While I was switching distros, I accidentally broke a partition. I’m almost certain that all the data is there, but it doesn’t have a filesystem (I used ext4). Is there anything I can do to fix it, similar to changing the file extension without changing the contents. PS: It’s a data partition. I was trying to resize it, accidentally also moved it to the left, found out that it was taking forever to move it, so I cancelled it. Finished the move to the left operation (I think), but it threw up an error about the filesystem. I don’t remember what it was, though.
Thanks to everyone who suggested Testdisk. It worked almost perfectly.
before you change anything it would be good to use dd and save the whole drive to a bigger drive or maybe compress it with gzip while using dd to save it to a slightly smaller one. That takes a very long time, but gives you the ability to start over with your recovery. Only do that if it’s worth to wait several hours.
photorec can also recover some files by looking at the raw data still there, if all else fails.
That’s what people always underestimate about data recovery jobs: you need lots of space. One copy for safekeeping. One to work on. One disk of the same size you store recovered files on.
Whenever friends or family ask me to look at a disk I always tell them to give me the disk and two new ones of the same or greater capacity and I’ll give it a shot. Usually they discover the data isn’t that important after all. If it is I have all I need.
use dd and save the whole drive to a bigger drive or maybe compress it with gzip while using dd to save it to a slightly smaller one
command would be something like this:
dd if=/dev/…/myparition|gzip status=progress > /mnt/external_hd/mypartition.gzip
Check out testdisk file recovery.
Seconded. This is one of the things testdisk is built for, searching for lost filesystems and adding partition table entries to recover them.
Depends on how you “broke” it.
First step is to back up whatever data is there. Boot into a rescue distro like GRML
ddthe block device to an external hard drive.If you nuked the partition table, there may be additional work to rebuild it if you used GPT rather than MBR. But gdisk should also tell you if there are backups, which would make your life way easier.
If you still have a partition (like /dev/sda1) but the mount command claims that it cannot find a valid ext signature, you might be able to simply use
mkfs.ext4. It’s counterintuitive, but this isn’t destructive and will recreate the filesystem leaving the data alone. And if it does turn out to be destructive, that’s why you have your backup.To recover from the backup, you can use scalpel or photorec from the testdisk package. Photorec holds your hand and can be run in read-only mode. Caveat: These tools work by looking for specific file headers and makes a best guess as to where it’ll end (if the format doesn’t have a defined footer). This means that you won’t be able to recover the filename and other metadata.
In the car now, but I can respond with more detailed steps if your other options don’t pan out.
First thing is to not mount it at all. Any writes to the overwritten partition will corrupt your data.
Second thing: install system rescue cd to a live usb and boot it. Look into
testdiskandphotorec. It’s been a while since I’ve had to use these tools, but I believetestdiskcan restore the partition andphotoreccan find files in a file system that has been deleted. I would try runningphotorecfirst to save the recovered files to an external hard disk, and thentestdiskto try restoring them. But disclaimer: it’s been a while since I’ve had to do this, so my memory is foggy here.Good luck!
It would help if you told us what exactly you did to break the partition.
Try testdisk. It can find a filesystem, copy files from it or restore the partition that contained it.
Now learn 3:2:1 backup principles, this problem will recede, the lessons learned are for a lifetime, or more…
