4

I had Ubuntu 14.04 LTS installed on my Laptop. After a while I had some troubles starting it up. I decided to reinstall Ubuntu.

I had 3 ntfs partitions, 2 ext3 partitions the mount point for the first was / and for the second was ./local and a swap partition. During the reinstallation I chose the option: "erase Ubuntu 14.04 and reinstall".

During the reinstallation the power cut off. After it worked again I turned my laptop on to try to restart the installation process. I couldn't find any options other than:

  1. Erase disk and install Ubuntu
  2. Something else

When I chose Something else I couldn't see my partitions. Instead I found this:

Device                         Type     Mount point     Format?     Size      Used     System   

/dev/mapper/ubuntu--vg-root
 /dev/mapper/ubuntu--vg-root   ext4                                 631381 MB unknown  Linux device-mapper (linear)(631.4 GB)
/dev/mapper/ubuntu-vg-swap_1
 /dev/mapper/ubuntu-vg-swap_1  swap                                 8493 MB   unknown
/dev/sda
 /dev/sda1                     ext2                                 254 MB    27 MB
 /dev/sda5                                                          639877 MB unknown

At the Testdisk phase I have this:

Testdisk

  • Do you have or can you get a spare drive of same or larger size? It may be possible to recover your data. – Elder Geek May 8 '14 at 21:25
  • @ElderGeek If it's possible I'll buy one immediately – Kareem May 8 '14 at 21:27
  • 1
    I like to say all things are possible, the only questions are How much? and How long? More soon. – Elder Geek May 8 '14 at 21:36
  • Don't panic and don't do anything further to the original drive with the missing data. I'm working on your answer. – Elder Geek May 8 '14 at 21:44
  • @ElderGeek I'm sorry! How much and How long what? And how to do it using a larger hard drive if it's possible? – Kareem May 8 '14 at 21:44
5

The first thing to do is to take a forensic copy of the drive. Duplicating the drive entirely gives you the flexibility to work on repairing the problem on the copy while insuring you do no further damage to the original. I like dc3dd for this better than dd as dc3dd provides a progress report while it runs.

EDIT: newer versions of dd now include a progress report with the switch status=progress. To see if yours does see man dd

1) Boot from a Live media USB or DVD - Choose Try Ubuntu

2) Open a terminal with CTRL - ALT - T at the prompt enter

which dc3dd

this is just a quick way to see if you have the right tool installed for the forensic image. If it responds with a path like

/usr/bin/dc3dd

we have it. If not, we have to install it and enter

sudo apt-get install dc3dd before continuing to step 3

3) determine what your source (old) drive is named This is likely /dev/sda but to be sure look with Disks from the GUI in the attached image below you can see my sda1 is a 128GB drive with 2 64GB partitions.

Recovery1

4) attach the new drive Verify the device names with Disks from the GUI make notes! The old disk will be called source and the new one called target. So in this example source=/dev/sda and target will be /dev/sdb or whatever it says it is in Disks

Now that we have a plan we will duplicate the source to the target using dc3dd.

5) At the terminal issue the command

dc3dd if=/dev/sdX of=/dev/sdY change X to match the source (likely a) and Y to match the target (likely b or c) check your notes and be sure you have this right!!!

Note: To create an image rather than clone a physical drive change of=/dev/sdY to of=diskimage.dd

While we are copying the source drive to the target to insure we can always go back in case something goes wrong and we will be no worse off than before, we should likely familiarize ourselves with partitions in general. A good write up can be found at http://www.tomshardware.com/forum/270354-32-understnading-extended-logical-primary-partitions This knowledge will be useful later in the process.

6) When the copy is complete shut down, disconnect the drive marked source (old drive) and put it away somewhere safe.

7) Boot up the machine again with the Live DVD/USB with the target (new drive) attached.

8)We're going to install testdisk to recover the partitions on the target drive which is now identical to the source in terms of data.

Open a terminal and issue the command

sudo apt-get install testdisk

9) When the installation is complete we issue the command testdisk

The following example steps are from a very good step by step tutorial source

One condition:

    TestDisk must be executed with Administrator privileges.

Important points for using TestDisk:

    To navigate in TestDisk, use the Arrow and PageUp/PageDown keys.
    To proceed, confirm your choice(s) with the Enter key.
    To return to a previous display or quit TestDisk, use the q (Quit) key.
    To save modifications under TestDisk, you must confirm them with the y (Yes) and/or Enter keys, and
    To actually write partition data to the MBR, you must choose the "Write" selection and press the Enter key.

