Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was in the process of resizing an NTFS partition on my 2TB data drive (increasing its size, moving it all the way to the beginning of the disk) when gparted unexpectedly terminated at perhaps 66% complete.

sudo mount -t ntfs /dev/sdc1 /media/data/ :

  NTFS signature is missing.
  Failed to mount '/dev/sdc1': Invalid argument
  The device '/dev/sdc1' doesn't seem to have a valid NTFS.

Mounting with gparted:

  mount: wrong fs type, bad option, bad superblock on /dev/sdc1,
    missing codepage or helper program, or other error
    In some cases useful info is found in syslog - try
    dmesg | tail or so

fdisk -l shows:

Disk /dev/sdc: 2000.4 GB, 2000398934016 bytes, 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x33d99b3b

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1               1  3907029167  1953514583+  ee  GPT

Does gparted copy the data before writing the partition table? If that's the case, can I scan the disk for the beginning of the NTFS partition and attempt to recover the old partition table?

What are my options for getting my data back?

share|improve this question
2  
May be testdisk can help you to get back your data. –  avirk Dec 20 '12 at 2:14
    
Yeah, I've been inspecting the disk using testdisk this far, but I don't want to take any action that could put me deeper into trouble... –  martindale Dec 20 '12 at 2:17
    
I'm not so much familiar with Linux tools so can't help you too much with this. But I'm sure its the best utility that can help you. But if you want more about the testdisk then Google it for YouTube video's and also join the chat:root access room and talk to any available expert like Journeymangeek –  avirk Dec 20 '12 at 2:23
3  
You might want to try imaging the disk first if you have the space - that way you can test doing a recovery or running forensics tools on the image without risking the original drive –  Journeyman Geek Dec 20 '12 at 2:29
3  
Yeah, I think I'll use this as an excuse to buy a new drive. –  martindale Dec 20 '12 at 2:35
show 2 more comments

1 Answer 1

I would suggest getting that new disk first, then using dd to copy the disk in its entirety in its current state, from one to the other. Just be sure the new disk has the same number (or more) of LBAs as the current disk (LBAs are printed on the label)

Once that is done, then yes, scan the disk using testdisk and following this guide:

http://www.dedoimedo.com/computers/linux-data-recovery.html

If testdisk can find and tell you the sector number of the beginning of the lost partition, and the end of the contiguous data for that part of the partition, you should be able to move it over to the start of the disk with dd.

Example:

If the start of the partition is on sector 1294, and there is contiguous data from 1294 to 1399, then you could do:

dd if=/dev/sdb of=/dev/sdd skip=1293 count=105

sdb is the disk you tried to relocate the partition on, sdd is the second spare disk you bought for this recovery attempt. Hope that helps, and good luck!

share|improve this answer
    
Thanks! This seems like a good approach. I'm going to see if I (or someone else) can find the time to dig into gparted's source to see if I can't find the order of operations to confirm what is likely to have actually happened. I'm pretty sure this'll be the method of recovery, but I'm leaving it open for now. –  martindale Mar 4 '13 at 3:59
    
Hey there. It's been a while since I've logged in and I wanted to see if you were able to recover your data. Please let us know what the ultimate outcome was and if you tried my suggestion. –  Speeddymon Jun 18 at 15:02
    
I haven't yet tried this, but I've set the drive aside for when I do in fact have time to attempt it. I will update this with the results. Thank you very much for checking in! –  martindale Jun 22 at 17:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.