All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 57 posts ]  Go to page 1, 2, 3  Next
Author Message
 Post subject: Lost all files due to linux installation.
PostPosted: March 10th, 2017, 9:35 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Get ready for this one :)
I'm trying this morning to install deepin linux (debian with deepin de) and I specifically chose my 100GB hard drive that I intended to use for this. Checked around 3 times it's the correct one. Moved on with the installation and when I rebooted I found out that it used also my 400GB hard drive (not partition, those are two separate hard drives) to install something onto it deleting around 350GB of data. Now the hard drive has a changed format, used to be NTFS now it's ext4 I think. What should I use and how to get those files back. Here's a screenshot of how it's showing in 'Disks' a disk utility for linux. Image

The 80GB hard drive is an old 3.5" IDE drive, 101GB and 400GB are 2.5" sata drives.

Thanks.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 10th, 2017, 15:08 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
P.S. linux software is better (I guess) because recuva doesn't seem to recognize ext4 or should I delete all partitions off of it and format as ntfs or fat? This hard drive is now in USB enclosure so I can safely remove it when I install some stuff next time but it can be put back into the machine if needed.

Files aren't that really important but it would make my d̶a̶y̶ month if I could get them back. I noticed that the hard drive had a bad sector but it never showed any problems whatsoever.

Thanks again.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 10th, 2017, 15:56 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
I see that the last 1.1MB is free. Perhaps there is still a backup copy of the NTFS boot sector in that area?

Can you show us the Partitions window in DMDE (freeware disc editor)?

https://dmde.com/

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 10th, 2017, 16:26 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Chose this 400GB hitachi drive. Hope this is the right thing.
Too big image to post here so it's like this
http://i.imgur.com/CuTmWdj.png


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 10th, 2017, 18:16 
Offline
User avatar

Joined: August 9th, 2007, 8:40
Posts: 789
Location: United Kingdom
I love working with jobs like that. But I charge.

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 10th, 2017, 19:22 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
If you select "$Volume 02" and open it, do you see a file/folder tree (probably not)?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 11th, 2017, 4:41 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
When I highlight $Volume 02 and click 'open' it pops up a window
http://i.imgur.com/s1m0u6u.png
if I go 'auto detect option' this I get
http://i.imgur.com/9K11Ghd.png
if I go 'continue with this parameters' I get
http://i.imgur.com/UndK0g8.png


@scratchy I also like someone else doing it but I don't have any money :)


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 11th, 2017, 13:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Try an NTFS search.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 11th, 2017, 18:47 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
The MFT (Master File Table) is the root of your file/folder structure. It appears to have been destroyed by the Linux install. I'm assuming that your drive was originally partitioned as detected by DMDE, ie 106GB and 294GB partitions.

An NTFS search will scan the drive for NTFS fragments. If this does not prove to be fruitful, then a raw search may be necessary. A raw search tries to find files based on the signatures in their headers.

You can adjust the sliders in the Scan Parameters to limit or expand the search area.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 11th, 2017, 19:37 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Image

Got some fragments I guess (after NTFS scan). Tomorrow I will scan for raw if necessary now it's 12:30.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 10:19 
Offline
User avatar

Joined: August 9th, 2007, 8:40
Posts: 789
Location: United Kingdom
Hi

http://imgur.com/s1m0u6u is (probably) the back up boot sector of a partition that starts at LBA 207 980 544. Which would give you a ~300 GB partition
starting at LBA 207 980 544

If the original partition was 400 GB, then this is not the correct backup boot sector and you will need to search again.
If the partition was in fact 300 GB then look at the location 207 980 544 and see what is there. If there is another boot sector there you are almost ready to rebuild the partition table.

You could also look at LBA63 to see what is there. The linux partition does not start until 2048 so the original boot sector may still be at 63 if

a) it has not been overwritten and;
b) that was it's original location.

If it was 2048 then the boot sector and MFT mirror will have been overwritten, but that can be recovered if the first copy of the MFT is available. I can write a boot sector if necessary as long as the main file system info is still intact.

If you cant do it with that software, get a demo of WinHex http://www.winhex.com/winhex/index-m.html

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 12:14 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
The entire drive's capacity is 400GB and it had only one partition that I used, don't know if any other existed and I used only that one for media (videos, pics, documents etc) so the partition cannot be 300GB I guess. Maybe it's ~300GB because I used about that much on the drive?

Guess I'm going to have to do a 'raw' and 'NTFS' search.

How do I 'take a look' at LBA63?

How do I recover MFT with either of these programs?

(Too many questions I know.)

