1

today I did a stupid thing like using Windows “diskpart” to try to delete a volume inside my portable SSD NVME 256GB, but instead I type “clean” and I deleted all volumes in that disk.

Inside the external SSD disk there was in order: • 8 GB windows recovery boot • 147 GB volume where I store general folders formatted in NTFS • 2 gb linux boot folder in ext4 • 39 gb ubuntu encrypted volume in ext4 • 22 gb veracrypt encrypted volume in exfat (I think is exfat, but not sure, in any case windows showed RAW) (this is the most important and the one I cannot see) (the encrypted volume used to hide another encrypted volume) • 17 Gb of EFI windows boot

Under you can see some of my screenshots:

enter image description here

enter image description here

enter image description here

enter image description here

The result is very messy and wrong:

enter image description here

Then I changed the “head” in the disk geometry to 8 (before was 255) and then analysed again, but the result was the same.

Do you have any idea how I can recover all the partition like before?

1
  • If you get no answers or no options, try using R-Studio Undelete. Feb 24 '21 at 19:24
0

I don't know what the windows tool did, but assuming it just deleted the partition table, there is a chance. You need to find where your partitions start. First of all, if any of those screenshots shows the original state, that could be enough information to recover it.

If not, you have to guess. The first one often starts at 1 MB, and they tend to be aligned to whole megabytes. But there is no guarantee that this was the case.

To look at the second megabyte of your disk (probably the start of the first partition) try this:

dd if=/dev/sdb bs=1M skip=1 count=1 | file -

You say the first partition was a windows recovery partition, probably NTFS or FAT. file would then say something like this:

/dev/stdin: DOS/MBR boot sector, code offset 0x58+2, OEM-ID "mkfs.fat", Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 2048, sectors 524286 (volumes > 32 MB), FAT (32 bit), sectors/FAT 4033, reserved 0x1, serial number 0x7109f176, label: "EFI20210224"

Or this:

/dev/stdin: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 0, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors 204799, $MFT start cluster 4, $MFTMirror start cluster 12799, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 064baf16e1b371b26

If it just says /dev/stdin: data, you got the wrong position. Tweak the skip= parameter until you find it. You might have to check multiples of 512 bytes instead of whole megabytes. You remember the approximate sizes and the order, so there is a chance.

For the ext4 partition, file would say something like:

/dev/stdin: Linux rev 1.0 ext4 filesystem data, UUID=52e69144-d086-54a3-882c-97fa6985226f, volume name "proot20210224" (needs journal recovery) (extents) (64bit) (large files) (huge files)

For each type of filesystem, you can create it in a regular file, and then check what file says about them. This way you'll know when you found each type. Don't just bruteforce it though, check around the positions they should be at. There might be random garbage that looks enough like a filesystem header anywhere on the disk to fool file.

Once you have all the positions, create the exact same layout. You probably want to use sfdisk for this. I never know what the more user friendly options mean by a gigabyte, sfdisk always uses 512 bytes as the unit. So the first one could be

start=2048,size=16777216

If it really starts at 1 MB, and it's exacly 8 GiB. But the size of course depends on where you found the next one. For the last partition, you can skip the size to use the rest of the disk.

If you updated the partition table, try to mount the partitions read only, and copy the data somewhere else. I would not continue to use that disk read-write until all the data is safe.

3
  • Thanks for replying but your knowledge far exceded my experience. I am using windows 10, never used ubuntu in my life, first time using testdisk. I don't even know where to insert those commands you wrote. On the windows cmd? Is there a tutorial for me on youtube or somewhere?
    – RosMyster
    Feb 25 '21 at 21:03
  • These are linux commands, I assumed you still have a working install somewhere, or at least a copy of sysresccd. (And those screenshots look an awful lot like cfdisk.) dd is a simple data copy tool, file tries to guess what type of data it's looking at, and sfdisk can create partition tables. But the first rule of data recovery is if you don't know exactly what you're doing, don't. It is possible to make things worse.
    – stribika
    Feb 25 '21 at 21:19
  • So in the first command, if=/dev/sdb tells dd to read from /dev/sdb; bs=1M tells it to use 1 MiB units; skip=1 tells it to skip 1 unit (MiB) at the start of the input; count=1 tells it to read 1 unit. Since there is no of=, it will write to stdout, which is sent into file's stdin because of the |. The - tells file to read from its stdin.
    – stribika
    Feb 25 '21 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.