Last night I was not as awake as I thougt i was and I ended up formatting the wrong drive using GParted..... I thought of testdisk to recover the lost partition but I don't really understand how to use it. First of all Testdisk detect the partition table of my drive as "none" where as it should be detected as Intel (in my opinion) If I select an Intel partition type and then analyse --> deeper search it showing in the first second of the scan the correct (backup superblock ?) of my "Lacie1To" partition witch used to be the only Ext4 partition occupying all the disk. But if I clicked on stop it doesn't show me the partition in the list. So my question, what should I do with this info ?

I use Fedora KDE and I have separate drives for Linux home and root. Recently when both of these were on low storage, I decided to resize my other drive and extend both by 5GB. After I cut off 10GB from my extra drive, to extend the drives I booted up a live CD and in KDE Partition Manager I moved up home partition since unallocated storage was upon it and added 5GB to it and extended the root drive by the remaining 5GB space. Applying went successfully except plasmashell crashed for some reason during the process, but it didn't affect the process I believe. After I restarted and booted from my SSD, I couldn't login to my account. I was confused and at first thought that maybe the fstab with home drive mount instructions was broken. I logged in to TTY and started checking drives and saw that my home drive was mounted correctly, but almost empty. I went back to live CD and started checking different ways to recover data. I tried testdisk, photorec, dmde, R-Studio and a few other options. I was able to recover some of my data, but in absolutely unstructured way. I was wondering is there a way to try to recover data with folders and other metadata. Including a picture of my current drive situation (damaged - empty drive is highlighted): Fdisk:

I've been running a RAID1 setup using two Samsung 970 EVO 500GB NVMEs on an Asus Z390 Maximus XI Formula motherboard for the last two years. This is my home server running Ubuntu 22.04 and I chose RAID1 for this specific reason in case one of the drives would fail. I wanted to upgrade the machine from 32GB to 128GB RAM for more ZFS Cache, but as the system didn't POST by itself I opted for a CMOS reset using the button on the motherboards I/O. After the reset I was anticipating having to change SATA Mode from AHCI to RAID (Intel Rapid Storage Technology) in the BIOS before being able to boot from my storage again as normal. Unfortunately this was not the case. I tried CSM (Compatibility Support Module) Settings recommended online, enable it and set Boot Device Control to UEFI and Legacy OPROM and UEFI priority for booting from storage devices. No change. I also tried manually rebuilding the RAID Volume without initializing/formatting the disks by creating a new RAID1 volume, but no change. So I moved on to data recovery by moving one of the disks to a separate PC I have with a minimal Ubuntu install.

and

fdisk -l

both show the disk being recognized, while the type reported by fdisk is cleary Linux RAID:

/dev/nvme0n1: 465.76 GiB, 500107862016 bytes, 976773168 sectors
Disk model: Samsung SSD 970 EVO 500GB               
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 23ABA6D9-5923-4891-B67E-2208F422E40C

Device         Start       End   Sectors   Size Type
/dev/nvme0n1p1  4096 976506887 976502792 465.6G Linux RAID

## Steps taken in Ubuntu: ## 1. Copied the entire disk content to my local device:

dd if=/dev/nvme0n1 of=~/nvme_backup.img bs=4M status=progress

2. Installed and ran testdisk

testdisk /dev/nvme0n1

3. Chose

[EFI GPT]

partition table type, analyzed and found

Raid        4096 976506887 976502792 [ubuntu-server:0]

*The name of my raid volume!* So I accepted and WROTE. 4. After reboot, I attempted to mount the volume

: /mnt/recovery: unknown filesystem type 'linux_raid_member'

and realized I need to assemble the degraded RAID using

. 5. I followed this blogpost to examine the metadata, finding the following:

sudo mdadm --examine /dev/nvme0n1p1 
/dev/nvme0n1p1:
          Magic : a92b4efc
        Version : 1.2
    Feature Map : 0x1
     Array UUID : f4c5d883:1a67c158:7d34d079:c5e09397
           Name : ubuntu-server:0
  Creation Time : Mon Jul 10 16:26:43 2023
     Raid Level : raid1
   Raid Devices : 2

