinux.org/help.php#bbcode

There's a blank drive (WD, 1TB) and a Samsung SSD (120GB) with an EFI and a linux partition.
Which one is the relevant drive?

ArchCroUser · 2021-01-06 15:34:34

The WD, 1TB Drive is the secondary drive that I accidentally fucked up. The SSD is my install, home and EFI partition.

seth · 2021-01-06 15:40:41

You can (and will have to) use testdisk to seach for the partitions if you didn't store the partition table elsewhere.
If testdisk comes up w/ a structure that looks similar enough to what you had before, there's a good chance it's the correct one.
Edit: https://www.cgsecurity.org/wiki/TestDis … partitions

Nevertheless, heed Omar007's advice and make a clone/backup of the drive.
You *will* have to write on it and if yo have to take a guess/bet, you might be wrong and that will lead to data loss.

Last edited by seth (2021-01-06 15:40:57)

ArchCroUser · 2021-01-06 15:55:13

When I load up testdisk with sudo (otherwise it won't detect the drive), I get this:

Disk /dev/sda - 1000 GB / 931 GiB - WDC WD1003FZEX-00MK2A0

Please select the partition table type, press Enter when done.
 [Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map (legacy)
>[None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection



Hint: None partition table type has been detected.

I know from prior experience that during deep search it would search ~121000 files, and display them later, but would not let me write them because it would ask me to select

None partition type

at the beginning, before the scan. Should I choose a partition type from the menu above (keep in mind the original drive partition was .ext4).

And what would be the dd command to create the drive image?

Last edited by ArchCroUser (2021-01-06 15:55:44)

seth · 2021-01-06 16:02:03

Well, you've to select the partition table type you previously used (Intel or EFI, the SSD has a EFI/GPT)

dd if=/dev/sda of=/some/path/on/a/drive/with/a/lot/of/free/space.img

The target must have >= 1TB free space.

ArchCroUser · 2021-01-06 16:11:55

Well, the image is pretty much out of the question then, I have no other drive (internal nor external) with the capacity, so I'll have to shoot my shot.

I guess I will have to try the GPT table, as I looked up the default Manjaro tables (drive was automatically partitioned on Manjaro), and GPT seems to be the default table over there.

Arch Linux

#1 2021-01-06 02:19:56

Restoring deleted .ext4 partition which was deleted with cfdisk

#2 2021-01-06 10:22:09

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#3 2021-01-06 13:31:36

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#4 2021-01-06 14:37:32

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#5 2021-01-06 15:06:06

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#6 2021-01-06 15:16:24

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#7 2021-01-06 15:23:31

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#8 2021-01-06 15:28:36

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#9 2021-01-06 15:31:00

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#10 2021-01-06 15:34:34

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#11 2021-01-06 15:40:41

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#12 2021-01-06 15:55:13

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#13 2021-01-06 16:02:03

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

#14 2021-01-06 16:11:55

Re: Restoring deleted .ext4 partition which was deleted with cfdisk

Board footer