| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 128277 | 2012-12-10 04:02:00 | Accidental format of OS in Ubuntu | Curbd (13334) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 1317418 | 2012-12-10 06:45:00 | Thanks gary67, although painful I think I'll take the long approach - I can't risk errors. Thanks for the link, it's great to see that somebody has created the resource! Ok, question, in TestDisk I am asked what partition table the drive has. It was originally NTFS, but when I formatted it it was set to Ext3. My options in TestDisk are: Intel - Intel/PC partition (selected by default by TestDisk) EFI GPT partition map (Mac i386, some x86_64) Humax partition table Apple partition map Non partitioned media Sun Solaris partition XBox partition What should I choose? Thanks. Curbd. The default. If in doubt, leave it alone! :) |
pcuser42 (130) | ||
| 1317419 | 2012-12-10 07:26:00 | The default worked well, on its initial scan it didn't find the NTFS partition, but on the second deeper scan it did. I'm confused by the documentation of TestDisk, I'm not sure why they press 'Backup BS' / 'Copy backup boot sector over boot sector'. www.cgsecurity.org The sectors used in the Linux partition and the NTFS partition are identical. I don't know whether to now tell the program to delete the linux partition and make the NTFS one a primary partition. If I ask it to list the files of the NTFS partition it says 'Can't open filesystem. Filesystem seems damaged'. I don't know if this is enough information for anyone to assist, if not I'll take a stab. Thanks. Curbd. |
Curbd (13334) | ||
| 1317420 | 2012-12-10 07:48:00 | I'm confused by the documentation of TestDisk, I'm not sure why they press 'Backup BS' / 'Copy backup boot sector over boot sector'. www.cgsecurity.org The sectors used in the Linux partition and the NTFS partition are identical. I don't know whether to now tell the program to delete the linux partition and make the NTFS one a primary partition. If I ask it to list the files of the NTFS partition it says 'Can't open filesystem. Filesystem seems damaged'. That's not a good sign. They are not two separate partitions, you can't "delete one and make the other one the primary". What it is doing is attempting to retrieve the configuration of the old NTFS format of the partition from the backup boot sector and MFT so it can write it back to the correct place, overwriting the new ext3 info you put there by formatting it. If you are lucky, the file system should be mostly intact, however what you have posted looks like you might not be. Once you have restored the NTFS partition info, I would try a chkdsk run over it, from a Win boot disk or another system. Of course, if the data is important, you should be doing all this on an image of the original drive, or better yet, just restoring from your backup ... :) |
fred_fish (15241) | ||
| 1317421 | 2012-12-11 05:07:00 | Thanks for the advice fred_fish. My files have been retrieved! I'll list down what I went through for The Error Guy and incase it can help anyone else: System Rescue CD: I downloaded the 'System Rescue CD' live disc, it's simply a CD that you can put into the computer at boot and load 'TestDisk' (and 'PhotoRec') by CGSecurity. I downloaded this on another computer and ripped the .iso image to CD using 'ImgBurn'. At boot it tells you to type in a command to go into the graphical mode, which I did. TestDisk I then went into the systems menu, and found 'TestDisk'. I performed analysis on the hard drive, and then the deeper analysis. Upon deeper analysis, TestDisk found that the drive had a NTFS partition on there somewhere, and it so happened to be in the same sectors as the Linux partition. I couldn't list the files under the NTFS partition, saying the boot sector or partition table was corrupt or something similar. I continued with TestDisk, and changed the Linux partition to 'D', for it to supposedly be deleted, and changed the NTFS (Windows) partition to 'P' for primary. I pressed the option for TestDisk to restore a backup of the boot sector, and tried to use the fix/write new boot sector option, which returned a corrupt error again. PhotoRec I ran PhotoRec by typing 'PhotoRec' into the terminal. Under settings you can change it so that all files will be saved, even if they are not recognisable files (such as .jpg or .bmp) by PhotoRec. This would be an important option to use to restore as many of your files as possible. Sadly I couldn't locate my external hard drive on the System Rescue CD's operating system, so I couldn't continue with the PhotoRec process. Windows Installation Disc I inserted a Windows Installation Disc (the kind that usually comes with your computer) at boot, and instead of pressing R, I pressed enter to continue