How to recover an ext4 signature deleted with fdisk?

Question

While resizing an EBS volume on Amazon AWS I accidentally deleted the ext4 signature.

root@server:~# fdisk /dev/xvdf

Welcome to fdisk (util-linux 2.31.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Command (m for help): d
Selected partition 1
Partition 1 has been deleted.

Command (m for help): n
Partition type
   p   primary (0 primary, 0 extended, 4 free)
   e   extended (container for logical partitions)
Select (default p): 

Using default response p.
Partition number (1-4, default 1): 
First sector (2048-524287999, default 2048): 
Last sector, +sectors or +size{K,M,G,T,P} (2048-524287999, default 524287999): 

Created a new partition 1 of type 'Linux' and of size 250 GiB.
Partition #1 contains a ext4 signature.

Do you want to remove the signature? [Y]es/[N]o: y

The signature will be removed by a write command.

Command (m for help): w
The partition table has been altered.
Syncing disks.

root@server:~# 
root@server:~# resize2fs /dev/xvdf1
resize2fs 1.44.1 (24-Mar-2018)
resize2fs: Device or resource busy while trying to open /dev/xvdf1
Couldn't find valid filesystem superblock.

Is there a way to recover my filesystem?

Solution

Restoring from backup is the safest option, as it is a known procedure.

Salvaging data rapidly becomes time consuming, costly, and risky. Take a backup of the broken volume, especially if you value the data and have no other copy.

Dump the ext4 details and attempt to fsck with a backup superblock. Not being able to recover is still a possibility, but file system tools will examine the structures if they can be found.

Do a cost benefit analysis of whether the data is worth hiring a recovery professional. (A "filesystem wizard" as dumpe2fs man page says.)

---

Personally, I prefer LVM on top of unpartitioned disks. Still need to be careful about wiping a filesystem, but not via fdisk.

Comments

[Michael Hampton]

Go back to the snapshot you made just prior to doing this.