Ubuntu – How to recover partially formatted ext4 partition (testdisk did not help)

data-recoverypartitioningtestdisk

I have а 2TB "single ext4-formatted partition" HDD.
Recently, while working under Windows 7 on the same machine, I have damaged the afore-mentioned partition. What happened is that while I was trying to recover external USB drive I opened the standard Windows Disk Management tool and it prompted me if I want to make disk1 "active". At that moment I didn't realize that "disk1" is not my USB disk, but the ext4 internal disk. After clicking OK, Windows has created a 100MB "system reserved partition" on the disk and left the rest untouched.

When I logged back in to Linux, the partition was not mounted. I deleted the created by Windows 100MB NTFS "system reserved partition" and tried to run Testdisk. Testdisk sees my old ext4 partition, but at the end tells something like "no partition can be recovered".

Is it possible to get back my partition and directory structure + data? The problem is that I had there all my programs (C/C++) and working directories as well as some experimental data, i.e. files which don't have specific headers like jpg or pdf. Is there a way to recover this data? Can I, for instance, recover part of the partition, let's say whatever is above 100MB?

P.S. Please let's avoid "you should have done a backup"-like comments.. 🙂 I had a backup, but it was stored on the USB drive which I was trying to recover first.. (a general disk failure, disk is not readable).

Best Answer

You may have run into this problem, but that's not really clear. If so, yours is the first case of its kind that I've heard of, and you can thank the GNU parted developers for sitting on a fix for over two years.

As a practical matter, your best bet for recovery is this:

  1. (Optional, but strongly recommended.) Do a low-level backup of the damaged disk. For instance, sudo dd if=/dev/sdc of=/path/to/backup.img backs up /dev/sdc (if that's the damaged disk) to /path/to/backup.img (you can change this target directory or filename, if you like). Obviously you must have sufficient free space in /path/to to hold the backup. This means you may need to buy a new backup disk, prepare it, and mount it at /path or /path/to. You can skip this step, but then if you make matters worse, it will become harder to recover -- perhaps to the point of becoming impossible to recover.
  2. Use fdisk (if the disk used MBR) or gdisk (if the disk used GPT) to re-create your original partitions. Since you say you had a single partition on the disk, chances are that it started at sector 2048 and extended to the end of the disk. Thus, deleting the current partition(s) and re-creating that one may work. Do not create a fresh filesystem on the disk; just create an empty partition. (GParted likes to create a fresh filesystem and so should be avoided. It's possible to get it to create an empty partition, but why take the risk?)
  3. Reboot. (This just ensures that you're using the new partition table. There are less radical ways to do this, but this one is easy to describe.)
  4. Run e2fsck on the partition you just created. If you're very very lucky, it may locate enough of the ext4fs data structures to bring the disk back to live, although probably with some missing files or other problems. You might want to use fsck.ext4 to make sure, that it recognizes properly that it is a ext4 filesystem. Fiddling with e2fsck options (such as -b) may improve your odds of recovering data, but these options are very advanced. See the e2fsck man page for details.
  5. If this fails, run PhotoRec on the disk. This should enable recovery of individual files, although they'll probably lack filenames or any sort of organization, so you'll need to sift through them to figure out what they all are.
Related Question