Choose style:

Author Topic: (solved) restoring "deleted" Linux partition and swap file  (Read 698 times)

0 Members and 1 Guest are viewing this topic.

Offline davexnet

  • Jr. Member
  • **
  • Posts: 25
  • Karma: 1
  • New Forum User
    • View Profile
  • Peppermint version(s): 7 64-bit
(solved) restoring "deleted" Linux partition and swap file
« on: September 20, 2018, 04:36:43 pm »
Hi all,
I suffered some kind of "glitch" while using my  PC, the screen froze and filled with a strange diagonal pattern.
I had to clear CMOS and remove the motherboard battery before I could even get the PC to POST again.

When I attempted to boot my Linux boot loader (Grub) I get the grub-rescue > prompt.
Trying to boot Windows just a black screen.  To cut a long story short I used a rescue disk to save
and review the master boot record.  It had been partially overwritten with garbage, including the
partition table unfortunately.

At the end of disk1 is 49GB of unallocated space,
that's where my Peppermint Linux partition + swap are supposed to be.  This drive also contains the Windows 10
boot loader.  I have grub installed on disk 0

All those Windows partitions were also lost but a program run from Windows on another PC
(Easeus Partiton Master) after connecting this drive successfully found them and restored the partition table.
Unfortunately this program did not find the Linux partitions.

I'm wondering if there are any recommendations of anything else to try that might be able
to restore the Linux partitions in a similar way?  I have tried Testdisk which actually does find them
but i'm concerned about some reported overlapping of partitons that I have not yet attempted using it.

I have created the Knoppix DVD 8.1. but I have not found any useful tools.
Any suggestions appreciated
« Last Edit: September 21, 2018, 11:47:12 pm by davexnet »

Offline pin

  • Trusted User
  • Veteran
  • *****
  • Posts: 1762
  • Karma: 245
    • View Profile
Re: restoring "deleted" Linux partition and swap file
« Reply #1 on: September 20, 2018, 05:10:33 pm »
NOTE: I have no clue if this could work!!!
https://ubuntuforums.org/showthread.php?t=1376383
Wait and see if someone who's actually been through this can help!
Just say NO to flatpak and snap!!

Online PCNetSpec

  • Administrator
  • Hero
  • *****
  • Posts: 24924
  • Karma: 2753
  • "-rw-rw-rw-" .. The Number Of The Beast
    • View Profile
    • PCNetSpec
  • Peppermint version(s): Peppermint 8R, 9, and 9R
Re: restoring "deleted" Linux partition and swap file
« Reply #2 on: September 20, 2018, 05:48:06 pm »
testdisk is what you're after.

You can install testdisk in a LiveUSB session
Code: [Select]
sudo apt-get install testdisk
then instructions to get it to find lost partitions can be found here
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
WARNING: You are logged into reality as 'root' .. logging in as 'insane' is the only safe option.

Team Peppermint
PCNetSpec

Offline davexnet

  • Jr. Member
  • **
  • Posts: 25
  • Karma: 1
  • New Forum User
    • View Profile
  • Peppermint version(s): 7 64-bit
Re: restoring "deleted" Linux partition and swap file
« Reply #3 on: September 20, 2018, 09:33:49 pm »
Perhaps I need to do a little bit more reading, I dont understand what / why Testdisk is doing what it is.

When it displays the current structure everything agrees with the Windows Disk Management image I posted before.
Then I do the "quick" search, the Linux partitions show up (in green) but some of the NTFS that were there before have now
disappeared.   What do I do now?  Add the back manually with cylinder , head & sector ?


Offline AndyInMokum

  • Global Moderator
  • Hero
  • *****
  • Posts: 4808
  • Karma: 1011
  • "Keep on Rockin' in the Free World"
    • View Profile
  • Peppermint version(s): PM 9 & PM 8 Respin-2 (64-bit)
Re: restoring "deleted" Linux partition and swap file
« Reply #4 on: September 21, 2018, 12:22:21 am »
Hi davexnet, how's it going?  I have to advise you, We are no longer accepting terminal screenshots as feedback unless there is no other option.  The links to screenshots are too often removed or broken.  This renders the whole thread useless for future inquiries and a complete waste of time for the devs helping out.  Could you please rerun the terminal commands?  It is very easy to copy and paste the outputs into the forum editor.  You can do this by highlighting the area to be copied by holding down the left mouse button while dragging the mouse.  Use the copy function on the right mouse click.  Paste the contents into the forum editor using the paste function on the right mouse click.  To preserve the original format, please make sure you encapsulate the outputs with the, # Insert Code function.  This is located above the  :-[ Embarrassed emoticon in the forum editor.  For extra long outputs, you may use the Sp Spoiler function instead.  This is located above the  :'( Cry emoticon in the forum editor.  To post the outputs from text files, you may use the, Insert Quote function.  This is located above the :-X Lips Sealed emoticon in the forum editor.  If it the outputs are from another computer in your network.  Please copy the outputs to a text file.  These can be saved to a thumb drive and then transferred to forum editor.  The appropriate adjustments must to be made before we can proceed with the thread.  Remember we're trying to help you and in doing so, we hope to help others in the future.  Your efforts are much appreciated.   Many thanks for your cooperation and  understanding  ;).
Backup! Backup! Backup! If you're missing any of these -  you ain't Backed Up!
For my system info please L/click HERE.

