On 2018.12.17 17:32, Heiko Baums wrote:
Am Sat, 15 Dec 2018 18:33:35 -0500
schrieb Jack <ostrof...@users.sourceforge.net>:
Some months ago, I borked a laptop HDD by trying to move a partition
in a way that left both the old and new partitions invalid. (For my
sanity, I've forced the details out of my memory, but the old and
new locations overlapped, and I think the move might have been
interrupted. My own fault, I know.)
Have you written anything on this HDD after moving those partitions?
And did you move the partitions or did you repartition the HDD?
At this point, unfortunately, my memory is hazy. I did not
repartition, but the damage made accessing anything difficult (see
details below). The additional problem is that now I'm getting
physical read errors on the drive, so to be safe, I'd need to get
another drive large enough to use ddrescue, and then go digging.
You could try to find the beginning of the old partitions with
hexedit and set a pointer to this position with losetup. Set the
offset to this position. Linux actually doesn't need partitions to
access the HDD and/or mount file systems. Partitions just make it a
lot easier.
At this point, I think I've forgotten the details, but using the
example of a 300G drive with 100G empty and then a 200G partition, when
I moved the partition to the beginning of the disk (using gparted, as I
remember) once it moved more than the first 100G of the partition, it
overwrote the beginning of the original partition, and once it
overwrote any of the directory structure it still needed to know where
stuff was, game over. The first 100G of the "new" partition is
essentially intact, but the damage to the beginning of the "old"
partition makes it difficult to start. I suppose I could go looking
for any intact directory inodes and see whether it's intact enough to
find anything of interest. (There are really only a few files I would
still like to recover - but as they are in fact .VDI files, it's likely
all or nothing, because I don't think just part of one of them will be
at all useful.) In fact, it would be more acurate to say there was
another 100G before all of that, and that partition is still intact,
except for the read errors.
And keep in mind that partitions are written to the partition table
at the beginning of the drive. Repartitioning usually doesn't
overwrite any data. So if you haven't written anything onto the new
partitions (incl. formatting the new partitions) all the data is most
likely still there.
The "new" partition is incomplete, but essentially intact, as much of
it is there. The beginning of the "old" partition is overwitten with
stuff from somewhere in the middle of the partition being moved.
So you could also try to recover your old partition table. Maybe the
backup of your old super block is still intact. Unfortunately I can't
remember how to find it out. Maybe with fdisk resp. gdisk or with
testdisk.
I know the location of all the partition starts and ends, so that's not
the issue. I just need lots more empty space to put the copies so I
can safely go digging.
But there is a chance that the behavior of moving partitions is a bit
different than repartitioning the HDD, so that the data is actually
already overwritten by moving those partitions.
Exactly.
On the other hand, if you had really moved the partitions the
partitioning tool you used should have seen that both partitions
would overlap and shouldn't have done this.
I think I mentioned that. I'm going to have to do some testing, and
probably learn that gparted is smarter than I thought, which means I've
clearly forgotten something else stupid that I did. Otherwise, I'll
file a bug against gparted.
That said, no matter which problem you have with an HDD, always stay
calm and think first before you do anything. In most cases you can
recover your data. But the first step is to stop working
(particularly writing) with this HDD. The second step is - as the
others already mentioned - to make a copy with dd or ddrescue.
All that would be good and "easy" (for some definition) if the disk
itself were not in process of failing.
I had a lot of HDD crashes, logical and physical ones. And once I
even didn't have a backup. I never lost any data so far, not even a
bit.
I'd call that "famous last words" :-)
Heiko
Jack
