Switch to full style
Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
Post a reply

Lost all files due to linux installation.

March 10th, 2017, 9:35

Get ready for this one :)
I'm trying this morning to install deepin linux (debian with deepin de) and I specifically chose my 100GB hard drive that I intended to use for this. Checked around 3 times it's the correct one. Moved on with the installation and when I rebooted I found out that it used also my 400GB hard drive (not partition, those are two separate hard drives) to install something onto it deleting around 350GB of data. Now the hard drive has a changed format, used to be NTFS now it's ext4 I think. What should I use and how to get those files back. Here's a screenshot of how it's showing in 'Disks' a disk utility for linux. Image

The 80GB hard drive is an old 3.5" IDE drive, 101GB and 400GB are 2.5" sata drives.

Thanks.

Re: Lost all files due to linux installation.

March 10th, 2017, 15:08

P.S. linux software is better (I guess) because recuva doesn't seem to recognize ext4 or should I delete all partitions off of it and format as ntfs or fat? This hard drive is now in USB enclosure so I can safely remove it when I install some stuff next time but it can be put back into the machine if needed.

Files aren't that really important but it would make my d̶a̶y̶ month if I could get them back. I noticed that the hard drive had a bad sector but it never showed any problems whatsoever.

Thanks again.

Re: Lost all files due to linux installation.

March 10th, 2017, 15:56

I see that the last 1.1MB is free. Perhaps there is still a backup copy of the NTFS boot sector in that area?

Can you show us the Partitions window in DMDE (freeware disc editor)?

https://dmde.com/

Re: Lost all files due to linux installation.

March 10th, 2017, 16:26

Chose this 400GB hitachi drive. Hope this is the right thing.
Too big image to post here so it's like this
http://i.imgur.com/CuTmWdj.png

Re: Lost all files due to linux installation.

March 10th, 2017, 18:16

I love working with jobs like that. But I charge.

Re: Lost all files due to linux installation.

March 10th, 2017, 19:22

If you select "$Volume 02" and open it, do you see a file/folder tree (probably not)?

Re: Lost all files due to linux installation.

March 11th, 2017, 4:41

When I highlight $Volume 02 and click 'open' it pops up a window
http://i.imgur.com/s1m0u6u.png
if I go 'auto detect option' this I get
http://i.imgur.com/9K11Ghd.png
if I go 'continue with this parameters' I get
http://i.imgur.com/UndK0g8.png


@scratchy I also like someone else doing it but I don't have any money :)

Re: Lost all files due to linux installation.

March 11th, 2017, 13:57

Try an NTFS search.

Re: Lost all files due to linux installation.

March 11th, 2017, 18:47

The MFT (Master File Table) is the root of your file/folder structure. It appears to have been destroyed by the Linux install. I'm assuming that your drive was originally partitioned as detected by DMDE, ie 106GB and 294GB partitions.

An NTFS search will scan the drive for NTFS fragments. If this does not prove to be fruitful, then a raw search may be necessary. A raw search tries to find files based on the signatures in their headers.

You can adjust the sliders in the Scan Parameters to limit or expand the search area.

Re: Lost all files due to linux installation.

March 11th, 2017, 19:37

Image

Got some fragments I guess (after NTFS scan). Tomorrow I will scan for raw if necessary now it's 12:30.

Re: Lost all files due to linux installation.

March 12th, 2017, 10:19

Hi

http://imgur.com/s1m0u6u is (probably) the back up boot sector of a partition that starts at LBA 207 980 544. Which would give you a ~300 GB partition
starting at LBA 207 980 544

If the original partition was 400 GB, then this is not the correct backup boot sector and you will need to search again.
If the partition was in fact 300 GB then look at the location 207 980 544 and see what is there. If there is another boot sector there you are almost ready to rebuild the partition table.

You could also look at LBA63 to see what is there. The linux partition does not start until 2048 so the original boot sector may still be at 63 if

a) it has not been overwritten and;
b) that was it's original location.

If it was 2048 then the boot sector and MFT mirror will have been overwritten, but that can be recovered if the first copy of the MFT is available. I can write a boot sector if necessary as long as the main file system info is still intact.

If you cant do it with that software, get a demo of WinHex http://www.winhex.com/winhex/index-m.html

Re: Lost all files due to linux installation.

March 12th, 2017, 12:14

The entire drive's capacity is 400GB and it had only one partition that I used, don't know if any other existed and I used only that one for media (videos, pics, documents etc) so the partition cannot be 300GB I guess. Maybe it's ~300GB because I used about that much on the drive?

Guess I'm going to have to do a 'raw' and 'NTFS' search.

