[SOLVED] TestDisk Partition Recovery Issue [Developer

rajeefmk · 11-01-2011, 04:47 AM

Dear Forum Users,

I'm a newbie to the Linux world,although I've been always keenly interested to get to know more about linux and open softwares.

Recently due to Human error from my part, i accidently deleted all my partitions and the system has just a single partition now.Moreover there is no operating system to boot from.

I searched the internet and came across TestDisk and its capability to boot from a CD.I Downloaded BootMed, an ubuntu(10.10) varient.I followed the instructions from the website.Now the real Issue :

Initially after the Analyse, the software detected all my deleted partititons and when i selected one and pressed enter it said the partition cannot be recovered.And gave me an option for Deep Search.
The deep search initially began but with "read error count just as high as analyse cylinder count".

It took as long as 18+ hours yet the deep search count was 6%. I got frustrated and restarted system to restart the process but this time the whole process of - Booting up, Analaysing, Detecting - has become VERY Slow and the software seems to take hours to go to the next option.

Everytime I restart the whole process seems to be slower more.I'm confused and helpless and I have no backup of my datas.

Request you all to help me with this softeware or any other methods.

rng · 11-01-2011, 11:56 AM

How many partitions were there? What details testdisk gives about the partitions (sector numbers etc)? Posting them here may help as you may be able to use other tools like sfdisk to make those partitions.

Some free windows tools are also available for partition recovery.

Hiren's boot cd is also often mentioned to have tools for data recovery. See their website.

I have once recovered partitions successfully using testdisk.

rajeefmk · 11-01-2011, 01:13 PM

hello

From what i can remember from the first time, there were 2 partitions of linux, 2 which i had created, a partition containing windows, and a HDD Recovery.

And the testdisk seems Very slow now, so i cannot get past the Analyse screen. Sorry to say that i cannot obtain the boot sector details. The slowing down thing started happening after I aborted a Deep search which took aroung 18+ hours. Now i'm scared that I can't even see that i got earlier.

Will ddrescue be useful in this case to create an image of my disk ?

rng · 11-01-2011, 08:29 PM

If testdisk is not working things may be difficult as far as I know. You have to decide whether there was important data on the disk or only operating systems which can easily be reinstalled. I have'nt used ddrescue myself.

rajeefmk · 11-02-2011, 06:12 AM

Thank you for your reply.

There is highly valuable documents in the hard disk including my Dad's thesis paper. the operating system doesnot concern me.

rng · 11-02-2011, 07:25 AM

As I mentioned earlier, try windows recovery tools- google for them. Also see Hiren's cd website- they list many recovery tools.

Also see following links:
sysrescuecd: http://www.sysresccd.org/Main_Page

5 best linux recovery tools: http://www.linuxtoday.com/it_managem...22800535OSSWRL

rng · 11-02-2011, 10:30 AM

How many, what format and approximately what sized partiions were there on the disk?

rajeefmk · 11-03-2011, 06:14 AM

There were 3 partitions - C: [contained ubuntu 11.04 and windows 7](80 + 100 GB) , D: [100GB], E:[100GB] .

There was also a Hidden Partition recovery partition.

After running TesDisk for the first time, i say all these partitions.But when I clicked on one of these, the result said " cannot be recovered " and I was given two options - deep Search or quit .

The Deep Search took me 18+ hours which I aborted atlast as it was still 6% after all that time. When i run analyse once again. the whole system became very slow.

rng · 11-03-2011, 06:53 AM

I think you need professional help for this and may need to take your disk to a service center.

Which partition had important data?

You can download boot_info_script from http://bootinfoscript.sourceforge.net/ and run it as root. The output will be stored in RESULTS.txt in that folder which you can post here. It will clarify all the current partitions as well as booting info. It may help.

rajeefmk · 11-03-2011, 07:10 AM

Thank you Rng for sparing your time in helping me.

I'm right now away from my laptop. I shall post you the details you asked for on the coming saturday (Nov 5th).

And I still believe in the power of Linux - that I can recover my data using linux.Professional people mght charge in tens of thousands. I'm not in a financial state to provide money for data recovery as I'm a full time student.

Thank you once again.

rajeefmk · 11-06-2011, 04:08 AM

Hello.

I did as you told me.Got the following result -

"gawk" could not be found, using "busybox awk" instead.
This may lead to unreliable results.

The process then for terminated

unSpawn · 11-06-2011, 06:33 AM

Quote:

Originally Posted by rajeefmk

I Downloaded BootMed

FWIW Testdisk and Photorec are readily available from several Live CDs listed at http://www.cgsecurity.org/wiki/TestDisk_Livecd

Quote:

Originally Posted by rajeefmk

Initially after the Analyse, the software detected all my deleted partititons and when i selected one and pressed enter it said the partition cannot be recovered.And gave me an option for Deep Search. The deep search initially began but with "read error count just as high as analyse cylinder count".

Oddly enough I can't find that message in the Testdisk source (testdisk-6.13-WIP.tar.bz2)... And unless you know what you're doing you should always default to making a backup of the complete disk to (a file on) a physically different medium before doing anything else. (Anyone omitting this crucial nfo please make a mental note you always should.) Also you should run as 'testdisk /debug /log' as the log file may hold details to read and attach to your reply as plain text file.

Quote:

Originally Posted by rajeefmk

It took as long as 18+ hours yet the deep search count was 6%. I got frustrated and restarted system to restart the process but this time the whole process of - Booting up, Analaysing, Detecting - has become VERY Slow and the software seems to take hours to go to the next option.

Both things, impatience and slowness, are worrying. If booting Linux 'dmesg' may hold interesting information. Save as 'dmesg > /tmp/dmesg.txt' and attach as plain text file.

Quote:

Originally Posted by rajeefmk

I have no backup of my datas.

Unfortunately you've learned an invaluable lesson the hard way.

Questions:
I. Bit late now but what exactly did you do to delete all partitions?
II. Do you have a separate USB or Firewire hard disk with free space large enough to hold a copy of the complete disk? (If you have a smaller disk just state free space.) If you don't have one consider lending or buying one. If you can't but have another workstation with ample free space then if workstation and laptop can be connected over a network using 'dd' is possible. If you can't buy or lend a disk but 0) the value of the paper exceeds the value of the laptop and you 1) have a workstation with ample free space consider reading the laptops technical manual, opening the laptop (YMMV) and hooking up the 3.5" disk with a converter to the workstation. (Just stating options.)
III. On which partition exactly were those "highly valuable documents in the hard disk including my Dad's thesis paper"?
IV. 0) What application created those files (MsWord 2007, AbiWord, OpenOffice.org, etc, etc), 1) what approximate size were they and 2) when were they approximately last written to?
V. Please attach as plain text the tesdisk.log and dmesg.txt.
* Please stay with the thread until completion and post replies as soon as possible (subscribe?). Depending on evidence of HW deterioration or not this IMHO isn't the type of problem you want to stretch out fixing over weeks.

H_TeXMeX_H · 11-06-2011, 07:38 AM

I would use foremost, just make sure that thesis is in a format listed in foremost.conf, otherwise you'll have to add the format yourself.
http://foremost.sourceforge.net/

rajeefmk · 11-06-2011, 09:45 AM

Quote:

Originally Posted by unSpawn

FWIW Testdisk and Photorec are readily available from several Live CDs listed at http://www.cgsecurity.org/wiki/TestDisk_Livecd

Oddly enough I can't find that message in the Testdisk source (testdisk-6.13-WIP.tar.bz2)... And unless you know what you're doing you should always default to making a backup of the complete disk to (a file on) a physically different medium before doing anything else. (Anyone omitting this crucial nfo please make a mental note you always should.) Also you should run as 'testdisk /debug /log' as the log file may hold details to read and attach to your reply as plain text file.

Both things, impatience and slowness, are worrying. If booting Linux 'dmesg' may hold interesting information. Save as 'dmesg > /tmp/dmesg.txt' and attach as plain text file.

Unfortunately you've learned an invaluable lesson the hard way.

Questions:
I. Bit late now but what exactly did you do to delete all partitions?
II. Do you have a separate USB or Firewire hard disk with free space large enough to hold a copy of the complete disk? (If you have a smaller disk just state free space.) If you don't have one consider lending or buying one. If you can't but have another workstation with ample free space then if workstation and laptop can be connected over a network using 'dd' is possible. If you can't buy or lend a disk but 0) the value of the paper exceeds the value of the laptop and you 1) have a workstation with ample free space consider reading the laptops technical manual, opening the laptop (YMMV) and hooking up the 3.5" disk with a converter to the workstation. (Just stating options.)
III. On which partition exactly were those "highly valuable documents in the hard disk including my Dad's thesis paper"?
IV. 0) What application created those files (MsWord 2007, AbiWord, OpenOffice.org, etc, etc), 1) what approximate size were they and 2) when were they approximately last written to?
V. Please attach as plain text the tesdisk.log and dmesg.txt.
* Please stay with the thread until completion and post replies as soon as possible (subscribe?). Depending on evidence of HW deterioration or not this IMHO isn't the type of problem you want to stretch out fixing over weeks.

Answers
1.I was recovering my system from the HDD recovery drive and due to human error from my side all partitions were deleted and combined to a single C: Drive.
2.Currently I donot have a external drive but am planning to buy one.Though I have a desktop with around 200GB free space which can be connected over a network to the laptop.
3.The thesis paper as well as other important documents were in a single partition,(Other than C: and HDD Recovery drive.)
4.The paper was created in Libreoffice (saved as .odt and .xml).
5.I donot know the location and how to obtain the testdisk.log and dmesg.txt files.
6.I will for sure stay with the thread until completition.I've been in a state of panic for a month, so i would like to apologise for my impatience and rapid actions taken.

rajeefmk · 11-06-2011, 09:48 AM

Quote:

Originally Posted by H_TeXMeX_H

I would use foremost, just make sure that thesis is in a format listed in foremost.conf, otherwise you'll have to add the format yourself.
http://foremost.sourceforge.net/

Hello

I'm completely in the dark in how to use an advanced software as foremost. At the same time, I'm highly interested in learning the same. But since I donot have a backup of the disk, I'm completely at loss.