Oh Хрен! - Data recovery when the [****] hits the fan!

@cleoqc
@mitch.kremm

Problem:
I copied a new image to my 500GB multi-boot O/S SDD and attempted to boot it.  Unfortunately, it had the “expand to fill the entire drive” option set and as a consequence it turned the entire 500GB SSD, with all my hard won data, into a gigantic SD card.

First thought:  Oh &^%$#@&!!
Second thought:  I’m thoroughly BORKED.

Yes, I have some backups, but I really need a way to keep a handle on things.

Then I decided to try to see what I could recover:

What I had before this happened was a 500GB SSD that had a number of partitions, (one primary partition and seven logical partitions that allowed me to boot one of three operating systems and maintain a “project files” partition), that was my multi-boot SSD with all my test data on it.

What I had afterward was two primary partitions - the original “OS_BOOT” partition and a new primary partition that had the operating system’s root file system on it.

I immediately tried using parted to see what I could recover, but it didn’t find anything.  then I had a brainstorm - I deleted the large primary partition that was where the original extended (logical) partition was and recreated an extended partition there.

Parted was then able to find the original FAT32 boot partitons and one root partition, (the one for the new operating system I copied), but nothing else.

Then I remembered another tool I used awhile back to recover some lost data on ext2/3/4 partitons - TestDisk.

Viz.:
https://www.cgsecurity.org/wiki/TestDisk

Placing this on a Intel box running Mint 19.3, I attached the SSD to it and told it to “analyze” the disk looking for partitions.

It did.

It found every single partition on the disk, and I allowed it to update the partition table.

Now nothing’s perfect and the exact partition layout’s structure wasn’t exactly the same.  Some of the original logical partitions were now primary partitions, but they were there, the filesystems were verifiable, and, more important, every one of the Linux filesystems fsck’d perfectly - including my precious “Project_Files” partition!

Ultimately, I am copying each partition’s data off onto another drive and then I will have to re-organize the original SSD and copy the partitions back on it in the correct way.  But that’s chicken-feed compared to having to manually regenerate everything.

I thought I’d mention this - especially the tool “TestDisk”, (even though it doesn’t have a Raspberry Pi version) - as it is pure magic.

This is the second time TestDisk has saved my bacon hugely and I’m gonna “buy them a beer”.  In fact, I plan to buy them a couple of crates!

2 Likes