Sunday, March 3, 2019

partitioning - Recovering Ext3 Partition After Failed Move


I had an 1.5TB exteral disk, with an 983.83 GB ext3 partition on it, where the partition was positioned such that there were approximately 400 GB free space before the ext3 partition.


I then used Minitool Partition Wizard to move the partition to the start of the drive, but unfortunately the cable was ripped out from the drive at 54% completion.


Now the drive simply shows an unknown partition where the ext3 partition used to be.


I had a look at the situation using Partition Wizard's Partition Recovery, and it detects the an ext3 partition at the new location, as well as an unknown partition at the old location.


Since I have moved the partition to the start of the drive I suspect that it would be possible to continue the process in some way, the partition overlap, but there should be a sufficient offset between the locations, such that all the data should still be on the disk, though it is cut in two parts.


I have two ideas to how to fix the problem, but I'm not sure how I would make it happen.


The first idea is to simply copy the rest of the partition to the new location and then undelete the partition, such that it would show up again. It seems it would be the easiest way to fix the problem.


The second idea was to recover the partition at the new location, and then resize the partition to fill the entire drive and finally try to undelete the files, but I'm not sure this is even possible.


Does anyone of you have a good idea of how one of these ideas could be accomplished?


Alternative ideas to recover the partition would also be greatly appreciated.


EDIT: Clarified information about partition size and overlap.


Answer



OK, I don't know minitool, so I'll assume that it does the obvious thing: copy bytes sequentially and adjust metadata, either up front or afterwards.


You can use fdisk -l to see what state your partition table is in. It should either report a partition at the old location, or at the new location. Things might be easiest for you if you were to recover the partition in the location the metadata indicates.


You write that “there should not be any of the actual data which have been overwritten”. Does that mean that the whole partition is smaller than 400GB, in other words, that the old and the new location do not overlap? If so, you may skip the rest of this answer.


Otherwise I'd try to work out the offset of the move: by what distance were your sectors supposedly copied? The recovery output should give you a good indication there. If you have that worked out, I'd try to search for some overlap: using dd you can read arbitrary portions of your drive content. Do so at two locations exactly that offset apart from one another, and pipe the result to some hash function like md5sum. If your offset is correct, and the lower location contains bytes already copied while the higher location contains the source of those same bytes before copying, then the data and hence the hash should agree. In that case, you could simply copy the remaining data using the same offset, in order to either complete or undo the transfer, depending on the intended location of the recovered data which you have decided on above.


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...