PDA

View Full Version : Accidental format of OS in Ubuntu



Curbd
10-12-2012, 05:02 PM
Hi there,

Earlier using an Ubuntu live cd and running GNU Parted, I accidentally formatted my main operating system hard drive. I formatted it into Ext3, and soon after realised what I had done.
I shut the computer down and tried to restart in XP but there was an error as expected.

What's the best approach for recovering the data? Will XP need to be reinstalled or can it be completely recovered? I'm not sure if now having it formatted into Ext3 causes more issues, as windows can't read Ext3 partitions.

I really hope you can help (Rest assured my next thread after this will be about backing up).

Thanks!

Curbd

wainuitech
10-12-2012, 05:13 PM
Depends on if you want to recover the data on the drive, OR the Actual OS.

If its data recovery, its possible sometimes using the right software even after a format.

If its the OS ( XP) better to wipe it clean and reinstall.

Curbd
10-12-2012, 05:18 PM
If I can recover the OS too that would be great, but if it's only the data I can restore then I'm happy with that too.

Thanks.

wainuitech
10-12-2012, 05:45 PM
A recovery of the OS / Programs if it did work, could be unstable, or not work at all. Better to reinstall, would take less time in the long run and then you'll know its complete.

A fresh install will run better more than likely anyway, good chance to have a "clean out".

Curbd
10-12-2012, 05:50 PM
Sounds like a good plan!
What is the best way to recover my files? I'm currently looking at TestDisk by CGSecurity. Any tips too?
Thanks so much for your help and fast replies :)

The Error Guy
10-12-2012, 06:20 PM
No experience on software (although I'd be keen to know because it will happen to me :rolleyes: ) Just remember that you will need to have a 2nd HDD to recover the data to since if you recover to the damaged/formatted HDD you will be overwriting the stuff you are trying to retrieve.

fred_fish
10-12-2012, 06:22 PM
Which partition did you format?
XP or ubuntu?
If ubuntu, only the XP bootloader needs reinstalling as the grub files on the ubuntu partition are gone, so the grub bootloader won't work.
If XP, testdisk is your best bet for restoring the previous ntfs partition, although as stated above, XP may need a repair install, or better yet, copy off the data from ubuntu or such, then a clean install.
Testdisk can also give access to the lost data and you can copy it from there if you have some storage space available on another mounted volume.

Curbd
10-12-2012, 06:27 PM
Thanks for the advice on using a second hard drive, I have one formatted (correctly, this time!) and ready to go. The Error Guy, I'll let you know how I get on and what software I use.

fred_fish, it was the XP volume that was formatted, Ubuntu was being run as a live cd.

Thanks for the advice everyone, time for me to download a TestDisk live disc! I'll keep you posted.

Curbd.

gary67
10-12-2012, 06:43 PM
If you have enough of a data cap you can download XP SP3 with almost all the latest updates from here (http://www.ryanvm.net/forum/viewtopic.php?t=6438)

Curbd
10-12-2012, 07:34 PM
Thanks gary67, although painful I think I'll take the long approach - I can't risk errors. Thanks for the link, it's great to see that somebody has created the resource!

Ok, question, in TestDisk I am asked what partition table the drive has. It was originally NTFS, but when I formatted it it was set to Ext3.
My options in TestDisk are:

Intel - Intel/PC partition (selected by default by TestDisk)
EFI GPT partition map (Mac i386, some x86_64)
Humax partition table
Apple partition map
Non partitioned media
Sun Solaris partition
XBox partition

What should I choose?

Thanks.

Curbd.

pcuser42
10-12-2012, 07:45 PM
Thanks gary67, although painful I think I'll take the long approach - I can't risk errors. Thanks for the link, it's great to see that somebody has created the resource!

Ok, question, in TestDisk I am asked what partition table the drive has. It was originally NTFS, but when I formatted it it was set to Ext3.
My options in TestDisk are:

Intel - Intel/PC partition (selected by default by TestDisk)
EFI GPT partition map (Mac i386, some x86_64)
Humax partition table
Apple partition map
Non partitioned media
Sun Solaris partition
XBox partition

What should I choose?

Thanks.

Curbd.