 Avail Dev Size : 976502784 sectors (465.63 GiB 499.97 GB)
     Array Size : 488251392 KiB (465.63 GiB 499.97 GB)
    Data Offset : 264192 sectors
   Super Offset : 8 sectors
   Unused Space : before=264112 sectors, after=-264183 sectors DEVICE TOO SMALL
          State : clean TRUNCATED DEVICE
    Device UUID : de5af620:88784a78:693bf52a:bab766a4

Internal Bitmap : 8 sectors from superblock
    Update Time : Sun Apr 27 23:57:35 2025
  Bad Block Log : 512 entries available at offset 16 sectors
       Checksum : 88404970 - correct
         Events : 9909


   Device Role : Active device 1
   Array State : AA ('A' == active, '.' == missing, 'R' == replacing)

6. Attempted to start the raid again using mdadm (my knowledge is very limited here so I tried both):

~$ sudo mdadm --assemble --run /dev/md0 /dev/nvme0n1p1 --force
mdadm: Device /dev/nvme0n1p1 is not large enough for data described in superblock
mdadm: no RAID superblock on /dev/nvme0n1p1
mdadm: /dev/nvme0n1p1 has no superblock - assembly aborted
~$ sudo mdadm --assemble --run /dev/md0 /dev/nvme0n1 --force
mdadm: Cannot assemble mbr metadata on /dev/nvme0n1
mdadm: /dev/nvme0n1 has no superblock - assembly aborted

My hopes was that this last step would allow me to mount the disk directly and find my now inaccessible data (OS files and configs, all important data is still on the ZFS pool luckily). I initially thought it would be as simple as moving a single disk to another system, enabling IRST and booting from the drive as the disks are "mirrored". Worth noting is that data is clearly still readable if I use:

photorec /dev/nvme0n1

But I would of course prefer if there were some way for me to get access to the proper file system again. Any help or guidance is greatly appreciated.

Tried to restore a deleted partition with testdisk. Fortunately when selected the right device the quick analyze function listed the deleted partition. However when I selected the partition by moving cursor down and hit Enter to continue, I got the following error: No partition found or selected for recovery And that was it - so any help how to recover a partition which is listed?

I was playing around with testdisk, gdisk and fdisk, and I set the cylinder head sector count to zero by mistake, and the system now reports "no medium". I tried opening the drive with gdisk, fdisk, cfdisk, sfdisk, cgdisk, sgdisk, fixparts, testdisk, parted, gparted, partx, mkfs. mke2fs, fsck e2fsck, and badblocks and all of those returned "no medium" or simular response as well. hdparm and sdparm seemed to offer hope, but none of the changes I tried worke:

# hdparm /dev/sda 
was 
4000000/64/32, sectors=8192000008, start=0
is
1024/0/62, sectors=0, start=0

# sdparm /dev/sda warning: mode page seems malformed
The page number field should be 0x01,0x02,etc... 
but is 0x00
Hereafter field position exceeds mode page length=2

My OS

# uname -a
Linux debian 5.10.0-22-amd64 #1 SMP Debian 5.10.178-3 (2023-04-22) x86_64 GNU/Linux

My VM environment

# systemd-detect-virt
none

How can I fix this? As far as how i set my chs to 0/0/0 I don't know. at the time i was playing around with testdisk gdisk fdisk I was rearranging the geometry for absolutely no reason. I was going back and forth from windows to Linux. Various identifiers changed such as the pid now reads pid:2010. I can’t remember what it was but it wasn’t that. size changed while not tinkering, “windows”. at some point heads read zero. the disk use to have a “real” name but it kept changing. went from Disk model: ??? to Disk model: USB Disk ... now it's Disk model: Generic Flash Disk 2.0

I have a 500GB HDD that will only boot into grub rescue. It appears the partition table has become corrupt as fdisk is reporting one partition being 3.6T. I have run testdisk (results below) but not sure how to proceed, all i need to be able to do is mount the partition to get some files off it.

