I have just formatted an ext4 partition to fat32 using gparted.
I stupidly closed gparted before I realized that I might have been able to use the undo function. I am currently attempting file system recovery using gparted and I have the feeling that It won't do me any good having formatted to another partition type rather than accidentally deleting the partition.
Any help recovering the partition or data?
Answer
I made the silly mistake of formatting a partition by accident. I was installing a linux distribution called crunchbang on my netbook, so I don't have to bring my laptop to class every week. I was intending to format a USB flash drive for this purpose, when, to my dismay, I formatted an ext4 partition containing over 500gb of data to fat32. This is a summary of what I've learned:
If a filesystem is damaged, you can attempt to recover that filesystem itself, or individual files. Individual file recovery is possible regardless of the state of the filesystem, but it has the drawback of being almost completely useless if you are dealing with a lot of data. When you recover individual files, you are going to LOSE the ENTIRE directory structure of your data (that means organisation and filenames). In my case, this was completely useless, as it would take me years to sift through and rename all those music files and other junk. Also, In many cases the program will fail to find specific start and end blocks for your file (this is almost always the case with plain text files) and you could end up (like me) with each mp3 file split into a hundred 1-5 second pieces.
READ this all the way through before attempting anything... (you will find instructions for making an image of your disk at the bottom, but it should be done first)
If you are in a different situation (like recovering a very small amount of data or looking for a specific searchable piece of data), than individual file recovery could be an option for you. The free utilities I found for this are:
PhotoRec [NOT ENOUGH REP TO POST LINK]
and
ForeMost [NOT ENOUGH REP TO POST LINK]
(both are in the ubuntu repositories for your convenience)
If your intent is to recover an entire partition, then you should look towards a piece of software called TestDisk. This is also in the ubuntu repositories, and It has a nice curses GUI to make things easier. [NOT ENOUGH REP TO POST LINK]
TestDisk is compatable with all kinds of filesystems including ext2/3/4, ntfs, fat, and others.. (and the binary is released in Windows as well as UNIX compatible versions) Unfortunately after hours with this utility, TestDisk was able to find my old partition, but the root inode was destroyed, so I gave up on using TestDisk and decided to try to recover the ext backup superblock manually.
If your concern is a linux ext2/3/4 partition, then you will find these to utilities helpful (they will most certainly already be on your linux machine)
this will be used to calculate where the backup superblocks will be located in the event you were to create a ext filesystem on the partition in question mke2fs (make extended 2 file-system) for ext2/3/4
this will be used to attempt to restore the filesystem using one of the backup superblocks e2fsck (extended 2 file-system check) also for ext2/3/4
An explanation on how to recover an ext superblock manually using these utilities can be found here: http://ing-tani.blogspot.com/2013/01/repair-broken-ext4-superblock-in-ubuntu.html
SIDE NOTE: if your partition table is intact (not the case for me), then you could perhaps make use of dumpe2fs like so: http://www.cyberciti.biz/faq/linux-find-alternative-superblocks/
if you are unable to use these utilities to find the backup superblocks (perhaps you messed up multiple partitions, and because of this, you don't know where they start/end) you may find use of a program called gpart (not to be confused with gparted or parted... it's totally different) though I'm not sure if it supports linux file-systems newer than ext2.. If you are at this point, It may be time to start worrying.
Using this last approach, I was successfully able to recover the entire partition, save the top-level directory names (so I had to rename about 6 top-level folders, but everything below them was preserved) SUCCESS!
Another thing that ended up being EXTREMELY important for me was creating a backup image of the messed up disk (in my attempts to recover, I ended up restoring this image at least twice) so FIRST thing before using any of these utilities, find some free space on your machine or an external drive..
If your messed up drive is sda, and you wanted to store the image in yourname's home directory for instance: dd if=/dev/sda of=/home/yourname/sda.img.bak bs=512
to restore the image after a failed recovery attempt: dd if=/home/yourname/sda.img.bak of=/dev/sda bs=512
You could of course use /dev/sda1 if you are only interested in the first partition, but as some of these utilities alter the partition table, it is perhaps a better idea to image the whole disk..
Also, if you are using dd for a large operation, it is very helpful to see a progress bar, for which you can use a utility called pv which reports progress of data through a pipeline [NOT ENOUGH REP TO POST LINK]
for instance: pv -tpreb /dev/sda | dd of=/home/yourname/sda.img.bak bs=512
BTW: some people suggested making the backup image, and working on it directly, but I found it easier to work on the disk itself (easier to mount)
In conclusion, If you have made it this far, I hope you never need to use these tools to recover your data. In case you do though, perhaps this illustration will make it a little easier (it took me many hours to search the web for all this information, and many people told me it was not possible)
P.S.
If your disk is physically damaged, then you will not be able to use dd to image, as it will abort with read errors. You may be able to use GNU dd_rescue (but It looks like some work and a lot of time) [NOT ENOUGH REP TO POST LINK]
No comments:
Post a Comment