Re: [gentoo-user] data recovery advice needed

[Jack <ostroffjh@users.sourceforge.net>]

On 2018.12.17 17:32, Heiko Baums wrote:
> Am Sat, 15 Dec 2018 18:33:35 -0500
> schrieb Jack <ostroffjh@users.sourceforge.net>:
> 
>> Some months ago, I borked a laptop HDD by trying to move a partition  
>> in a way that left both the old and new partitions invalid.  (For my  
>> sanity, I've forced the details out of my memory, but the old and  
>> new locations overlapped, and I think the move might have been  
>> interrupted.  My own fault, I know.)
> 
> Have you written anything on this HDD after moving those partitions?  
> And did you move the partitions or did you repartition the HDD?
At this point, unfortunately, my memory is hazy.  I did not  
repartition, but the damage made accessing anything difficult (see  
details below).  The additional problem is that now I'm getting  
physical read errors on the drive, so to be safe, I'd need to get  
another drive large enough to use ddrescue, and then go digging.
> 
> You could try to find the beginning of the old partitions with  
> hexedit and set a pointer to this position with losetup. Set the  
> offset to this position. Linux actually doesn't need partitions to  
> access the HDD and/or mount file systems. Partitions just make it a  
> lot easier.
At this point, I think I've forgotten the details, but using the  
example of a 300G drive with 100G empty and then a 200G partition, when  
I moved the partition to the beginning of the disk (using gparted, as I  
remember) once it moved more than the first 100G of the partition, it  
overwrote the beginning of the original partition, and once it  
overwrote any of the directory structure it still needed to know where  
stuff was, game over.   The first 100G of the "new" partition is  
essentially intact, but the damage to the beginning of the "old"  
partition makes it difficult to start.  I suppose I could go looking  
for any intact directory inodes and see whether it's intact enough to  
find anything of interest.  (There are really only a few files I would  
still like to recover - but as they are in fact .VDI files, it's likely  
all or nothing, because I don't think just part of one of them will be  
at all useful.)  In fact, it would be more acurate to say there was  
another 100G before all of that, and that partition is still intact,  
except for the read errors.
> 
> And keep in mind that partitions are written to the partition table  
> at the beginning of the drive. Repartitioning usually doesn't  
> overwrite any data. So if you haven't written anything onto the new  
> partitions (incl. formatting the new partitions) all the data is most  
> likely still there.
The "new" partition is incomplete, but essentially intact, as much of  
it is there.  The beginning of the "old" partition is overwitten with  
stuff from somewhere in the middle of the partition being moved.
> 
> So you could also try to recover your old partition table. Maybe the  
> backup of your old super block is still intact. Unfortunately I can't  
> remember how to find it out. Maybe with fdisk resp. gdisk or with  
> testdisk.
I know the location of all the partition starts and ends, so that's not  
the issue.  I just need lots more empty space to put the copies so I  
can safely go digging.
> 
> But there is a chance that the behavior of moving partitions is a bit  
> different than repartitioning the HDD, so that the data is actually  
> already overwritten by moving those partitions.
Exactly.
> 
> On the other hand, if you had really moved the partitions the  
> partitioning tool you used should have seen that both partitions  
> would overlap and shouldn't have done this.
I think I mentioned that.  I'm going to have to do some testing, and  
probably learn that gparted is smarter than I thought, which means I've  
clearly forgotten something else stupid that I did.  Otherwise, I'll  
file a bug against gparted.
> 
> That said, no matter which problem you have with an HDD, always stay  
> calm and think first before you do anything. In most cases you can  
> recover your data. But the first step is to stop working  
> (particularly writing) with this HDD. The second step is - as the  
> others already mentioned - to make a copy with dd or ddrescue.
All that would be good and "easy" (for some definition) if the disk  
itself were not in process of failing.
> 
> I had a lot of HDD crashes, logical and physical ones. And once I  
> even didn't have a backup. I never lost any data so far, not even a  
> bit.
I'd call that "famous last words" :-)
> 
> Heiko
Jack