Jun 30 2009
So I was asked someone earlier today to try to analyze two CDs with Linux (installed on another partition of my laptop) to see if they were blank or contained data. I figured, “hell, why not? Should be easy enough, right? Hibernate Windows, reboot into Ubuntu, check the discs, come back up”. Wrong.
Very, very wrong.
See, about a month ago when the Windows Seven Beta was threatening to expire, I upgraded in-place to the newest version, RC1 (Seven, by the way, rocks). This, by default, frustratingly overwrote my MBR to put Microsoft’s proprietary bootloader on there, so I could no longer boot into Linux. I realized this fact this afternoon when, after hibernating Windows and restarting my machine, Seven popped back up again. Recognizing my mistake, I set out to fix it by reinstalling GRUB to the MBR, something I’ve done before and shouldn’t be too hard, right? Wrong.
Extremely, direly wrong.
So I pop in my Ubuntu CD (8.10, “Hardy Heron”, old at the time of this writing) and try to start up the live CD, twice; it keeps freezing on boot (that’s a secondary issue I’ve yet to resolve, at least with that version). I realize I could install GRUB from really any Linux live CD (with grub built-in), so I pop in my System Rescue CD (I forget which version) and try installing GRUB, but I forgot (in GRUB-speak) where the HDD was (if it was “(hd0,0)” or something else entirely) (this is require for the “root” command of the GRUB installation sequence). So I back out of GRUB and try mounting my current Linux partition of my HDD in the System Rescue CD’s live-CD filesystem to read its current GRUB configuration, which I should then be able to find and install, right? Wrong.
Horrifically wrong.
Through some mix-up of whatever commands I ran, upon reboot of my machine (and not even getting GRUB installed), lo and behold, Windows wouldn’t start. Oh crap. Not a big deal, right? I messed up something with the bootloader config, should be easy enough to fix. But when I booted with my GPartED live-CD, it reported my entire 300GB drive as “Unallocated”.
Oh shit.
Unallocated?
Unallocated!
That meant my data was gone! Overwritten! Deleted! Non-existent, all blank, never to be recovered!
What terrible news…
So, realizing that I now lost my Windows configuration (and all of my installed programs) and about 18GB of recently-added music to my collection (amongst other, more insignificant things), I dejectedly set about to download a copy of the latest version of Ubuntu (at the time of this writing, 9.04, “Jaunty Jackalope”), and install it to my laptop so I could then download, burn (no other computer has a DVD burner), and install the RC again of Seven.
While this is all going on, I decide (just out of curiosity’s sake) to try a few other rescue-type live-CDs I have in my collection (I’ve got a few tricks up my sleeve :-D). Nothing really got anywhere until I put back in the original setup disk for my laptop (yeah, back to Vista) and tried the “Repair Windows” link–it reported finding something wrong with the bootsector and, curiously enough, two Windows partitions (one from my Seven install and another embedded XP install Dell uses for its MediaDirect system). And, it found these partitions with consistent start/end blocks as I knew the sizes of the partitions to be.
But wait? How can this be? If all my data is gone…what is it finding…and how is it finding it?!
I think this to myself, and decide to allow it to “try repair and reboot”, which, of course, does nothing. But it gets me thinking further, so I reboot into GPartEd to encounter the same “Unallocated” disk I saw earlier. But this time I decided to go into the terminal and really see what’s up. I rooted around /dev/ for a bit, trying to find my particular HDD (it’s /dev/sda, not hda because it’s a SATA drive) and found 7 (logical) devices (excluding sda itself): /dev/sda[1-7]. Interesting, right? I created a mount point (/mnt/data) and tried various combinations of filesystems and devices until I hit on one:
mount -t ntfs-3g /dev/sda2 /mnt/data
Success in mounting? Surely this can’t mean…yes, yes it does! A quick `cd /mnt/data && ls` reported to me the contents of the embedded XP installation! Which meant that, indeed, my data was still intact and readable on my drive! And thus began my thinking that in fact it was not my hard drive that got overwritten, but simply its partition table that got corrupted.
So I did some research online and found a bunch of websites that really helped me out; I’ve linked to them here for completion’s sake and to help out anyone else who may have a similar problem in the future:
A summary of the steps I executed to finally rebuild my partition table and recover my laptop follows:
- Run `fdisk -u -l /dev/sda`. This outputs a list of the various partitions and their respective starting/end blocks and FS types on the drive; it was apparent from this that at least one partition was overlapping another and 2 others were out of order (AKA contiguously not following each other in the drive).
- `fdisk /dev/sda` to enter interactive mode. Here, I deleted (`d`) each of the offending partitions, one-by-one, verifying (`v`) the partition table after each time to check when the warnings about overlap no longer persisted.
- Write the new partition table to the disk (`w`) to save the changes.
After this, I started up GPartEd again and, amazingly, it no longer showed my disk as unallocated! My partitions were back! (Minus what I had just deleted; those were now the unallocated space). So I reboot the machine excitedly and–YES–Windows starts up! I was never so happy in my whole life to see a Windows login prompt! I was able to get back into Windows and immediately start a backup of all my important data and compose this post (which I’m writing from my now-recovered laptop! :-D).
So, what is the moral of the story? If there even is one? I really don’t know. Be careful what commands you execute when you’re fucking around with MBRs? Or, more importantly, even when you think your data’s hosed and you’re fucked–DON’T overwrite anything or start to reinstall stuff immediately. Had I done so, then my data truely would’ve been lost from the new partitions created. Since I spent a little bit of time researching, mucking around, and looking deeper into the problem, I discovered my data was there all along! And even if I couldn’t rebuild the partition table correctly, the mere fact that I was able to mount and read my data meant that I could’ve at least backed it up first to an external drive and THEN wipe the drive again–still a better solution to losing everything permanently.
Whew. This took up too much time tonight. What should’ve been a relaxing evening enjoying a movie turned into 4 hours of data recovery and low-level hard drive partition table rebuilding.
Oh, and the CDs, by the way? The ones that kicked this whole thing off?
Completely blank.