2

I accidentally formatted my windows partition into ext4 system while trying to install ubuntu and then immediately deleted it. then tried to restore files. testdisk showed only new+deleted ubuntu partition. EaseUs detected deleted NTFS partition but unable to find any deleted files.

I haven't done anything more harmful such as overwriting with new files or formatting again.

i badly need this partition recovered, anyone help me please..

My harddisk is SSD

Improve this question
4
  • Do you have to preserve the directory structure? If not, you could try out photorec, which comes along with the testdisk package.
    – anonymous2
    Aug 9, 2016 at 18:23
  • @anonymous2 This could be a last option, if nothing works :(
    – Prakash GPz
    Aug 9, 2016 at 18:26
  • Another concept is this: if you have a big enough HDD to fit all the data of your SSD, make a disk image and play with it instead of the original hard drive.
    – anonymous2
    Aug 9, 2016 at 18:28
  • Due to garbage collection (trim) routines in SSD firmware it's highly unlikely that you will be able to recover the data. If you succeed in doing so I would be pleased to hear about it. Best of luck.
    – Elder Geek
    Aug 24, 2016 at 21:24

1 Answer 1

Reset to default
2

It really depends on how much damage the ext4 format did to begin with. If all ext4 does is write a superblock, then your data is probably all there. Problem is there's no entry point into the NTFS format cmd that I know of that says "just write superblock info and don't touch anything else". So what you have to do is cheat.

  1. make a dd image of your hard disk and save it somewhere safe. You'll probably need a extra disk to do this because of the sheer space being used.
  2. format the disk as NTFS
  3. compare the two disks at the block level, the image you made vs the actual disk using the cmp utility.

cmp will tell when the two start to differ. Take that offset and then use dd to use your image as a source and skip ahead N(on the src and dst) where N in the offset cmp gave you and start writing back your data to the freshly formatted NTFS disk.

That's the gist of it. It's of course all about the details being exactly right. I would recommend you get a scratch disk, put a NTFS fs on and some data. Format it as ext4 and use that disks as your "learning disk" to proof your recovery procedure. Once you have that all figured out, do the same thing with your real data.

Alternatively, ship your data off to a data recovery specialist or... call it lost and take to heart the value of a regular backup schedule (carbonite, backblaze etc).

Improve this answer
10
  • Wouldn't cmp show any differences even of unallocated blocks or artifacts from previous formats which are irrelevant for the FS?
    – Andrea Lazzarotto
    Aug 10, 2016 at 10:35
  • Yup, that's when you resort to hexdump and manually sort collisions. Ultimately you're going to have to write a bit of software to perform the comparison. This is also all contingent on NTFS figuring out that the filesystem is inconsistent and using it's fsck to rebuild the inode table. A $60 1T external hard disk drive using the most basic backup software is a much cheaper alternative to a data recovery specialist. I do that with duplicity and I backup off site. I develop storage arrays for a living. The last thing I want to do is play data recovery specialist in my free time.
    – ppetraki
    Aug 10, 2016 at 13:48
  • @AndreaLazzarotto According to your profile, you do forensic NTFS reconstruction on the side. Hopefully you can help him directly. I mostly concentrate on block storage, filesystems are not my thing. I would be interested to know if you're successful and how you went about it. Regards, Peter.
    – ppetraki
    Aug 10, 2016 at 13:58
  • The problem with fsck and NTFS is that currently fsck just uses ntfsfix... this doesn't work very well as you might imagine. :) For now I suggest the OP tries with this answer. In case you are interested in how the process works, you should consider leafing through this.
    – Andrea Lazzarotto
    Aug 10, 2016 at 15:24
  • @AndreaLazzarotto Thanks for the link to the paper. It looks like you've thoroughly researched the subject.
    – ppetraki
    Aug 10, 2016 at 15:36

Not the answer you're looking for? Browse other questions tagged .