-1

I had a computer with a windows 7 and I installed lubuntu 14.04 on another partition (I think I shrinked the windows NTFS partition first). I installed lubuntu this way:

-> NTFS boot
-> NTFS windows 7
-> extended partition
   -> "/" (ext4)
   -> "/home" (ext4)
   -> MAYBE there was a data partition in ext4 (I don't remember, not my computer)
   -> swap

After installation, when you booted on windows (in GRUB), it didn't work and it kept rebooting each time.

Today I decided to reinstall windows 7 so here is what I did:

  1. I launched on lubuntu, installed gparted and removed both Windows partition.
  2. I made one big NTFS partition with the intention to install windows 7 on it.
  3. I installed windows 7
  4. It erased my "/" and "/home" partitions (but they aren't reformatted)

I don't even know why it did so, maybe because I should have kept the windows partition unformatted and the boot partition created erased linux. Seriously, I'm very surprised.


So now, here are two questions:

I) How can I retrieve all the data from "/home" ? I suppose it's not removed for now since I didn't write anything on these partitions as of now.

II) What caused this accident?

1
  • The Windows installer shouldn't erase partitions without asking you—and you should be able to have it not touch them. But probably Super User would be a much better place to ask about the Windows installer.
    – derobert
    Mar 23, 2016 at 17:19

1 Answer 1

2

The first step in any data recovery like this is to make an image (bit-for-bit) copy of the drive. Then, work only on the copy (for ultimate paranoia, make a second copy and work only on that).

Copying a full disk is fairly easy. Presuming /dev/sda is the disk to copy, and you want to put the disk image at /media/backup/sda-image, any of these will work (pv will give a progress bar, ETA, etc. if you have it installed). Note they all need root (because typically root is required to read /dev/sda)—put sudo in front if required:

pv -pterba /dev/sda > /media/backup/sda-image       # or
dd if=/dev/sda of=/media/backup/sda-image bs=4096   # or
cp /dev/sda /media/backup/sda-image                 # yep, even cp works

It's possible you managed to delete the partitions and reallocate the sectors they previous allocated to your new "one big NTFS" partition. If so, you've very likely lost data as NTFS will have written (at minimum) filesystem metadata over top your ext4 partitions. Worse, you installed Windows as well—so that's a bunch of stuff written to that filesystem, which may also have overwritten your data. If this has happened, recovery may be much more difficult. If this is the case, you should avoid even booting that copy of Windows.

The basic approach is to attempt to rediscover which sectors were the ext4 filesystem(s), then you can use that to re-create the partition table—or at least map it to a loopback device (using losetup) and copy your data off. Testdisk is a utility that will do this for you. I suggest running it on the disk copy from another system, or via a live CD/DVD.

We have a bunch of questions about testdisk you may want to refer to. I also have an answer explaining how to manually search for ext4 partitions without using testdisk which could be useful if testdisk fails to find it.

Once you have your partition table back, you should run e2fsck -f -n on the partition to see how much damage the metadata has taken; if it's minimal you can take off the -n and fix it. Then mount it and verify your data. If the damage is extensive, you may want to attempt to copy your data off before fsck (mounting it read-only), and then again after to maximize the amount of data recovered.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – terdon
    Mar 26, 2016 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .