Accidentally formatted ext4 partition

Question

I have just formatted an ext4 partition to fat32 using gparted.

In which directions should I tread in my attempt to recover?

Solution 1

I made the silly mistake of formatting a partition by accident. I was installing a linux distribution called crunchbang on my netbook, so I don't have to bring my laptop to class every week. I was intending to format a USB flash drive for this purpose, when, to my dismay, I formatted an ext4 partition containing over 500gb of data to fat32. This is a summary of what I've learned:

If a filesystem is damaged, you can attempt to recover that filesystem itself, or individual files. Individual file recovery is possible regardless of the state of the filesystem, but it has the drawback of being almost completely useless if you are dealing with a lot of data. When you recover individual files, you are going to LOSE the ENTIRE directory structure of your data (that means organisation and filenames). In my case, this was completely useless, as it would take me years to sift through and rename all those music files and other junk. Also, In many cases the program will fail to find specific start and end blocks for your file (this is almost always the case with plain text files) and you could end up (like me) with each mp3 file split into a hundred 1-5 second pieces.

READ this all the way through before attempting anything... (you will find instructions for making an image of your disk at the bottom, but it should be done first)

If you are in a different situation (like recovering a very small amount of data or looking for a specific searchable piece of data), than individual file recovery could be an option for you. The free utilities I found for this are:

PhotoRec

and

ForeMost

(both are in the ubuntu repositories for your convenience)

---

If your intent is to recover an entire partition, then you should look towards a piece of software called TestDisk. This is also in the ubuntu repositories, and It has a nice curses GUI to make things easier.

TestDisk is compatable with all kinds of filesystems including ext2/3/4, ntfs, fat, and others.. (and the binary is released in Windows as well as UNIX compatible versions) Unfortunately after hours with this utility, TestDisk was able to find my old partition, but the root inode was destroyed, so I gave up on using TestDisk and decided to try to recover the ext backup superblock manually.

---

If your concern is a linux ext2/3/4 partition, then you will find these to utilities helpful (they will most certainly already be on your linux machine)

this will be used to calculate where the backup superblocks will be located in the event you were to create a ext filesystem on the partition in question mke2fs (make extended 2 file-system) for ext2/3/4

this will be used to attempt to restore the filesystem using one of the backup superblocks e2fsck (extended 2 file-system check) also for ext2/3/4

An explanation on how to recover an ext superblock manually using these utilities can be found here: Repair a broken Ext4 Superblock in Ubuntu .

SIDE NOTE: if your partition table is intact (not the case for me), then you could perhaps make use of dumpe2fs like so: Linux: Find Alternative Superblocks - nixCraft

if you are unable to use these utilities to find the backup superblocks (perhaps you messed up multiple partitions, and because of this, you don't know where they start/end) you may find use of a program called gpart (not to be confused with gparted or parted... it's totally different) though I'm not sure if it supports linux file-systems newer than ext2.. If you are at this point, It may be time to start worrying.

---

Using this last approach, I was successfully able to recover the entire partition, save the top-level directory names (so I had to rename about 6 top-level folders, but everything below them was preserved) SUCCESS!

Another thing that ended up being EXTREMELY important for me was creating a backup image of the messed up disk (in my attempts to recover, I ended up restoring this image at least twice) so FIRST thing before using any of these utilities, find some free space on your machine or an external drive..

If your messed up drive is sda, and you wanted to store the image in yourname's home directory for instance: dd if=/dev/sda of=/home/yourname/sda.img.bak bs=512

to restore the image after a failed recovery attempt: dd if=/home/yourname/sda.img.bak of=/dev/sda bs=512

You could of course use /dev/sda1 if you are only interested in the first partition, but as some of these utilities alter the partition table, it is perhaps a better idea to image the whole disk..

Also, if you are using dd for a large operation, it is very helpful to see a progress bar, for which you can use a utility called pv which reports progress of data through a pipeline

for instance: pv -tpreb /dev/sda | dd of=/home/yourname/sda.img.bak bs=512

BTW: some people suggested making the backup image, and working on it directly, but I found it easier to work on the disk itself (easier to mount) and restoring the image to disk if/when necessary

Solution 2

Here a link to a related question we had some time ago: Recovering Very Important Lost Data From Ntfs Partition

If the data is REALLY important. Stop using the disk/partition NOW. Unmount it! And do a read only copy of the disk. Every time you try to recover something on the original disk you are in danger of loosing more data. Then try recovery tools on the copied disk image. You can create an image with dd if=your_partition of=your_disk_image_file bs=512 (hope the syntax is correct) Have a look here as well DataRecovery - Community Help Wiki and here https://forensicswiki.org/wiki/Tools:Data_Recovery.

To make sure you do not loose data work only on the disk image you created!!!!

If you cant recover the partition you can still try to use a carving tool like foremost to recover (some) of your data. The tool will analyze the disk content and look for files in well known formats. Have a look here for a quick example how to use it http://www.rissmann.ch/2014/08/09/how-to-recover-lost-files/

Comments

[Shane]

@AshutoshKale that comment is not very helpful. I know that It is tricky business, and likely not 100% recoverable, but far from impossible. It is generally more harmful to give bad advice than it is to avoid giving any. And before someone comes around to say that this question has already been asked, this is a sensitive issue for me, and I thought the specifics would matter (ie ext4 to fat32, using gparted... perhaps gparted stores some information about deleted partitions to protect against this?)

[Shane]

@Ruediger .. thanks for the response. I have just finished creating an image of the disk, and currently using testdisk to attempt to restore a backup of the ext4 superblock. I feel pretty optimistic about it so far.

[Rajind Ruparathna]

I was able to fix mine following similar steps. I recorded those details in the following blog post. notebookbft.wordpress.com/2017/04/27/…