undelete a deleted partition

[Hadeda]

I must apologize for not properly outlining the problem I am having right now.

1) I have no problems running testdisk.

2) I am having a problem using it for the purpose of undeleting a partition.

I am not experienced enough to navigate through testdisk, as most of the time, I don't know what I am looking at let alone how to press the right buttons without goofing things up.

My question is perhaps:
Does someone know of or have specific (step-by-step) instructions about how to undelete a deleted partition using testdisk?

Many thanks!

[winh8r]

Try having a look here:


http://ubuntuforums.org/showthread.php?t=1917047


hope this helps you in some way.

good luck

[varunendra]

My question is perhaps:
Does someone know of or have specific (step-by-step) instructions about how to undelete a deleted partition using testdisk?

Here you go: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Hope it helps you getting your partition/data back.

[Hadeda]

Thanks for all your excellent help, folks.

Step-by-step guides are great if the example mirrors one's problem. Mine was totally different as testdisk did not reveal any partitions during the first steps - any of the steps from then onwards were not applicable.
Screenshots attached for entry * Linux. The entry for P Linux reported: No file found, filesystem seems damaged.

It is possible that the first trial and error approach goofed things up. Do I have to reformat and do a new install?

Again, many thanks for your generous time spent.

[sudodus]

Don't despair yet, there is still photorec to recover the files you need. Probably Testdisk has not destroyed anything, at least not the parts of the drive where file data are saved. So before you repartition and/or reformat the drive, try to recover the important files with photorec!

Wait a minute! You can see partitions and the root file system with Testdisk Testdisk can read, and if you let it write the partition table, maybe you'll have it all back without resorting to photorec!

[varunendra]

Hadeda,

First off, do not try to fix the issue unless you are absolutely sure what you are doing! Any wrong attempt may further worsen the condition. This includes any attempts that may "Write" to the MBR or any of the partition tables.

Now,
Please explain in detail which was the partition you deleted (primary or logical, its size, type, etc) The boot info script does not give us any concrete details about the lost partition.

I would suggest to run Gparted from the live usb > list the hard disk in question > take a screenshot > post it back here and add some description of the partition that was lost.

We can then try to match it with any findings of testdisk and accordingly suggest you what to do next. It is always possible to recover the files unless they are overwritten, although it may be difficult (but not impossible) if the partition table got severely damaged. And so far I haven't noticed any activity in your descriptions that suggests any possibility of a 'damage' to the partition info.

There may be many possibilities and the 'gparted screenshot + partition description by you' would help us getting a better understanding of the situation.

And don't worry about our time. We do it because we enjoy it!


PS:
testdisk did reveal partitions. All those 'D' partitions are the deleted ones. We may just have to figure out which is the one that you want back.

[Hadeda]

Thanks to you all!

varunendra:

>I would suggest to run Gparted from the live usb > list the hard disk in question > take a screenshot > post it back here and add some description of the partition that was lost.

Gparted sda 56Gb.png attached.

> We may just have to figure out which is the one that you want back.

Excellent question. Problem is, I am not 100% sure anymore. I think that sda2 ought to be the working partition and have attached GParted sda2 49 Gb.png. But then, the 'unallocated' 2G partition is probably the one 'accidentally' deleted.

sd1 has no data other than the sector information and is probably an old 1st Ubuntu partition.

There is a probability that the unallocated space is the 2nd Ubuntu installation which I reduced to 2 Gb when installing a new installation on sda2. It is the one I accidentally deleted (Disk Utility shows it as "2.1Gb Free". In fact I am reasonably certain that this is the deleted Partition.

To clarify, there ought to be 3 Ubuntu partitions.

I searched for options in GParted:

Partition -> Check allowed me to "Check and repair filesystem (ext4) on dev/sda1" and "Check and repair filesystem (ext4) on dev/sda2" but not on the other 3 listings.
Naturally I would not press a button without your consent, so here is my question:
Would this be an easy solution?

p.s.: I am delighted to know that you are having fun. I must admit that it can be quite infectious...



edit:
I omitted to add the most obvious issue:
When running live USB I CAN mount and see the 4.1Gb partition in Nautilus!
It is just that the homefolder is encrypted and I am not experienced enough to fish through all the other system folders.