Failed to read extended partition table (offset=964032512): Invalid argument
Disk /dev/sde: 465.8 GiB, 500107862016 bytes, 122096646 sectors
Units: sectors of 1 * 4096 = 4096 bytes
Sector size (logical/physical): 4096 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x00052d57

Device     Boot     Start       End   Sectors  Size Id Type
/dev/sde1  *         2048 964032511 964030464  3.6T 83 Linux
/dev/sde2       964032512 976773167  12740656 48.6G  5 Extended

parted /dev/sde print
Error: Cannot have a partition outside the disk!
Ignore/Cancel?
Ignore/Cancel?
Ignore/Cancel? i
Error: Cannot have a partition outside the disk!
Ignore/Cancel?
Ignore/Cancel?
Ignore/Cancel? i
Error: Cannot have a partition outside the disk!
Ignore/Cancel? i
Error: Invalid argument during seek for read on /dev/sde
Retry/Ignore/Cancel? i
Error: Invalid partition table on /dev/sde -- wrong signature 6475.
Ignore/Cancel? i
Error: Cannot have a partition outside the disk!
Ignore/Cancel? i
Model: WDC WD50 03AZEX-00MK2A0 (scsi)
Disk /dev/sde: 500GB
Sector size (logical/physical): 4096B/4096B
Partition Table: msdos
Disk Flags:

Number  Start   End     Size    Type      File system  Flags
 1      8389kB  3949GB  3949GB  primary                boot
 2      3949GB  4001GB  52.2GB  extended

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER 
http://www.cgsecurity.org 

Disk /dev/sde - 500 GB / 465 GiB - CHS 7600 255 63

The harddisk (500 GB / 465 GiB) seems too small! (  Linux                 1144  87 32  8645  91 22  120503808
   Linux                 1144 148 29  8645 152 19  120503808
   Linux                 1144 172 53  8645 176 43  120503808
   Linux                 1144 217 34  8645 221 24  120503808
   Linux                 1144 221 38  8645 225 28  120503808
   Linux                 1145 145 25  8646 149 15  120503808
   Linux                 1145 202 18  8646 206  8  120503808
   Linux                 1145 234 50  8646 238 40  120503808
   HPFS - NTFS          203486  30 44 230431  25 50  432871117
   HPFS - NTFS          203518 253 43 230463 248 49  432871117

[ Continue ]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 493 GB / 459 GiB

My sister asked me to fix her laptop that couldn't recognise some of the peripheries including the network cards. She hasn't used it for almost a year. First (almost half a year ago) I asked her to make a backup of all her files, but she obviously forgot that and now was in a hurry. So I started the laptop, it booted just fine. Date and time was totally nonsense, couldn't connect to any network, couldn't update drivers manually, so I decided to just reinstall the os. It had Windows 10 pre-installed. The reinstallation started just fine, but around 38% it suddenly got the blue screen of death. After that it wouldn't start, claiming there was no valid boot info on any of the hard drives. At home I first tried using an external Win10 image, but it couldn't recognise the HDD at all. I then tried using Ubuntu ran from a USB stick. Gparted keeps saying that it encounters an output/input error while trying to do anything on that HDD. I since installed Ubuntu onto an external drive, because I had enough having to re-install and re-configure everything all the time; that is sdb with all the partitions. I was paying extra attention not to do anything with the HDD during the process. lsblk lists the HDD with no partitions, but it's at least there (sda). $ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 63,5M 1 loop /snap/core20/2015 loop1 7:1 0 63,4M 1 loop /snap/core20/1974 loop2 7:2 0 4K 1 loop /snap/bare/5 loop3 7:3 0 73,9M 1 loop /snap/core22/858 loop4 7:4 0 73,9M 1 loop /snap/core22/864 loop5 7:5 0 237,2M 1 loop /snap/firefox/2987 loop6 7:6 0 349,7M 1 loop /snap/gnome-3-38-2004/143 loop7 7:7 0 485,5M 1 loop /snap/gnome-42-2204/120 loop8 7:8 0 497M 1 loop /snap/gnome-42-2204/141 loop9 7:9 0 91,7M 1 loop /snap/gtk-common-themes/1535 loop10 7:10 0 12,3M 1 loop /snap/snap-store/959 loop11 7:11 0 53,3M 1 loop /snap/snapd/19457 loop12 7:12 0 40,9M 1 loop /snap/snapd/20290 loop13 7:13 0 452K 1 loop /snap/snapd-desktop-integration/83 sda 8:0 0 223,6G 0 disk sdb 8:16 0 298,1G 0 disk ├─sdb1 │ 8:17 0 512M 0 part /boot/efi ├─sdb2 │ 8:18 0 205G 0 part /media/oriba/69895ea3-aa89-4618-ab95-a7bd361f9df6 └─sdb3 8:19 0 92,6G 0 part /var/snap/firefox/common/host-hunspell / sr0 11:0 1 1024M 0 rom fdisk now returned this: $ sudo fdisk -l /dev/sd? Disk /dev/sda: 223,57 GiB, 240057409536 bytes, 468862128 sectors Disk model: SATAFIRM S11 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes That's all; no identifier, no label, no partitions. However, after trying testdisk and photorec (both finding zero files using the smallest sector size) it usually disappears from there as well: first it appears as a disk with 0 size, then it completely disappears until I shut down the laptop and start it again. Here's testdisk: Select a media (use Arrow keys, then press Enter): >Disk /dev/sda - 240 GB / 223 GiB - SATAFIRM S11 Before selecting Quick Search: Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63 Current partition structure: Partition Start End Size in sectors Partition sector doesn't have the endmark 0xAA55 After searching, testdisk returns nothing, so I go to deep search, which also returns an empty list, I only see the headers: Partition, Start, End and Size in sectors. However, if I now type lsblk, it lists sda as size 0: sda 8:0 0 0B 0 disk fdisk doesn't list it anymore, until I reboot. I never tried to write anything onto that HDD, nor did I try to format it. Is there anything else I can do or is the hardware malfunctioning? Also, did I mess it up anywhere (apart from not making a backup)?