The default. If in doubt, leave it alone! :)

Curbd
10-12-2012, 08:26 PM
The default worked well, on its initial scan it didn't find the NTFS partition, but on the second deeper scan it did.
I'm confused by the documentation of TestDisk, I'm not sure why they press 'Backup BS' / 'Copy backup boot sector over boot sector'.
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The sectors used in the Linux partition and the NTFS partition are identical. I don't know whether to now tell the program to delete the linux partition and make the NTFS one a primary partition.
If I ask it to list the files of the NTFS partition it says 'Can't open filesystem. Filesystem seems damaged'.

I don't know if this is enough information for anyone to assist, if not I'll take a stab.

Thanks.

Curbd.

fred_fish
10-12-2012, 08:48 PM
I'm confused by the documentation of TestDisk, I'm not sure why they press 'Backup BS' / 'Copy backup boot sector over boot sector'.
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The sectors used in the Linux partition and the NTFS partition are identical. I don't know whether to now tell the program to delete the linux partition and make the NTFS one a primary partition.
If I ask it to list the files of the NTFS partition it says 'Can't open filesystem. Filesystem seems damaged'.

That's not a good sign.
They are not two separate partitions, you can't "delete one and make the other one the primary".
What it is doing is attempting to retrieve the configuration of the old NTFS format of the partition from the backup boot sector and MFT so it can write it back to the correct place, overwriting the new ext3 info you put there by formatting it.
If you are lucky, the file system should be mostly intact, however what you have posted looks like you might not be.
Once you have restored the NTFS partition info, I would try a chkdsk run over it, from a Win boot disk or another system.
Of course, if the data is important, you should be doing all this on an image of the original drive, or better yet, just restoring from your backup ... :)

Curbd
11-12-2012, 06:07 PM
Thanks for the advice fred_fish.

My files have been retrieved! I'll list down what I went through for The Error Guy and incase it can help anyone else:

System Rescue CD:
I downloaded the 'System Rescue CD' live disc, it's simply a CD that you can put into the computer at boot and load 'TestDisk' (and 'PhotoRec') by CGSecurity. I downloaded this on another computer and ripped the .iso image to CD using 'ImgBurn'.
At boot it tells you to type in a command to go into the graphical mode, which I did.

TestDisk
I then went into the systems menu, and found 'TestDisk'. I performed analysis on the hard drive, and then the deeper analysis.
Upon deeper analysis, TestDisk found that the drive had a NTFS partition on there somewhere, and it so happened to be in the same sectors as the Linux partition.
I couldn't list the files under the NTFS partition, saying the boot sector or partition table was corrupt or something similar.
I continued with TestDisk, and changed the Linux partition to 'D', for it to supposedly be deleted, and changed the NTFS (Windows) partition to 'P' for primary.
I pressed the option for TestDisk to restore a backup of the boot sector, and tried to use the fix/write new boot sector option, which returned a corrupt error again.

PhotoRec
I ran PhotoRec by typing 'PhotoRec' into the terminal.
Under settings you can change it so that all files will be saved, even if they are not recognisable files (such as .jpg or .bmp) by PhotoRec. This would be an important option to use to restore as many of your files as possible.
Sadly I couldn't locate my external hard drive on the System Rescue CD's operating system, so I couldn't continue with the PhotoRec process.

Windows Installation Disc
I inserted a Windows Installation Disc (the kind that usually comes with your computer) at boot, and instead of pressing R, I pressed enter to continue with the Windows setup. At the next screen where you can select what drive you want to install Windows onto, there can be an option available to 'repair' the partition. This wasn't an option for me, so I exited out of it.
I rebooted and tried pressing 'R' to use the recovery console, but it could only see the hard drives other partition (it's a Dell Media Direct partition, containing no useful Windows OS files as far as I can tell). If it had seen the right partition I would have tried 'fixmbr' and 'fixboot' at the command/terminal.

Hard Drive in the second computer / Checkdisk
I was running out of options, so I decided to unscrew the hard drive from the bottom of the laptop and insert it into my desktop computer. Thankfully it was very easy to remove, it only required a couple of screws to be removed and then it slid right out. It connected to my desktop with the SATA data and power cables in the desktop computer (I had to disconnect another drive temporarily).
I booted up the desktop, and it automatically started Checkdisk (chkdsk). It took its time and I'm glad it did, it scanned through every sector and flashed file names up on the screen as it repaired them! The hard drive is 100GB, and the process took a couple of hours or more. I think it was important to have done the 'TestDisk' step earlier, as I think this allowed Checkdisk to see the partition.

Copying the files
My next step was to open the drive and see if I could fetch the files, success! I copy and pasted the files from the previously-corrupted hard drive onto another drive, using a portable program called X-Abakt. It's a portable program so doesn't need to be installed, and it is open source. The reason why I used Abakt was that I initially tried a copy and paste within Windows Explorer, but it got to a file that couldn't be copied and gave up. I now have all of my files back, and they work well!

Does the hard drive work in the laptop?
Putting the hard drive back into the laptop, and trying to boot from it doesn't work. It initially couldn't see the partition, so I added that with the command prompt on the Windows Installation Disc, but when I tried to boot it said that a windows .dll couldn't be found named 'hal.dll' in system32. It said to reinstall a copy of the missing file.
I've decided to reinstall Windows at this point, I'm sure it could still have been recovered but for the extra time (and possible errors) it didn't seem worth it.

I hope this is useful and that if you have any hard drive problems you manage to recover your files.

Thanks so much for your help and hand-holding everyone, hugely hugely appreciated!

Note: As soon as I realised I had accidentally formatted my hard drive, I turned the computer off and didn't use it to remove the likelihood of data being overwritten.
Sorry for the tedious details, but if anybody else happens to run into the same problem it's better to have too much info than too little.

Phew... :)

fred_fish
11-12-2012, 07:11 PM
Win!

That's probably the best possible outcome.

Yes, the change of partition-type label is essential.
chkdsk then recognises the partition and uses the backup sectors and remaining structure to attempt to rebuild the filesystem info.

Photrec is probably a last resort option. While it can read the data directly from the disk and recognise filetypes and boundaries based on header and footer blocks, without access to a valid MFT it has no way to determine filenames or to completely recover fragmented files.

mikebartnz
11-12-2012, 08:00 PM
Good on you for telling how you did it all. Thank you.

wainuitech
11-12-2012, 08:35 PM
Good you got your data back. Thanks for coming back and saying.

Proves one thing as well ;) Even though a HDD is formatted, the data is not actually fully gone.

Agent_24
12-12-2012, 11:07 AM
Good to hear of your success but I would strongly advise you make a 1:1 sector-by-sector backup image of drives in this kind of state before you do anything to them.

Next time you may not be so lucky - CHKDSK could just as well have decided the files were unfixable and deleted them all instead!

Curbd
11-01-2013, 08:27 PM
Good to hear of your success but I would strongly advise you make a 1:1 sector-by-sector backup image of drives in this kind of state before you do anything to them.

Next time you may not be so lucky - CHKDSK could just as well have decided the files were unfixable and deleted them all instead!

Good thinking Agent_24, do you have any software to recommend doing a 1:1 sector-by-sector backup with?

Thanks all!

Curbd.

KarameaDave
11-01-2013, 09:22 PM
Sorry wrong thread!

Agent_24
12-01-2013, 12:08 AM
Good thinking Agent_24, do you have any software to recommend doing a 1:1 sector-by-sector backup with?

Most drive cloning software can do this, since it is easy: it does not require any knowledge of the filesystem(s). Any half-decent software should have this feature. On a healthy drive you can use any software you like.

However, If your data is on a faulty drive you need something more capable, and you need to minimise activity on the drive so you have the best chance of getting data off. I like to use GNU ddrescue (http://www.gnu.org/software/ddrescue/ddrescue.html) to make an initial backup image. It works just as well on healthy drives too.


As for using CHKDSK. It's a common mistake people make. CHKDSK (and the older Scandisk) is not a data recovery program, nor is it really designed to work with faulty drives.

While it does recover things in some cases (as happened luckily for you) and it can attempt to handle faulty drives in some way, its main function is to repair errors that prevent proper functioning of the filesystem. If that means deleting files it can do nothing else with, then that is what it will do. And if bad hardware gets in the way, you can end up with even more problems.

The main point of data recovery is to NOT write to the drive!

Make a 1:1 sector image (a partition-level image is useless because it only copies what it can see) and keep that as your master copy.

Take a second copy of that first image, and perform all your recovery attempts on it. Then you can perform writes if needed. If you change something for the worse, just re-copy from the master image and try again.

This works because if the drive you are recovering from is faulty, you may only get one chance to read off the data. If you do a bad write to your image and need to re-read it after the source drive has died, well... :xmouth:


For any drive that is dead beyond software solutions, be prepared to pay big bucks.