[Solved] Recovering a partition table from backup superblocks...

Dizzy1 · 2011-07-26 19:07:35

of the partitions.

I overwrote the partition table with testdisk trying to recover a partition that I wrote over with the arch install when I realized that gnome didn't copy the hidden files from my home directory. So I killed the arch install (it had only downloaded a few packages) and tried to revcover it but failed.
Now I am asking for advice on how to remake the second and third partition that were originally on the disk from the backup superblocks, or if it is even possible. Thanks. I apologize if this is the wrong subforum for this type of topic.

Last edited by Dizzy1 (2011-07-27 16:26:22)

MoonSwan · 2011-07-26 19:16:27

Go to www.cgsecurity.org/wiki/TestDisk . They have guides to help your recovery prospects. By the way, that was a 3 second google search.

Dizzy1 · 2011-07-26 19:22:53

I have tried testdisk. It is the 6th word in my first post and it hasn't found either partition that I am looking for, just some fat16 and a fat32 partition.

MoonSwan · 2011-07-26 19:48:00

Did you try any of testdisk's advanced utilities at all? I've had success with that instead of just having it search for partitions. One of the advanced options is to search for superblocks IIRC and have the backup ones re-instated which should allow you to mount a partition long enough to grab your data. I use PartedMagic for this chicanery and it works well. I could recover the superblocks and fsck fixed them but after getting my data the partition was too far gone to recover much of the OS and some data.

Try the last option on this page, it may help: http://www.cgsecurity.org/wiki/Data_Recovery_Examples

Did you try the "Deeper Search" option after trying to find your partitions, as shown here half way down the page: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Dizzy1 · 2011-07-26 19:54:50

I have tried the deeper search option and it found nothing. But I can't follow the example the bottom of the page because the partition table is empty. Also it should be helpful to mention that the data hasn't been touched, just the partition table has been overwritten.

MoonSwan · 2011-07-26 20:04:03

If only the partition table has been over-written then you're correct in assuming the thing should be recoverable. Very odd, in your situation I'd use SystemRescueCD or PartedMagic to see if they offer utilities that would be more appropriate to the issue at hand.

The only other option I know of that may work is to use RIP (Recovery is possible) but all of its utilities are on the command line and thus, can be difficult to use.

I'm guessing photorec won't do much either but you could try it?

Dizzy1 · 2011-07-26 20:31:15

I am going to try RIP because parted magic doesn't seem to have anything that can help and neither does SystemRescueCD. But it doesn't seem to have anymore utilities than arch has available? (its running of a separate hdd on the machine)

Last edited by Dizzy1 (2011-07-26 21:36:55)

MoonSwan · 2011-07-26 21:38:19

I don't know a lot about RIP, just what I gleaned from their website once a while ago. The other distro I know made for this is Trinity. You can also try the wiki for arch-based distros; one on there is specifically a forensics distro. That might have more tools than you have now.

Sorry I'm not a lot of help, good luck!

Edit: apologies for my first post, I was being snarky and you don't deserve that (despite a lack of caffeine as the excuse!).

Last edited by MoonSwan (2011-07-26 21:41:29)

raijin · 2011-07-27 02:07:27

i ran into a similar problem when i _lost_ a xfs partition, the partiton table was overwritten and testdisk wouldn't find it.

parted rescue <start> <end>

It found and readded the partition to the table. The only downside is you need to know _around_ what sector the partition starts and ends.

Last edited by raijin (2011-07-27 02:08:52)

Dizzy1 · 2011-07-27 16:25:08

Thanks to all the people that have helped here, Testdisk actually did find the partitions but you need to enable the partitions created after vista when searching.

Arch Linux

#1 2011-07-26 19:07:35

[Solved] Recovering a partition table from backup superblocks...

#2 2011-07-26 19:16:27

Re: [Solved] Recovering a partition table from backup superblocks...

#3 2011-07-26 19:22:53

Re: [Solved] Recovering a partition table from backup superblocks...

#4 2011-07-26 19:48:00

Re: [Solved] Recovering a partition table from backup superblocks...

#5 2011-07-26 19:54:50

Re: [Solved] Recovering a partition table from backup superblocks...

#6 2011-07-26 20:04:03

Re: [Solved] Recovering a partition table from backup superblocks...

#7 2011-07-26 20:31:15

Re: [Solved] Recovering a partition table from backup superblocks...

#8 2011-07-26 21:38:19

Re: [Solved] Recovering a partition table from backup superblocks...

#9 2011-07-27 02:07:27

Re: [Solved] Recovering a partition table from backup superblocks...

#10 2011-07-27 16:25:08

Re: [Solved] Recovering a partition table from backup superblocks...

Board footer