I have a LUKS encrypted logical volume which is spread across two physical drives. I use the Qubes OS. The first drive is fine. I did a whoopsie with the partition table of the second drive. But the data on that drive seems to be OK. testdisk can find the windows partition and a little LUKS partition which I had. I managed to look into both and they are good. I *think*, and ChatGPT backs me up (clutching at straws), that there is a single LUKS header for the whole logical volume. I still have that LUKS header, which is on the first drive. On the second drive, in the place where the second part of the encrypted logical volume should start, I have data which looks like encrypted data. I know the UUID of the second part of the logical volume. I know the location of the data. I know the size. (I'm getting all this from dracut in the boot partition of the first drive. How can I recreate my needed partition? I can use testdisk to re-create the other partition (which is Windows, and which shows up in testdisk). But I didn't do it yet. I just backed up the data and the raw data with dd. Can I just use parted to create the partition on the spot where I have the data eg: sudo parted /dev/sdc mkpart logical 40000000s 42000000s Then set the UUID to be the one I need re-created tune2fs -U "4bac4411-201a-2a4d-ab0e-2e4a306a5bb2" /dev/sdb1 What is the problem with that? Hopefully this is only writing the partition table, not overwriting my data. Do I need to think about something more, like do I need to delete the partitions that are there already (which are crap set up by the process that went astray and got me here)

I have an external drive that I accidentally deleted a lot of files off of. I can still see all the files in testdisk and have the option to undelete everything, but will recovering the files onto the same drive possibly cause an issue? I don't know how testdisk (or really drive writing at all) works so I'm not sure if the recovery process could possibly end up writing over the other undeleted files on the drive (meaning I'd only get some files back) or if I'm safe to recover to the same drive I deleted the files off of.

I managed to ruin a server drive by trying to clone it to another drive with dd. In the process, the original boot and sda1 partitions were overwritten. I immediatly stopped using the drive,I made an image of the damaged drive with ddrescue then attempted to recover the lost partition with testdisk. Running a deepscan I found what seemed to resemble my lost sda1 partition so I restored. After running an fsck on it and sudo e2fsck -b block_number /dev/xxx to restore a uncorrupted superblock, I was able to mount the partition and found a lost+found directory containing almost all my files. It seems my files are there so how would I be able to recover/rebuild the filesystem of the original partition?

