Article 5GC94 Trying to recover a Hard disk. Help needed.

Trying to recover a Hard disk. Help needed.

by
Anil Kagi
from LinuxQuestions.org on (#5GC94)
Hello everybody,

I searched for similar discussions but couldn't find one that would resolve my issue.

I know practically nothing about fdisk except some basic things, but it has come upon me that I have to use it. I am hoping to achieve this with the help of knowledgeable guys on the forum.

I am trying to recover a lost partition and data on a 320 GB HDD, with the help of fdisk. I am just trying to follow steps given in a guide found on the web which I feel is promising.

Information regarding the machine I use:
It is a 10 year old Laptop with i3 early M series processor, 3 GB RAM and 300 GB HDD. The operating system on it was 'antiX-Frugal'. My HDD was partitioned from sda1 to sda7, if I can remember. There were 4 partitions with an extended partition.

Quote:
sda1 - Primary NTFS 223gb
sda4 - Extended ext4
-------- sda5 - ext4 for VMs 50gb
-------- sda6 - Linux swap 4.5gb
-------- sda7 - antix-Frugal 20gb

sda2 & sda3 are missing because, I had deleted a primary partition which was located before the current NTFS on which a dual booted Windows OS resided and another ext4 /home partition located after that. I merged the space created by deleting the two partitions into the NTFS by moving and extending it.
History of my case:
Six days ago, I was working with Gparted to create partition table in order to re-install antix-Frugal. I was under the notion that Gparted commits the selected action only when asked to but I was wrong. I chose msdos partition from 'Device' drop down menu. I got a warning that the entire disk will be erased, but I thought it will be only after I 'Apply the actions'. However the moment I chose to go ahead, the entire disk became 'Unallocated' to my terrible shock. I lost very important data compiled for nearly 10 years, which also contains some painstakingly accumulated educational research matter for my student son.

Immediately after that I had closed Gparted, rebooted and verified. I could not boot. I booted with live USB and checked in Gparted. The disk was still in 'Unallocated' state.

I successfully recovered the partitions and all the data on it with the help of Testdisk. After Testdisk recognized the partitions, I did, 'write & reboot' and everything was back to normal.

However, I got carried away and the first thing I did after the recovery was, I took out one of my old SD cards that was unusable, with the hopes of recovering it too. It had two partitions. One FAT32 & the other NTFS. I was not able to delete the partitions and format SD card. I tried all sorts without success. Then I tried by changing the NTFS file type to FAT32, also without success. So I gave up hopes and removed the SD card. However I was shocked to find that my hard-drive on which there wa a NTFS partition too, had also been changed to FAT32 and was unusable. It is the partition on which all my data resides.

I started Testdisk again, but this time it is not recognizing the partition as NTFS. It is recognizing it as a FAT32 partition. I tried to change it back to NTFS with the 't' option, but after choosing 't' the option to finalize it, i.e. 'write', does not show.

Then I checked with Photorec. It has searched files and it is saving recovered files. I see that those files are the ones that were on that drive. However, the recovery by Photorec is not much helpful. The data recovered is just a disorganized pile of data. Of course it is useful in recovering some important individual files but that too I have to sift through a huge number of files. However, the arrangement or the organization of attaching some supporting pdf, text, jpg, video files to the study notes I have created in an adjacent folder tilted attachments is gone. The real hard work of years is gone. I tried PRECsort.sh but it doesn't ameliorate things much.

I realize, I made a big mistake by not backing up the data. :( For nearly a decade, I had taken care not to loose the data without backing up, but now this happened.

If Photorec can detect the files, it shows that the files are still intact. I wonder, then why can't the partition table be recovered with Testdisk using the 'write' option? It would save the sorting of files recovered by Photorec.

I kept searching the web for solutions. I got this webpage [https://tldp.org/HOWTO/Partition/recovering.html], which has raised my hopes. However, as I was doing as guided in the website, I hit a road block in the very first step.

The website says one thing and what my terminal is returning is different. The website says;

Code:Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-23361, default 1):However, what I am getting is different, as shown below;

Code:Command (m for help): n
Partition type
p primary (0 primary, 0 extended, 4 free)
e extended (container for logical partitions)
Select (default p): p
Partition number (1-4, default 1): 1
First sector (2048-625142447, default 2048):My queries:
  • Is this guide suitable for my case?
  • Is there any other option for me that can help?
  • Why am I getting in fdisk return as;
    Code:'First sector (2048-625142447, default 2048):'instead of as shown in the website as below;
    Code:'First cylinder (1-23361, default 1):'What can I do about this?

    Edit:

    I found on the fdisk(8) - Linux manual page here that;
    Quote:
    CHS (Cylinder-Head-Sector) addressing is deprecated and not used
    by default. Please, do not follow old articles and
    recommendations with "fdisk -S <n> -H <n>" advices for SSD or 4K-
    sector devices.
    So, is there way to alter the guide given on this page accordingly and carry out the same steps given in there?
Any help in this regard is greatly appreciated.

Thank you and best regards
Anillatest?d=yIl2AUoC8zA latest?i=g_MHSlApSCQ:SbUMj7v3jmU:F7zBnMy latest?i=g_MHSlApSCQ:SbUMj7v3jmU:V_sGLiP latest?d=qj6IDK7rITs latest?i=g_MHSlApSCQ:SbUMj7v3jmU:gIN9vFwg_MHSlApSCQ
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments