0

Booted up from live media (ubuntu 12.04) with HDD (3TB, GUID, single EXT4 partition used for storing data and nothing else)connected via SATA. For some reason the file system was only allowing "read only" access so I decided to unmount. I opened up "disk utility" and just clicked "mount" for the heck of it. For whatever reason it hung (and didn't actually end up finishing mount)... So I got impatient and did a sysreq+REISUO thing, but the system never shut off.. Got impatient again and just pulled the plug. Rebooted to find my that there is no longer any partition found on the device.

So basically.. I damaged, corrupted, destroyed, whatever my ext4 filesystem..? obviously all the data is still sitting there..right? I'm prob gonna go ahead and write block + dd the whole thing before before I do anything else, just 'cause.. when I get a hold of a spare 3 TB drive in the near future... that said.. what do I do, if anything, to get my partition and all the data on that partition back? What happened? How do I go about not losing 3 TB worth of data that I hadn't backed up yet?

2
  • It is indeed unlikely you've lost all your data, short of a hard disk/controller failure. It would take a fair while to overwrite 3 TB, while corrupting GPT/MBR is can be done with as low as writing 1-4 sectors. Nov 10, 2022 at 4:18
  • You might use something like dd and dump the first 3 sectors of your HDD, and the last 2, and paste a link to the dump here. Nov 10, 2022 at 4:19

2 Answers 2

0

It's possible that TestDisk will recover the partition on the disk. If not, you may need to resort to PhotoRec, which is a file-level recovery tool. The trouble with PhotoRec is that it doesn't typically recover filenames or directory structures, so you can end up spending dozens of hours sorting through and renaming/moving files that it recovers.

As to the cause, it's impossible to know. Some possibilities that spring to mind include:

  • Random data corruption caused by bugs, cosmic rays (for real), a power surge, a bad cable, or whatever.
  • A physically damaged disk. Checking it with a SMART utility (like GSMartControl) is advisable.
  • The uncontrolled shutdown you describe may have caused data corruption because a cache wasn't written back to disk.
  • Somebody may have broken into your computer and maliciously done damage. (Similarly, a virus or worm might be responsible, especially if the computer dual-boots with Windows.)

No doubt I'm forgetting some possibilities, too. You can perform checks like a SMART test, tests on your cables, security screenings, etc., to look for some of these items. Others, if they're the cause, will likely remain mysteries forever.

0

I won't talk about causes, Rod Smith is already giving a fairly comprehensive list.

I do not know TestDisk and it might be able to do what I'm about to describe...

If that disk was containing a single partition covering the whole disk, or if by chance you remember the partition details, you could recreate it. There are chances the data is still there and it's only your MBR/GPT that got damaged (GPT less likely as there are 2 copies).

In any case, if you can afford it, the first step prior to writing to the disk would be to make an image of it.

3
  • Could you expand a bit more? If you’re suggesting recreating the partition details, please give some details of how to do that. Thank you.
    – Will
    Nov 16, 2022 at 10:48
  • If the partition was using the whole disk, then re-create a partition that does just that, in MBR or GPT. I unfortunately do not really know about tools to do that, and myself, I would typically use a proprietary tool called "010 Editor", which is a hex editor which structure highlighting that supports MBR and GPT. Not I happen to know "everything" about MBR, and have some knowledge about GPT (not that it's complex), and I'm comfortable editing in hex editor... Nov 16, 2022 at 13:40
  • @Will However, it could be that you can do that with "any tool" (I would just be worried that the tool should not do anything more than write MBR/GPT). Typically you could use gparted, create a single EXT4 partition, and you're done. Provided your data hasn't been erased, you'll have access to it again. I do not know the specifics of EXT4, but it's possible even if you wouldn't enter the right parameters, that would still work. For a FAT partition (very simple example I know), as long as you get the starting position right, the FAT (the File Allocation Table) would be readable. Nov 16, 2022 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .