Scheduled Maintenance: We are aware of an issue with Google, AOL, and Yahoo services as email providers which are blocking new registrations. We are trying to fix the issue and we have several internal and external support tickets in process to resolve the issue. Please see: viewtopic.php?t=158230

 

 

 

[Hardware] Partition table overwritten, can I recover?

Need help with peripherals or devices?
Post Reply
Message
Author
MrPorcine
Posts: 2
Joined: 2023-01-12 00:37

[Hardware] Partition table overwritten, can I recover?

#1 Post by MrPorcine »

I have two drives in an external USB RAID1 box. The kernel sees this a just one drive, all the RAIDness is done by the external hardware. While preparing another RAID1 array with gdisk and mdadm I wrote over the partition table in the external box so it now thinks it's part of a RAID1 array. Is there any hope of recovering at least some of the old data? All the data was in one partition, formatted EXT2.

I found findSuper and am running it now. It's found many superblocks, with dates from just after the partition overwrite to some several years old. I have not done any writes to either of the disks yet. I'm resigned to loosing all the files, but if there is a way forward I'd like to try.

User avatar
dilberts_left_nut
Administrator
Administrator
Posts: 5346
Joined: 2009-10-05 07:54
Location: enzed
Has thanked: 12 times
Been thanked: 66 times

Re: [Hardware] Partition table overwritten, can I recover?

#2 Post by dilberts_left_nut »

Testdisk is my recommended tool for partition recovery.

Hardware raid may complicate matters.
AdrianTM wrote:There's no hacker in my grandma...

User avatar
kent_dorfman766
Posts: 535
Joined: 2022-12-16 06:34
Location: socialist states of america
Has thanked: 57 times
Been thanked: 70 times

Re: [Hardware] Partition table overwritten, can I recover?

#3 Post by kent_dorfman766 »

If you know what sectors the partitions started and stopped on and you know their types then you can recover data from them, but it is rare that folks save that data offline for these types of emergencies.

ChristianMorris
Posts: 7
Joined: 2022-12-04 16:07
Been thanked: 2 times

Re: [Hardware] Partition table overwritten, can I recover?

#4 Post by ChristianMorris »

There is a chance that you can recover some of the old data using findSuper and a data recovery tool such as ext2undelete or ext3grep. These tools scan the file system for deleted files and inode information, which can be used to recover the files. However, it's important to note that the chances of recovery are not guaranteed and may vary depending on the amount of data that has been written to the drive since the partition table was overwritten.

It's also important to stop any further writes to the drive, as this can cause the data that you are trying to recover to become overwritten. If you are able to recover any files, it's best to save them to a different drive to avoid any further data loss.

It's also worth noting that you should be careful when using recovery tools as they can cause further damage to the drive, so you might want to consider using professional data recovery service.

MrPorcine
Posts: 2
Joined: 2023-01-12 00:37

Re: [Hardware] Partition table overwritten, can I recover?

#5 Post by MrPorcine »

Nothing has been written to the drives since the incident. I'm waiting for another 4T drive to arrive so I can image the damaged drive and work on the image. So far all I've done is put two new drives in the external NAS box and format them for RAID1. Next step is to remove them and see what (if any) changes the hardware NAS makes to the drive format.

This is a background project as most of the important data was backed up to the cloud. Not all though... :-(

ChristianMorris
Posts: 7
Joined: 2022-12-04 16:07
Been thanked: 2 times

Re: [Hardware] Partition table overwritten, can I recover?

#6 Post by ChristianMorris »

It's good to hear that some of the data was backed up, and that you have a plan for creating an image of the damaged drive. That way, you can work on the image and minimize the risk of further data loss ;)
Before you image the drive, you should run a disk checking tool, such as "fsck" or "chkdsk", to check the integrity of the file system and repair any errors. Then, once the image is created, you can use data recovery tools on the image instead of the physical drive to minimize the risk of further data loss.
I hope I was helpful!

Post Reply