As far as I know, a solid-state drive (SSD) stores data in different locations that the operating system cannot control. If I accidentally delete a partition, and then enter the exact start and end blocks of the previous partition when creating a new partition with fdisk, can I recover the files as I would on a regular hard drive (HDD)?

I made a back up of DHCP but when i unstinalled it the back up was removed. How can i recover dhcpd.leases Example /var/lib/dhcpd/dhcpd.leases its on /dev/mapper/vg_server-lv_root i did do a locate dhcpd.leases no results were found OS Centos 6 Thank you in advance. I tried testdisk on the logical drive but it would not work with /dev/mapper/vg_server-lv_root

How to change my partition type id from 83 to 8e without formatting and losing data?

I tried to recover lost files from an exFAT thumb drive with the

package on linux. It was very good at finding deleted files. However as I went through the entries, I saw weird entries. The program claimed there were dozens of both present and deleted files with unreadable file names and humoungous file size as well as outlandish timestamps. For example one entry read

bytes,

-Apr-1911

and filename

,~WM-*'? M-kxfM-'D^^Q謁懫䞭鵣ㄆ冚୩鳼묁쐚쵡૪댷腁濬

. The names of invalid entries were garbled text, foreign languages and emojis. What was interesting was that some of the timestamps were before the unix epoch. The weird entries were not on the root of the drive. They were only on some folders. Also files with only alphanumeric characters displayed fine. My questions are: 1. What is the cause of this phenomenon? Is testdisk mistakenly picking up random leftover bytes as 'deleted files'? Or are some files created on Windows just not suitable for Linux? 2. Do Linux and Windows actually use different encodings/rulesets for their filenames? If so, what happens if a file whose name is valid on one OS which is not on the other is sent to the hostile OS? Do they all turn into gibberish like this? p.s. All files' content was encoded in UTF-8.

I accidentally deleted GPT partition table. Now I can't mount or see any data on my HDD. I tried every possible solution on internet instead it got worse. There is no back up. On disks this is what it shows When I run TestDisk it shows complete partitions and I am able to list all files. I don't want to mess up any further. Is there anyway that I could mount my drive and its partitions? **EDIT** I can't remember what exactly I did to delete partitions as it was months ago. I lost grub and tried to recover using boot-repair and gdisk. So far I have tried testdisk gpart. when I tried sudo gpart /dev/sdb, this is what I get

