edison23

Zápisky šíleného jazykového editora

Recover deleted ext4 partition

Managing disk partitions is always risky. If you've made a mistake and deleted a wrong partition, you've got a very good chance to recover it. If you realize your mistake soon enough, that is.

Datum: 2024-11-16
Kategorie: EN Guides Linux Unix
Štítky: linux ext4

Obsah


When you handle disk partitions, you always want to be 100% sure you're working with the right partition. Abort if there's the tiniest grain of doubt or a possibility that the app you're working with doesn't show you the partitions the way you think it is.

This guide is not about recovering deleted files. It's about recovering deleted disk partitions. The guide I copycat here has some info on file recovery too, though: Recover deleted files on Linux (Beginners Tutorial)

Avoid the mistake in the first place

The most reliable way to confirm you have the right partition is, in my experience, its size. You have to know your drives, of course. But for usual personal computer setup, you likely have each drive partitioned differently. It's also a good practice to intentionally make the partitions at least slightly different sized across multi-partition drives. The redundancy check for that are partition labels which are usually shown. Even by Windows 11 installer, to some extent.

Well, I didn't pay enough attention and mistook a 950GB drive for a 500GB drive I wanted to clean and repartition. The Windows disk manager makes this easier by having stupidly designed UI, but the fault is ultimately mine, of course.

Abort all operation on the drive if you make a mistake

Fortunately, I realized I deleted the primary partition on a wrong drive before proceeding to creating a new one on the same drive. When you make a mistake, abort. Don't do anything with the drive, boot up a Linux system and proceed to recovery.

Also, don't give money to various SW companies promising they're great at data recovery. They may be, but unless you overwrite the data, you don't need their software and waste money. (And if you overwrite the data on SSD, likely no one will recover it… try CIA, maybe.)

Use TestDisk to recover the partition

This guide is a copy of of the great Recover deleted files on Linux (Beginners Tutorial) guide written by Mokhtar Ebrahim. All credit goes to the original author. I place this guide here on my site basically as a backup if the original site vanishes. The screenshots are copied from the original article; they're accurate. Credit goes to the original author.

TestDisk is a scan and repair disk partitions utility written by Christophe Grenier and it works with various file systems such as EXT3, EXT4, FAT32, or NTFS. You can apply this guide to internal and external drives.

You need a running Linux OS and the damaged drive connected.

If you don't have testdisk installed, use your package manager to install it, e.g. sudo apt install testdisk.

  1. Start TestDisk:
$ testdisk
  1. You have the option to create a new file for the logs. Select the create option and press Enter (recommended). If you don’t want a log file, select the No Log option.

Create log file option

  1. Disks on the PC are listed. Select the one that you want to fix.

Select disk

Again, be 100% sure you have the right drive. You can make sure by running lsblk:

$ lsblk 
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
loop0         7:0    0     4K  1 loop /snap/bare/5
loop14        7:14   0 150.3M  1 loop /snap/thunderbird/546
sda           8:0    0   493G  0 disk 
sdb           8:16   0   3.6T  0 disk 
└─sdb1        8:17   0   3.6T  0 part /mydisk
nvme0n1     259:0    0   1.8T  0 disk 
├─nvme0n1p1 259:1    0   303M  0 part /boot/efi
├─nvme0n1p2 259:2    0  55.8G  0 part /

The drive you want in the example above is /dev/sda because it doesn't have any partition. Confirm the size before you proceed.

  1. Select partition table type. TestDisk recognizes various types of partition tables. It is usually Intel unless you are using a specialized one. In my case, it was Intel.

Select partion table type

  1. Select how to search for partitions. First, go with quick search. If that fails, you can try the other options. I have no experience with them as the quick search worked fine.

Select partition search type

  1. If you are lucky, you will see the deleted partition. If not, you will have to use a deeper search.

Select a partition to recover

  1. Select the partition to recover, press Enter and confirm to write the partition table.

This is a potentially destructive operation! For the first time in this tutorial, you're actually writing something to the drive. But at this point, you're likely pretty sure you have the partition you want, so it's fine.

Confirm to write the partition table

If you're recovering an internal drive partition, you likely need to reboot. Before you do that, you may want to adjust the /etc/fstab entries to auto-mount the partition under a particular mount point.