How do I 'take a look' at LBA63?

How do I recover MFT with either of these programs?

(Too many questions I know.)

This is the DMDE NTFS scan by the way http://i.imgur.com/1f3rOXA.png

Re: Lost all files due to linux installation.

March 12th, 2017, 16:28

You can use winhex disk editor to view the sectors. The size of the volume is not conditional on the amount of data stored on the drive. It is set when the volume is formatted. It could be a remnant from an old installation

Re: Lost all files due to linux installation.

March 12th, 2017, 16:36

Loaded the correct hard drive. Here it is

http://i.imgur.com/LbPK8fe.png

What now? :)

Re: Lost all files due to linux installation.

March 12th, 2017, 17:38

It appears that DMDE didn't find much. Try selecting each of the NTFS results and Open Volume.

To go to a particular sector, select Editor -> Goto Offset. You can save the screen text by selecting Edit -> Export to Text File. Then paste the text output inside the forum's "Code" box using the BBcode button.

Re: Lost all files due to linux installation.

March 12th, 2017, 17:56

Good point fzabkar also would be worth looking at lbs 768 587 855

Re: Lost all files due to linux installation.

March 12th, 2017, 18:02

.... I specifically chose my 100GB hard drive that I intended to use for this.


Are there two physical hard drives in the computer, or one that is partitioned as 100 and 300 ?

Re: Lost all files due to linux installation.

March 13th, 2017, 4:53

You can see in the first post on the screenshot there are actually three hard drives but I'm ignoring the 80GB one as it's where this Windows 8.1 installation is. That 400GB one had one partition, 400GB and it was used to store media. I selected the 101GB one to install the linux OS to but it took the 400GB drive with it, that's why I said "get ready for this one". Even after I was installing it it displayed usual warning like 'everything from this drive will be deleted' not 'everything from these drives'. Probably some bug in the installation of deepin, they are a relatively new distro devs.

Tried loading the NTFS 6, 7.68GB one and this is what it comes up with
http://i.imgur.com/Za0GO42.png
advanced settings
http://i.imgur.com/NU40b1W.png
Should I just hit ok with default reconstruction or some additional settings?

I went to a few sectors, hope this is good
768 587 855
Code:
LBA:768587855          block: 768 587 855
Disk identifier (Windows):
869E12DEh
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
5Bh FBh ??        : 816 194 19 : 376 123 11 :1870620186:3972222729:  2.03 TB
79h B3h ??        :  13 103 60 : 753 231 29 :2006895668:2066797510:  1.06 TB
ACh ECh ??        : 451  25 15 : 316 177 38 :2596778765:4274795761:  2.19 TB
DEh D9h ??        : 646  18 30 : 450 159 21 :3732615379:3972222745:  2.03 TB
MBR signature (0xAA55):
6779h

207 980 544
Code:
LBA:207980544          block: 207 980 544
Disk identifier (Windows):
80FED5C2h
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
A3h 09h ??        : 766 148 62 : 679 107 39 :1816035228:2335528199:  1.20 TB
AAh 5Bh ??        : 614 129  9 : 190  81 39 :3228931642: 605646170:   310 GB
C9h 3Ah ??        : 373  37 34 : 378   4 47 : 691739722: 162318239:  83.1 GB
6Eh AAh ??        : 348 224 12 : 507 146 44 : 708932312:3640607373:  1.86 TB
MBR signature (0xAA55):
61D0h

63
Code:
LBA:63                 block: 63
Disk identifier (Windows):
03C7ADEFh
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
83h 98h ??        : 762 216 29 : 561  90 51 :1147331534:1643163467:   841 GB
62h C5h ??        : 125 133 38 : 440  66 19 :3010758073:2839649697:  1.45 TB
EBh 51h ??        :  81 249 49 :1022  89 39 :2932016327:1459810034:   747 GB
E5h 8Ch ??        : 773  63 25 : 632  85  1 :1463935837:1661009212:   850 GB
MBR signature (0xAA55):
E1F7h

Re: Lost all files due to linux installation.

March 13th, 2017, 21:46

What have you tried so far? Your Linux probably over-wrote many if not most the data on that 400GB partition, that's my guess. I do not know how to advise you to reverse what happened.

Re: Lost all files due to linux installation.

March 13th, 2017, 22:45

"Virtual reconstruction" is read-only, so DMDE will not write on your drive. However, it would be a good idea to clone the drive, sector by sector, rather than thrashing it with repetitive searches.

The sector contents are best viewed in hex mode, ie ...

    Mode -> Hexadecimal/Text
Post a reply