life

Did you just lose your data to a corrupt HD partition table?

WAIT. Don’t attempt suicide.

Out of the many different cases of data loss that I have been through, this is the easiest one to deal with. Geeks can be paranoid about data, huh? But at the same time, geeks are the only ones who are more prone to data losses due to corrupt partition tables, and you already know why!

…falls down, hits head, cries a little…

Geeks are guys who can’t rest with the same OS for more than two months, and they keep switching over to different flavors of Linux and BSD time and again. Surprised by my prowess in this field? Yeah, because just like you guys, I am a geek. I have sworn however, that from now on, I would rather rip my leg off than install another OS on my rig.

So guys, I can understand your situation. First off, let me introduce you to some really lifesaving gear that I keep, just in case. Download them from their specific websites:

  • A Linux Live CD: I use CRUX 2.4 which I downloaded and burnt over 3 years back, but as far as it still works for me, I’ll keep it, since it has always been there for me ;)
  • TestDisk – This little app can do business. Get this app from cgsecurity.org (and be sure to download the Linux version). Save this app on a USB.
  • Some removable storage device. If you do not have enough storage on this device to transfer all your HD data, you can use another computer to empty this drive each time it fills up.

So guys, in a nutshell, what we are going to do is boot from the Live CD (since our HD won’t boot for us at the moment), then fire up this app.  You must be knowing that deleting a file does not actually delete it from the HD. It is there and will continue to be there, unless you overwrite that specific hard disk sector with another file. And yes, files are never located on adjacent HD sectors. A file is made up of numerous clusters and each cluster of a file would be located in a very distant sector to that of its counterpart. Therefore, even if you overwrite that specific HD sector, there is a high chance that you will still recover part of that file.

Are we ready?

Insert the CRUX Live CD into the tray and boot into CRUX Live CD:

Press enter and wait until the console is ready, then login as root:

Create the mount point for the USB:

If you are not sure about the device node for your USB, just issue the fdisk -l command:

From this I know  that my USB (which is 1 GB) is on /dev/sda1.

Mount the USB on which testdisk is stored. Then cd to the directory where the testdisk binary is:

All right! Fire up testdisk!

The following steps would be self explanatory and you may need to choose different options depending on your rig:

Next we press the Quick search button. This will search for partitions by analyzing the cylinders hence bypassing the need for the partition table! This is the magic behind data recovery from a corrupt partition table!

You may stop the search anytime, if you want to skip over to Deeper search. But I recommend using the Quick search before you do Deeper search.

Unfortunately, I am running this on a Virtual machine and the HD is virtual as well. As it is empty, no partition shows up:

But this is the point where you should take solace! Your partitions (which would otherwise be gone for good), will appear here. Just select each one one after the another and start copying the files over to a removable storage. To mount the storage device, you can simply switch to a secondary console by pressing CTRL + ALT + F2. Once you have mounted your drive, revert to this screen by pressing CTRL + ALT + F1. Then start copying your data. Easy, wasn’t it?

Happy recovery!

2 thoughts on “Did you just lose your data to a corrupt HD partition table?”

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s