This is the DMDE NTFS scan by the way http://i.imgur.com/1f3rOXA.png


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 16:28 
Offline
User avatar

Joined: August 9th, 2007, 8:40
Posts: 789
Location: United Kingdom
You can use winhex disk editor to view the sectors. The size of the volume is not conditional on the amount of data stored on the drive. It is set when the volume is formatted. It could be a remnant from an old installation

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 16:36 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Loaded the correct hard drive. Here it is

http://i.imgur.com/LbPK8fe.png

What now? :)


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 17:38 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
It appears that DMDE didn't find much. Try selecting each of the NTFS results and Open Volume.

To go to a particular sector, select Editor -> Goto Offset. You can save the screen text by selecting Edit -> Export to Text File. Then paste the text output inside the forum's "Code" box using the BBcode button.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 17:56 
Offline
User avatar

Joined: August 9th, 2007, 8:40
Posts: 789
Location: United Kingdom
Good point fzabkar also would be worth looking at lbs 768 587 855

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 12th, 2017, 18:02 
Offline
User avatar

Joined: August 9th, 2007, 8:40
Posts: 789
Location: United Kingdom
Quote:
.... I specifically chose my 100GB hard drive that I intended to use for this.


Are there two physical hard drives in the computer, or one that is partitioned as 100 and 300 ?

_________________
If you can keep your head when all about you are losing theirs, you probably don't fully understand the situation. ... Mr Kipling

https://www.mjm.co.uk/


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 13th, 2017, 4:53 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
You can see in the first post on the screenshot there are actually three hard drives but I'm ignoring the 80GB one as it's where this Windows 8.1 installation is. That 400GB one had one partition, 400GB and it was used to store media. I selected the 101GB one to install the linux OS to but it took the 400GB drive with it, that's why I said "get ready for this one". Even after I was installing it it displayed usual warning like 'everything from this drive will be deleted' not 'everything from these drives'. Probably some bug in the installation of deepin, they are a relatively new distro devs.

Tried loading the NTFS 6, 7.68GB one and this is what it comes up with
http://i.imgur.com/Za0GO42.png
advanced settings
http://i.imgur.com/NU40b1W.png
Should I just hit ok with default reconstruction or some additional settings?

I went to a few sectors, hope this is good
768 587 855
Code:
LBA:768587855          block: 768 587 855
Disk identifier (Windows):
869E12DEh
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
5Bh FBh ??        : 816 194 19 : 376 123 11 :1870620186:3972222729:  2.03 TB
79h B3h ??        :  13 103 60 : 753 231 29 :2006895668:2066797510:  1.06 TB
ACh ECh ??        : 451  25 15 : 316 177 38 :2596778765:4274795761:  2.19 TB
DEh D9h ??        : 646  18 30 : 450 159 21 :3732615379:3972222745:  2.03 TB
MBR signature (0xAA55):
6779h

207 980 544
Code:
LBA:207980544          block: 207 980 544
Disk identifier (Windows):
80FED5C2h
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
A3h 09h ??        : 766 148 62 : 679 107 39 :1816035228:2335528199:  1.20 TB
AAh 5Bh ??        : 614 129  9 : 190  81 39 :3228931642: 605646170:   310 GB
C9h 3Ah ??        : 373  37 34 : 378   4 47 : 691739722: 162318239:  83.1 GB
6Eh AAh ??        : 348 224 12 : 507 146 44 : 708932312:3640607373:  1.86 TB
MBR signature (0xAA55):
61D0h

63
Code:
LBA:63                 block: 63
Disk identifier (Windows):
03C7ADEFh
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
83h 98h ??        : 762 216 29 : 561  90 51 :1147331534:1643163467:   841 GB
62h C5h ??        : 125 133 38 : 440  66 19 :3010758073:2839649697:  1.45 TB
EBh 51h ??        :  81 249 49 :1022  89 39 :2932016327:1459810034:   747 GB
E5h 8Ch ??        : 773  63 25 : 632  85  1 :1463935837:1661009212:   850 GB
MBR signature (0xAA55):
E1F7h


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 13th, 2017, 21:46 
Offline

Joined: November 7th, 2015, 13:04
Posts: 170
Location: Austin metro area TX USA
What have you tried so far? Your Linux probably over-wrote many if not most the data on that 400GB partition, that's my guess. I do not know how to advise you to reverse what happened.

_________________
"Take care of thy backups and thy restores shall take care of thee." Ben Franklin revisited


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 13th, 2017, 22:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
"Virtual reconstruction" is read-only, so DMDE will not write on your drive. However, it would be a good idea to clone the drive, sector by sector, rather than thrashing it with repetitive searches.

The sector contents are best viewed in hex mode, ie ...

    Mode -> Hexadecimal/Text

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 57 posts ]  Go to page 1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 30 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group