# Need help to properly restore ext4 partitions with testdisk



## snoze33 (Oct 31, 2011)

Hello, first time ever using a forum so I hope I'm doing this right! Here is my situation, I am using ubuntu 11.04 0s and have 2 hdd's 250 gigs ea. I got a grub error and could not reboot. I installed ubuntu on 2nd drive and proceeded to use fdisk, fsck, r-linux, and testdisk to check & recover partitions/files from failed drive. I now have located my partitions, from the default install of ubuntu & rewritten partition table to disk but am not quite sure if its exactly correct. I can see my files with testdisk and r-linux but they somehow have wound up in sbd1 /lost+found folder. my drive is not visible thru (explorer? not sure what u call it in lunux os's). I dont see any errors with fdsk or fdisk but testdisk shows 2 partitions, 1 primary boot & 1 a primary linux swap. the partitioning i wrote to drive is with a logical linux swap in a w95 extended partition? Not quite sure where to go from here to get my partitions correct and files back where they belong. Any help would be greatly appreciated.

***Here is a copy of my Testdisk logfile:

Sun Oct 30 21:50:34 2011
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <[email protected]>
Main Page - CGSecurity
OS: Linux, kernel 2.6.38-8-generic (#42-Ubuntu SMP Mon Apr 11 03:31:50 UTC 2011)
Compiler: GCC 4.5 - Oct 17 2010 20:12:36
ext2fs lib: 1.41.14, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 488397168 sectors
/dev/sda: user_max 488397168 sectors
/dev/sda: native_max 488397168 sectors
/dev/sda: dco 488397168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 488397168 sectors
/dev/sdb: user_max 488397168 sectors
/dev/sdb: native_max 488397168 sectors
/dev/sdb: dco 488397168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ATA ST3250620NS
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ATA ST3250620NS
Disk /dev/sdc - 4007 MB / 3822 MiB - CHS 1018 124 62, sector size=512 - HP v125w

Partition table type (auto): Intel
Disk /dev/sdb - 250 GB / 232 GiB - ATA ST3250620NS
Partition table type: Intel

Analyse Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
1 P Linux 0 32 33 30271 2 3 486301696
2 E extended LBA 30271 34 1 30401 254 63 2102373
No partition is bootable
5 L Linux Swap 30271 34 36 30401 74 57 2090992
Computes LBA from CHS for Disk /dev/sdb - 250 GB / 232 GiB - CHS 30402 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30402 255 63

recover_EXT2: s_block_group_nr=0/1855, s_mnt_count=1/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Linux 0 32 33 30271 2 3 486301696
EXT4 Large file Sparse superblock, 248 GB / 231 GiB
Linux Swap 30271 34 36 30401 74 57 2090992
SWAP2 version 1, 1070 MB / 1020 MiB

Results
* Linux 0 32 33 30271 2 3 486301696
EXT4 Large file Sparse superblock, 248 GB / 231 GiB
P Linux Swap 30271 34 36 30401 74 57 2090992
SWAP2 version 1, 1070 MB / 1020 MiB

interface_write()
1 * Linux 0 32 33 30271 2 3 486301696
2 P Linux Swap 30271 34 36 30401 74 57 2090992
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
1 P Linux 0 32 33 30271 2 3 486301696
EXT4 Large file Sparse superblock, 248 GB / 231 GiB
2 E extended LBA 30271 34 1 30401 254 63 2102373
5 L Linux Swap 30271 34 36 30401 74 57 2090992
SWAP2 version 1, 1070 MB / 1020 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/1855, s_mnt_count=1/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 1310720 (block=163840, blocksize=4096)

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 1835008 (block=229376, blocksize=4096)

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 2359296 (block=294912, blocksize=4096)

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 6553600 (block=819200, blocksize=4096)

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 7077888 (block=884736, blocksize=4096)

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 12845056 (block=1605632, blocksize=4096)

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/1855, s_mnt_count=0/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 60787712
recover_EXT2: part_size 486301696
Ext2 superblock found at sector 21233664 (block=2654208, blocksize=4096)
Linux 0 32 33 30271 2 3 486301696
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []
superblock 163840, blocksize=4096 []
superblock 229376, blocksize=4096 []
superblock 294912, blocksize=4096 []
superblock 819200, blocksize=4096 []
superblock 884736, blocksize=4096 []
superblock 1605632, blocksize=4096 []
superblock 2654208, blocksize=4096 []

TestDisk exited normally.

***here is fdisk report:

desktop:~# fdisk -l /dev/sdb

Disk /dev/sdb: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000860eb

Device Boot Start End Blocks Id System
/dev/sdb1 1 30272 243150848 83 Linux
/dev/sdb2 30272 30402 1051186+ f W95 Ext'd (LBA)
/dev/sdb5 30272 30402 1045496 82 Linux swap / Solaris

***here's fsck reports:

desktop:~# fsck /dev/sdb1
fsck from util-linux-ng 2.17.2
e2fsck 1.41.14 (22-Dec-2010)
/dev/sdb1: clean, 31181/15204352 files, 1126064/60787712 blocks

desktop:~# fsck /dev/sdb2
fsck from util-linux-ng 2.17.2
e2fsck 1.41.14 (22-Dec-2010)
fsck.ext2: Attempt to read block from filesystem resulted in short read while trying to open /dev/sdb2
Could this be a zero-length partition?

desktop:~# fsck /dev/sdb5
fsck from util-linux-ng 2.17.2
fsck: fsck.swap: not found
fsck: Error 2 while executing fsck.swap for /dev/sdb5

***and blkid report:

desktop:~# blkid
/dev/sda1: UUID="8bfc52ae-e0de-48d5-b5bb-d475ecf527e2" TYPE="ext4" 
/dev/sda5: UUID="70bb35d3-9796-4c29-8d1e-b92ec1d79553" TYPE="swap" 
/dev/sdb1: UUID="fb48fb87-592f-4625-8bcf-d2aeb2c8b67e" TYPE="ext4" 
/dev/sdb5: UUID="18b5048c-eee6-4fd7-ab26-34c33545044e" TYPE="swap"

sorry if I posted too much info but I figured it better than not enough! hope someone can see what my issue is & how to repair it, thank you.


----------



## jiml8 (Jul 3, 2005)

I guess I'm not sure what your question is. Looks to me like testdisk has found everything, including the various spare superblocks. You do indeed have a logical linux swap partition in an extended partition. If you didn't set it up that way, your installer did. IIRC, Ubuntu will do that thing; set up one physical partition and automatically configure the remainder of the drive as an extended partition.

If you have files in lost+found, that merely means your directory structure got corrupted and e2fsck did the best it could. It didn't know where they came from or what they were named so it put them in lost+found.

I think you should tell testdisk to write the partition table it wants to write.


----------



## snoze33 (Oct 31, 2011)

thank for the response jimi8, ok I will write the partition table testdisk shows after a quick search. I dont understand why the disk does not show up in my file browser window when I look.. mabe then it will. im nervous about writing to the drive and moving all my files & os back to the / directory for I dont quite know how to verify a proper partition size was created. I hope I can repair my ubuntu install from there. took days to get it set up & running good.


----------



## jiml8 (Jul 3, 2005)

Proper procedure would be to image the disk as it is, before making repairs. This way, if anything goes wrong with the repair, you still have the image and are no worse off.

Of course, the REAL proper procedure is to back up the entire system so that you can just restore from backup. Even if you wind up wiping and reformatting, you can just roll the backup into place.


----------