The 53 Gb partition cannot be mounted in Nautilus and the following box pops up:

Error mounting: mount: wrong fs type, bad option, bad superblock on /dev/sda2,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

[savanna]

Rather than downloading testdisk, just install it using apt:

% sudo apt-get install testdisk

Find the binaries:

% dpkg -L testdisk | grep bin

Run each of the binaries with -h or --help

[varunendra]

Sorry but at this point, I'm a bit confused with all the details you have provided so far. So I need you to restate them in a precise, sequential and related manner with the final goal you want to achieve.

Currently the questions in my mind are (please answer all of them, in the sequence they are asked):

a) Grub does not work
b) Murphy's law has it that I need data from the deleted partition

Q.1) Did grub work before the partition deletion?

Q.2) Is it some user data that you want to get back or is it just to make the grub boot again (presuming that deleting the partition was the reason why grub doesn't boot anymore).

There is a .deb version of testdisk which I eventually managed to install and run.
I thought that I did the right thing and followed instructions, but when re booting, end up where I started:
error: no such partition
grub rescue>

Q.3) Can you remember and tell us what exactly you did (also, how and with which partition) with testdisk in the above attempt?

=> Grub2 ( v1.97-1.98 ) is installed in the MBR of /dev/sda ....... core.img is at this location and
looks inpartition 8 for /boot/grub.
..
<snip>
..
sda1: __________________________________________________ ________________________
<snip>
Operating System: Ubuntu 10.04.3 LTS
Boot files: /boot/grub/grub.cfg /boot/grub/core.img

Obviously, grub is looking at a non-existent partition for the boot files, while from the screenshots of testdisk and the above outputs, it seems sda1 contains all necessary files required to boot Ubuntu 10.04 that is installed on it. Based on this info-

Q.4) Can you browse sda1 from the Live USB? Is that the "4.1 GB partition" you mentioned in the last post? If yes, what tells you it is 4.1 GB when gparted sees no 4.1 GB partition (I doubt a wrong size reporting due to errors in the filesystem or partition table).

Regardless of these errors (if I'm not missing something crucial), I think we can more easily manage to boot this partition by reinstalling grub.

Screenshots attached for entry * Linux. The entry for P Linux reported: No file found, filesystem seems damaged.

Most definitely it is the 49.25GB partition which although exists, but needs fixing to become usable (or maybe even more screwed, I don't know). So-

Q.5) Is that partition an outcome of your initial efforts with testdisk? It may get fixed with the "Check & repair" option of gparted, but as I said, it may also get even more screwed. So I'd say just leave it as it is, at least for now.

'unallocated' 2G partition is probably the one 'accidentally' deleted.

I also think so.

sd1 has no data other than the sector information and is probably an old 1st Ubuntu partition.

You mean sda1, right?

Q.6) How can you say it contains no data? Can you browse it from the live cd? I am wondering what has occupied that 3.85GB space on it if there is no data.

When running live USB I CAN mount and see the 4.1Gb partition in Nautilus!
It is just that the homefolder is encrypted and I am not experienced enough to fish through all the other system folders.

Well.. I've already asked what tells you it is 4.1GB in size (only the name displayed or have you checked its properties somehow).

Q.7) Even though you may not need to, can you browse through other folders freely except for the /home/<your home> folder?

The 53 Gb partition cannot be mounted in Nautilus and the following box pops up

Again, you mean 49.25 GB partition, right?

Lastly, (I may be repeating myself):

Q.8 ) What kind of data is it that you want to recover? What was its size (approx.)?

With so many installation attempts, I doubt if a running system is all that you want, and the data you are worried about is no user-data at all! If so, that would be the easiest thing to achieve. But if not, and it is really some important user-data, then with appropriate steps and some caution, we can get it back.

My questions may not be very well arranged, but you get the idea. I need a sequential and comprehensive summary of the problem, maybe with some background info that is helpful. I may not get much time until Monday, but there are a few possibilities that it would take no time at all to suggest solutions for.

[Hadeda]

Thanks, Savanna!
I'll try it out.