Offline davexnet

  • Jr. Member
  • **
  • Posts: 25
  • Karma: 1
  • New Forum User
    • View Profile
  • Peppermint version(s): 7 64-bit
Re: restoring "deleted" Linux partition and swap file
« Reply #5 on: September 21, 2018, 01:05:54 am »
OK thanks for the advice about screen shots.   It would be nice if the forum itself offered storage
space then we could upload this kind of thing directly to the forum (I know it's a long show but I though I'd ask   :D
Of all the forums I belong to, very few offer this)  Ok I'll look into providing the info some other way

In the meantime I have noticed in Testdisk you have to run the full search when  the quick search doesn't find
everything  (I'll try that tomorrow)

Online PCNetSpec

  • Administrator
  • Hero
  • *****
  • Posts: 24924
  • Karma: 2753
  • "-rw-rw-rw-" .. The Number Of The Beast
    • View Profile
    • PCNetSpec
  • Peppermint version(s): Peppermint 8R, 9, and 9R
Re: restoring "deleted" Linux partition and swap file
« Reply #6 on: September 21, 2018, 12:01:01 pm »
I don't actually mind screenshots in this instance, because copy/paste from testdisk isn't all that clear.

My problem is I hate giving advice about data recovery (so generally don't), because of the risk of further damage/loss .. when someone hires me to do any kind of data recovery it's ALWAYS be with a signed agreement that clearly states this this risk, and even then I'd work on a sector by sector clone of the original drive, NOT the original drive.
« Last Edit: September 21, 2018, 12:05:32 pm by PCNetSpec »
WARNING: You are logged into reality as 'root' .. logging in as 'insane' is the only safe option.

Team Peppermint
PCNetSpec

Offline davexnet

  • Jr. Member
  • **
  • Posts: 25
  • Karma: 1
  • New Forum User
    • View Profile
  • Peppermint version(s): 7 64-bit
Re: restoring "deleted" Linux partition and swap file
« Reply #7 on: September 21, 2018, 08:24:30 pm »
Well The problem is solved, Testdisk (using deeper search) did find the missing partitions.
They should be verified on the found summary screen by making sure they can display their files and ensuring
that the partition types are correct - then write it.  I will now make sure to keep copy of the fixed MBR's and put them
somewhere safe

Thanks all - do you still want me to remove these images?

PCNetSpec I fully understand your hesitation about giving advice in something critical like this.  Everybody is different in their PC tech comfort levels.
When this first happened almost a week ago, I couldn't even remember what programs I should be looking at.
I took my time and gradually felt more comfortable in what I was doing. When my disk lost it's partitions, neither Acronis TrueImage
nor Macrium would backup this disk in any shape or form, both stating that "the disk was empty"

Online PCNetSpec

  • Administrator
  • Hero
  • *****
  • Posts: 24924
  • Karma: 2753
  • "-rw-rw-rw-" .. The Number Of The Beast
    • View Profile
    • PCNetSpec
  • Peppermint version(s): Peppermint 8R, 9, and 9R
Re: restoring "deleted" Linux partition and swap file
« Reply #8 on: September 21, 2018, 08:55:08 pm »
When my disk lost it's partitions, neither Acronis TrueImage
nor Macrium would backup this disk in any shape or form, both stating that "the disk was empty"

What I meant was to use something like the 'dd' command to do a block by block clone .. where it's not so much copying 'data' and 'partitions' as much as making a 1:1 copy of the state of all blocks (so the clone will exactly mirror the original block device, including errors and bad blocks).

Anyway, glad to hear testdisk did the job for you :)



Images in posts...

The images can stay :)  .. the reason we discourage the use of screenshots is only to stop people posting screenshots of terminal output .. as you can imagine, usually when a helper requests terminal output it'd save them a LOT of time/effort if they can copy/paste the output (or parts of it) into say a text file or a web browser so search tools can be utilised to find the important parts .. not something that can be done with text in an image.

It also means the text in the image can't be indexed by this forum software .. so again isn't searchable by future users looking for a solution to a similar problem.

This doesn't really apply to your testdisk images .. so I'm happy for them to stay :)
« Last Edit: September 21, 2018, 09:11:20 pm by PCNetSpec »
WARNING: You are logged into reality as 'root' .. logging in as 'insane' is the only safe option.

Team Peppermint
PCNetSpec

Offline scifidude79

  • Global Moderator
  • Hero
  • *****
  • Posts: 4025
  • Karma: 863
    • View Profile
  • Peppermint version(s): Peppermint 9
Re: restoring "deleted" Linux partition and swap file
« Reply #9 on: September 21, 2018, 10:05:39 pm »
Since this topic is solved, will you please edit your original post and add (Solved) to the Subject area. Thanks in advance. :)