I need your help! I wanted to take hash from partition table in order to crack the old password/passphrase which somehow changed for LUKS1 partition. I wrongly used dd command. I forgot that backups exist for a reason, of course. I created empty txt file emptyFileHash.img and I overwrote the beginning of partition table with empty data by WRONG COMMAND ORDER WRONG COMMAND ------- dd if=emptyFileHash.img of=/dev/sda1 bs=512 count=4097 instead of dd if=/dev/sda1 of=emptyFileHash.img bs=512 count=4097 RESULTS FROM my memory (might be inaccurate) ------ 0+ records in 0+ records out 2097664 bytes (2.1 MB, 2.0 MiB) copied, 0.0674719 s, 31.1 MB/s QUESTION - ddrescue ------------ How to use **ddrescue** recovery option on that partition with specific blocks which I overwrote? What is the way to read back only this chunk of data in order to recover partition and not entire 500GB disk? DETAILS -------------- fdisk -l Disk /dev/sda: 465.8 GiB, 500107862016 bytes, 976773168 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: ***NA*** Device Start End Sectors Size Type /dev/sda1 2048 976773119 976771072 465.8G unknown CURRENT HEX DATA ----------------- dd if=/dev/sda1 bs=512 count=10 |hexdump -C 10+0 records in 10+0 records out 5120 bytes (5.1 kB, 5.0 KiB) copied, 0.000738207 s, 6.9 MB/s 00000000 0a 0a 4b 53 ba be 00 01 61 65 73 00 00 00 00 00 |..KS....aes.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 78 74 73 2d 70 6c 61 69 |........xts-plai| 00000030 6e 36 34 00 00 00 00 00 00 00 00 00 00 00 00 00 |n64.............| 00000040 00 00 00 00 00 00 00 00 73 68 61 32 35 36 00 00 |........sha256..| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 40 |...............@| 00000070 d4 83 26 cc ff b5 fd b2 84 7d 5d f9 d9 4d 14 32 |..&......}]..M.2| 00000080 df 47 0d c3 e5 48 3b 76 01 85 29 45 ca d9 85 fe |.G...H;v..)E....| 00000090 bc 51 d6 7c e0 5d c3 5d 2b 94 db fb b5 20 3b 0a |.Q.|.].]+.... ;.| 000000a0 39 e1 07 73 00 00 de 9b 61 38 66 63 35 31 64 33 |9..s....a8fc51d3| 000000b0 2d 33 63 37 64 2d 34 34 64 38 2d 61 38 30 65 2d |-3c7d-44d8-a80e-| 000000c0 61 38 33 63 64 31 61 35 37 62 62 33 00 00 00 00 |a83cd1a57bb3....| 000000d0 00 ac 71 f3 00 0d 17 e0 5f d6 d2 31 f1 5d e6 0b |..q....._..1.]..| 000000e0 4b 96 27 07 51 25 96 b1 94 62 61 aa d2 85 6e 99 |K.'.Q%...ba...n.| 000000f0 c6 d0 06 7c 54 8f 74 6f 00 00 00 08 00 00 0f a0 |...|T.to........| 00000100 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000120 00 00 00 00 00 00 00 00 00 00 02 00 00 00 0f a0 |................| 00000130 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 00 00 03 f8 00 00 0f a0 |................| 00000160 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 00 00 05 f0 00 00 0f a0 |................| 00000190 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001b0 00 00 00 00 00 00 00 00 00 00 07 e8 00 00 0f a0 |................| 000001c0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001e0 00 00 00 00 00 00 00 00 00 00 09 e0 00 00 0f a0 |................| 000001f0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000210 00 00 00 00 00 00 00 00 00 00 0b d8 00 00 0f a0 |................| 00000220 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000240 00 00 00 00 00 00 00 00 00 00 0d d0 00 00 0f a0 |................| 00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00001000 6e 58 3d bd 51 ab da e1 0e b4 5f e2 7d 6d 5e 9e |nX=.Q....._.}m^.| 00001010 03 53 37 e6 57 00 a8 34 5d 89 fb 6a 8e d4 2f 9f |.S7.W..4]..j../.| 00001020 66 73 61 99 c3 23 5f 02 c9 e0 f1 ab 31 44 83 a4 |fsa..#_.....1D..| 00001030 cf a0 3d 5a c8 80 8f 27 d9 cd 4d 1e 8e 99 7b 8c |..=Z...'..M...{.| 00001040 fc d7 75 c1 1d 91 18 5f ef ac 29 8b a1 a1 99 08 |..u...._..).....| 00001050 d8 d1 df 17 11 71 a6 24 71 43 e7 29 6d f0 da 36 |.....q.$qC.)m..6| 00001060 fb 02 c7 c9 67 46 b9 28 50 62 1c 93 81 2a 2d 68 |....gF.(Pb...*-h|

I have some partition table with three partitions. I deleted the third partition with fdisk and next I created new partition on the same place with the same "first and last sectors". How can I determine if the deleted partition ever existed (I don't want to recover it). Screenshots of what I did: * third partition before deletion: * third partition file system before deletion: * deleting the third partition (reboot system after): * new third partition after deletion old third partition: * new third partition file system after deletion old third partition file system: * With TestDisk we can see partition table: So again: how can I determine if the deleted partition ever existed? Maybe with TestDisk or somehow different?