with the Windows setup. At the next screen where you can select what drive you want to install Windows onto, there can be an option available to 'repair' the partition. This wasn't an option for me, so I exited out of it. I rebooted and tried pressing 'R' to use the recovery console, but it could only see the hard drives other partition (it's a Dell Media Direct partition, containing no useful Windows OS files as far as I can tell). If it had seen the right partition I would have tried 'fixmbr' and 'fixboot' at the command/terminal. Hard Drive in the second computer / Checkdisk I was running out of options, so I decided to unscrew the hard drive from the bottom of the laptop and insert it into my desktop computer. Thankfully it was very easy to remove, it only required a couple of screws to be removed and then it slid right out. It connected to my desktop with the SATA data and power cables in the desktop computer (I had to disconnect another drive temporarily). I booted up the desktop, and it automatically started Checkdisk (chkdsk). It took its time and I'm glad it did, it scanned through every sector and flashed file names up on the screen as it repaired them! The hard drive is 100GB, and the process took a couple of hours or more. I think it was important to have done the 'TestDisk' step earlier, as I think this allowed Checkdisk to see the partition. Copying the files My next step was to open the drive and see if I could fetch the files, success! I copy and pasted the files from the previously-corrupted hard drive onto another drive, using a portable program called X-Abakt. It's a portable program so doesn't need to be installed, and it is open source. The reason why I used Abakt was that I initially tried a copy and paste within Windows Explorer, but it got to a file that couldn't be copied and gave up. I now have all of my files back, and they work well! Does the hard drive work in the laptop? Putting the hard drive back into the laptop, and trying to boot from it doesn't work. It initially couldn't see the partition, so I added that with the command prompt on the Windows Installation Disc, but when I tried to boot it said that a windows .dll couldn't be found named 'hal.dll' in system32. It said to reinstall a copy of the missing file. I've decided to reinstall Windows at this point, I'm sure it could still have been recovered but for the extra time (and possible errors) it didn't seem worth it. I hope this is useful and that if you have any hard drive problems you manage to recover your files. Thanks so much for your help and hand-holding everyone, hugely hugely appreciated! Note: As soon as I realised I had accidentally formatted my hard drive, I turned the computer off and didn't use it to remove the likelihood of data being overwritten. Sorry for the tedious details, but if anybody else happens to run into the same problem it's better to have too much info than too little. Phew... :) |
Curbd (13334) | ||
| 1317422 | 2012-12-11 06:11:00 | Win! That's probably the best possible outcome. Yes, the change of partition-type label is essential. chkdsk then recognises the partition and uses the backup sectors and remaining structure to attempt to rebuild the filesystem info. Photrec is probably a last resort option. While it can read the data directly from the disk and recognise filetypes and boundaries based on header and footer blocks, without access to a valid MFT it has no way to determine filenames or to completely recover fragmented files. |
fred_fish (15241) | ||
| 1317423 | 2012-12-11 07:00:00 | Good on you for telling how you did it all. Thank you. | mikebartnz (21) | ||
| 1317424 | 2012-12-11 07:35:00 | Good you got your data back. Thanks for coming back and saying. Proves one thing as well ;) Even though a HDD is formatted, the data is not actually fully gone. |
wainuitech (129) | ||
| 1317425 | 2012-12-11 22:07:00 | Good to hear of your success but I would strongly advise you make a 1:1 sector-by-sector backup image of drives in this kind of state before you do anything to them. Next time you may not be so lucky - CHKDSK could just as well have decided the files were unfixable and deleted them all instead! |
Agent_24 (57) | ||
| 1317426 | 2013-01-11 07:27:00 | Good to hear of your success but I would strongly advise you make a 1:1 sector-by-sector backup image of drives in this kind of state before you do anything to them. Next time you may not be so lucky - CHKDSK could just as well have decided the files were unfixable and deleted them all instead! Good thinking Agent_24, do you have any software to recommend doing a 1:1 sector-by-sector backup with? Thanks all! Curbd. |
Curbd (13334) | ||
| 1317427 | 2013-01-11 08:22:00 | Sorry wrong thread! | KarameaDave (15222) | ||
| 1 2 3 | |||||