Accidentally installed ubuntu on the whole disk instead of a specific partition

Question

I had Linux installed on my laptop with 3 partitions:

[System: 100Gb Ext4 Mount Point / ] 
[Data: 400Gb Ext4 Mount Point /media/Data] 
[Swap: 8Gb Swap]

I needed to reinstall my system and wanted to install it over the System partition leaving the Data one untouched.

Unfortunately I skipped the step of partitions selection, and Ubuntu installed a brand new OS using the default partition config:

[Boot: 500Mb fat32 ]
[System: 450Gb ext4 Mount Point /]
[Swap: 8Gb Swap]

After some search, I found I can restore files by running sudo photorec.

But I still hope to restore the whole 400Gb Data partition as it might have been unmodified by the installation (which I interrupted quickly after, meaning not much has been written the disk since).

• Do I have a chance to get back my data partition or is it 100% sure the filesystem is deleted?
• From my understanding of filesystems, if I recover the start and end position of the former partition and create a new partition out of it, will I get everything back?
• If so, what tool should I use to do that? Testdisk?
• How is it that files can be restored, but no the directory structure? Where is the arborescence stored?

Thanks in advance

---

EDIT: I ran TestDisk's deep analysis on m drive, and here's what I get:

I don't understand the numbers: they don't seem to make sense (Start not before End, column not correctly aligned etc.) Anyone can help me give those numbers some sense?

EDIT2: HE FOUND IT!

It is there in the screenshot, the [Disk] partition.

Unfortunately my laptop froze (out of memory?) before I recreated the partition. Do I have to rerun the Deep Search, or can I create the partition after my reboot? I'm so excited now ...

Answer 1

As the new partition table was created and the copying of data started, the data loss is inevitable. The integrity of your old Data partition depends on how fast you managed to cancel the process. According to the partition sizes of your old and new configuration, the new root partition starts beyond your old Data partition, so you still have a chance.

You are right, if you have your old partitions structure and restore it exactly, then you can get your partition back. But I doubt that you stored this info when you were creating your first configuration and this info should be precise.

Testdisk is a good tool for that job. Here's nice tutorial which explains several cases of data loss: http://www.dedoimedo.com/computers/linux-data-recovery.html
The author deliberately destroyed his partition table to recover it lately. But complete recovery can be obtained only if it was held immediately after the partition table destruction, without data copying. Nevertheless, Testdisk has an ability to analyze partition structure on standard and deep levels and try to recover your old partition configuration if it is possible.
Also check recovery tutorials on the author's site. Here's step-by-step explanation how TestDisk works: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

As regards your last question, all files after their deletion or partition table loss remain at their old positions. You mentioned Photorec, another program of the same author, which has an ability to recover files even if Testdisk failed. It uses a database of signatures of the different file types. It scans the hard drive sector by sector and seeks for these signatures. If it founds one, then it reads contiguous block of the data, checking its consistency. So if the parts of the file weren't overwritten, then it can be restored wholly. Principles of recovery are explained on this page: http://www.cgsecurity.org/wiki/PhotoRec

First of all I advise you to perform all recovery operations from other system. If you have a possibility to take off your laptop HDD and connect it to some desktop machine with adapter - that's the best way. If not, you can boot from Live CD/USB. There are special distributions aimed at data recovery, for example SystemRescueCD. Also if you've got an external HDD you can dump an image of your defective disk using dd and later work with it, so if you'll spoil the recovery, you will still have the original disk with data intact. An example of the command:

dd if=/dev/sdb of=/media/ext_disk/disk_dump

/dev/sdb in this case is your defective disk and /media/ext_disk - some external HDD which is mounted to your system. Be warned: don't reverse the order of if and of by mistake!
Default block size for dd is 512b so you can add bs=64K to the end of the command to speed up the process significantly, but this is advisable only if your original disk is error-free. There's a tool ddrescue which is used when original disk can contain errors.
Now you can work with your image instead of your disk:

testdisk /media/ext_disk/disk_dump

Here's the last link where some other recovery tools are mentioned and briefly explained: https://help.ubuntu.com/community/DataRecovery

Answer 2

I GOT IT!!!

I finally recreated a partition with sudo fdisk /dev/sda then n, as explained there

The last difficulty I had to face was to convert the CHS format to the Sectors format. It worked with the following formula found there :

LBA = (((cylinder number * heads per cylinder) + head number) *
  * sector per head) + sector number - 1

Which in my case was:

• Start: (10941*255 + 201) * 63 + 13 - 1 = 175779840
• End: (59572*255 + 98) * 63 + 46 - 1 = 957030399

The partition immediately mounted itself and the data was available again!