A folder with backup files was accidentally deleted from the /home partition on a Ubuntu 20.04 machine. All files in the folder were backups (zip) of the same thing (a Minecraft world) but from different dates. As it would be enough to get back only one of the 30 newest files a saw a good chance to recover at least one of them. I removed /home (which is a separate mount) from fstab, enabled root login, rebooted the machine and logged in as root. I first tried to recover the file using

, and it seemed to find the file but was not able to recover it. I tried several of the lost files and got the same output:

root@arne:~# extundelete /dev/sdb1 --restore-file 'TBS_world-2021-10-09.zip'
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 4456 groups loaded.
Loading journal descriptors ... 0 descriptors loaded.
extundelete: Extent block checksum does not match extent block while finding inode for TBS_world-2021-10-09.zip
extundelete: Extent block checksum does not match extent block while finding inode for TBS_world-2021-10-09.zip
Failed to restore file TBS_world-2021-10-09.zip
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name                                       | Inode number | Deleted status
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem

Next I tried

, which clearly detected the 423 deleted files:

root@arne:~# ext4magic /dev/sdb1 -H -a 1640202942 -b 1640203868
Filesystem in use: /dev/sdb1

|-----------d_time  Histogram-----------------  after  --------------------  Wed Dec 22 20:55:42 2021
1640203034 :        0 |                                                  |   Wed Dec 22 20:57:14 2021
1640203126 :        0 |                                                  |   Wed Dec 22 20:58:46 2021
1640203218 :        0 |                                                  |   Wed Dec 22 21:00:18 2021
1640203310 :        0 |                                                  |   Wed Dec 22 21:01:50 2021
1640203402 :        0 |                                                  |   Wed Dec 22 21:03:22 2021
1640203494 :        0 |                                                  |   Wed Dec 22 21:04:54 2021
1640203586 :        0 |                                                  |   Wed Dec 22 21:06:26 2021
1640203678 :      423 |**************************************************|   Wed Dec 22 21:07:58 2021
1640203770 :        0 |                                                  |   Wed Dec 22 21:09:30 2021
1640203862 :        0 |                                                  |   Wed Dec 22 21:11:02 2021

ext4magic : EXIT_SUCCESS

Trying to look for any of the files gives promising output, but actually recovering the file says it can't be found:

root@arne:~# ext4magic /dev/sdb1 -f albin/Backups/TBS_world-2021-10-10.zip -l
Filesystem in use: /dev/sdb1

Using  internal Journal at Inode 8
Inode found "albin/Backups/TBS_world-2021-10-10.zip"   18350376
Inode 18350376 is a directory but not found after 1640359705 and before 1640446105
ext4magic : EXIT_SUCCESS

root@arne:~# ext4magic /dev/sdb1 -f albin/Backups/TBS_world-2021-10-10.zip
Filesystem in use: /dev/sdb1

Error: Filename "albin/Backups/TBS_world-2021-10-10.zip" not found in Filesystem
if "albin/Backups/TBS_world-2021-10-10.zip" deleted, use InodeNr or try Journaling options

Running

shows the deleted directory, but the contents can't be accessed. It says the file system may be damaged.

TestDisk 7.1, Data Recovery Utility, July 2019                                                                                                                
Christophe GRENIER                                                                                                                    
https://www.cgsecurity.org                                                                                                                                     
 1 P Linux filesys. data         2048 1167943679 1167941632                                                                                                   
Directory /albin/Backups                                                                                                                                      
                                                                                                                                                              
No file found, filesystem may be damaged.

Any idea why these errors occur? It looks so promising with all tools, but it fails in the end. It seems plausible that at least one of the lost files should still be there without corruption. I don't understand why I get the errors I get.

I booted to a live Ubuntu USB, wanting to delete partitions on an SD card, and ended up deleting all my partitions on my MacBook Pro's internal HD. I have already tried gpart (which gets stuck at "Begin scan...") and testdisk (which can't create partitions since "Function write_part_mac not implemented"!). I did try cmd+ R at boot, but gave it up as it was taking a long time. I thought there would be an easier and faster alternative. Is there a way to recover data with partitions on my hd? Here's my testdisk output for the Mac HD:

Partition               Start        End    Size in sectors
> P DOS_FAT_32                    40     409639     409600 [EFI]

> P HFS                       409640  489972567  489562928

I accidentally overwrote an NTFS partition with an iso image with the dd command. I am trying to recover NTFS partition with testdisk, but after disk selection (1.8TB), partition table type selection (intel) and analysis, I get the following current partition structure: At this point I don't know what to do to go on and recover the NTFS partition that I don't see. Should I choose the HFS line? Please help me.