2y ago

Broke a partition. Is there any way of saving it?

While I was switching distros, I accidentally broke a partition. I'm almost certain that all the data is there, but it doesn't have a filesystem (I used ext4). Is there anything I can do to fix it, similar to changing the file extension without changing the contents. PS: It's a data partition. I was trying to resize it, accidentally also moved it to the left, found out that it was taking forever to move it, so I cancelled it. Finished the move to the left operation (I think), but it threw up an error about the filesystem. I don't remember what it was, though.

Thanks to everyone who suggested Testdisk. It worked almost perfectly.

19 comments

before you change anything it would be good to use dd and save the whole drive to a bigger drive or maybe compress it with gzip while using dd to save it to a slightly smaller one. That takes a very long time, but gives you the ability to start over with your recovery. Only do that if it's worth to wait several hours.
photorec can also recover some files by looking at the raw data still there, if all else fails.
- That’s what people always underestimate about data recovery jobs: you need lots of space. One copy for safekeeping. One to work on. One disk of the same size you store recovered files on.
  Whenever friends or family ask me to look at a disk I always tell them to give me the disk and two new ones of the same or greater capacity and I’ll give it a shot. Usually they discover the data isn’t that important after all. If it is I have all I need.
- use dd and save the whole drive to a bigger drive or maybe compress it with gzip while using dd to save it to a slightly smaller one
  command would be something like this:
  dd if=/dev/..../myparition|gzip status=progress > /mnt/external_hd/mypartition.gzip
  
  Wouldn't you want to use
  dd if=/dev/sda3 of=/dev/sdc1 status=progress && sync
  Where /dev/sda3 is the damaged partition and /dev/sdc1 is the freshly formatted external drive
  You'll find your attached devices with lsblk
  You're going to want to make sure /dev/sda3(broken partition) is unmounted so as not to write any more data to it.
First thing is to not mount it at all. Any writes to the overwritten partition will corrupt your data.
Second thing: install system rescue cd to a live usb and boot it. Look into testdisk and photorec. It's been a while since I've had to use these tools, but I believe testdisk can restore the partition and photorec can find files in a file system that has been deleted. I would try running photorec first to save the recovered files to an external hard disk, and then testdisk to try restoring them. But disclaimer: it's been a while since I've had to do this, so my memory is foggy here.
Good luck!
Try testdisk. It can find a filesystem, copy files from it or restore the partition that contained it.
It would help if you told us what exactly you did to break the partition.
You can try fdisk.
If the partition table is there - create a new partition at the exact same location, of the exact same size.
If the partition table is not there - create *the exact same type (mbr vs gpt) partition table, then do the first if.
Fdisk should tell you that it found a filesystem signature. Do not wipe it.
- there - create a new partition at the exact same location, of the exact same size.
  ... exact same starting block, size and geometry.
Check out testdisk file recovery.
- Seconded. This is one of the things testdisk is built for, searching for lost filesystems and adding partition table entries to recover them.
Depends on how you "broke" it.
First step is to back up whatever data is there. Boot into a rescue distro like GRML dd the block device to an external hard drive.
If you nuked the partition table, there may be additional work to rebuild it if you used GPT rather than MBR. But gdisk should also tell you if there are backups, which would make your life way easier.
If you still have a partition (like /dev/sda1) but the mount command claims that it cannot find a valid ext signature, you might be able to simply use mkfs.ext4. It's counterintuitive, but this isn't destructive and will recreate the filesystem leaving the data alone. And if it does turn out to be destructive, that's why you have your backup.
To recover from the backup, you can use scalpel or photorec from the testdisk package. Photorec holds your hand and can be run in read-only mode. Caveat: These tools work by looking for specific file headers and makes a best guess as to where it'll end (if the format doesn't have a defined footer).
In the car now, but I can respond with more detailed steps if your other options don't pan out.
Two tools worth using:
DMDE
Photorec
If the data is extremely important make a back up first.
Did you delete the partition? Or quick format?
Now learn 3:2:1 backup principles, this problem will recede, the lessons learned are for a lifetime, or more....

19 comments