Log creation Create Log

Choose Create to instruct Testdisk to create a log file containing technical information and messages, unless you have a reason to append data to the log or you execute TestDisk from read only media and must create the log elsewhere.
Choose None if you do not want messages and details of the process to be written into a log file (useful if for example Testdisk was started from a read-only location).
Press Enter to proceed.

Disk selection

All hard drives should be detected and listed with the correct size by TestDisk: disk selection

Use up/down arrow keys to select your hard drive with the lost partition/s.
Press Enter to Proceed.

Partition table type selection

TestDisk displays the partition table types. menu partition table type

Select the partition table type - usually the default value is the correct one as TestDisk auto-detects the partition table type.
Press Enter to Proceed.

Current partition table status

TestDisk displays the menus (also see TestDisk Menu Items). menus

Use the default menu "Analyse" to check your current partition structure and search for lost partitions.
Confirm at Analyse with Enter to proceed.

Now, your current partition structure is listed. Examine your current partition structure for missing partitions and errors. Analyse

The first partition is listed twice which points to a corrupted partition or an invalid partition table entry. Invalid NTFS boot points to a faulty NTFS boot sector, so it's a corrupted filesystem. Only one logical partition (label Partition 2) is available in the extended partition. One logical partition is missing.

Confirm at Quick Search to proceed.

Quick Search for partitions TestDisk displays the first results in real time.
quick search

During the Quick Search, TestDisk has found two partitions including the missing logical partition labeled Partition 3. first results

Highlight this partition and press p to list your files (to go back to the previous display, press q to Quit, Files listed in red are deleted entries).

All directories and data are correctly listed.

Press Enter to proceed.

Save the partition table or search for more partitions? menu search!

When all partitions are available and data correctly listed, you should go to the menu Write to save the partition structure. The menu Extd Part gives you the opportunity to decide if the extended partition will use all available disk space or only the required (minimal) space.
Since a partition, the first one, is still missing, highlight the menu Deeper Search (if not done automatically already) and press Enter to proceed.

A partition is still missing: Deeper Search

Deeper Search will also search for FAT32 backup boot sector, NTFS backup boot superblock, ext2/ext3 backup superblock to detect more partitions, it will scan each cylinder

After the Deeper Search, the results are displayed as follows: The first partition "Partition 1" was found by using backup boot sector. In the last line of your display, you can read the message "NTFS found using backup sector!" and the size of your partition. The "partition 2" is displayed twice with different size. Partitions listed as D(eleted) will not be recovered if you let them listed as deleted. Both partitions are listed with status D for deleted, because they overlap each other. You need to identify which partition to recover. results deeper search!

Highlight the first partition Partition 2 and press p to list its data.

The file system of the upper logical partition (label Partition 2) is damaged
damaged file system (click on thumb).

Press q for Quit to go back to the previous display.
Let this partition Partition 2 with a damaged file system marked as D(deleted).
Highlight the second partition Partition 2 below
Press p to list its files.

list files

It works, your files are listed, you have found the correct partition!

Use the left/right arrow to navigate into your folders and watch your files for more verification

Note: FAT directory listing is limited to 10 clusters - some files may not appear but it doesn't affect recovery.

Press q for Quit to go back to the previous display.

The available status are Primary, * bootable, Logical and Deleted.

Using the left/right arrow keys, change the status of the selected partition from D(eleted) to L(ogical). This way you will be able to recover this partition. set partition to recover

Hint: read How to recognize primary and logical partitions? Note: If a partition is listed *(bootable) but if you don't boot from this partition, you can change it to Primary partition.

Press Enter to proceed.

Partition table recovery

It's now possible to write the new partition structure. Note: The extended partition is automatically set. TestDisk recognizes this using the different partition structure. menu write

If all partitions are listed and only in this case, confirm at Write with Enter, y and OK.

Now, the partitions are registered in the partition table. NTFS Boot sector recovery

The boot sector of the first partition named Partition 1 is still damaged. It's time to fix it. The status of the NTFS boot sector is bad and the backup boot sector is valid. Boot sectors are not identical. backup bs

To copy the backup of the boot sector over the boot sector, select Backup BS, validate with Enter, use y to confirm and next OK.

More information about repairing your boot sector under TestDisk Menu Items. The following message is displayed: after backup bs

The boot sector and its backup are now both OK and identical: the NTFS boot sector has been successfully recovered.

Press Enter to quit.

reboot

TestDisk displays You have to restart your Computer to access your data so press Enter a last time and reboot your computer.

End instructions from cgsecurity

If the drive is physically damaged we'll need a different approach using ddrescue

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.