Page 1 of 1

Recover ext4 partition initialized by win10

Posted: Sun Apr 14, 2019 4:34 pm
by CloudyStef
Hi guys, please help!
I have 3 drives in my dual-boot system: an SSD (NVME) hosting win10 pro, a 1TB HD hosting Linux LMDE, and recently I added a 3TB drive (WD RED) to store my family archive. This 3TB drive is with the problem, which I caused. I formatted it as single partition in ext4, thinking that keeping my photos under Linux will protect them from ransomware.
As in the end the partition was not full (about 500GB remaining) I decided to shrink that partition to make room for a second one of 400GB, planning to format it in NTFS so I could move large file between Linux and win10. I did shrink that with Gparted then I re-booted into windows, to format the 400GB (I know Linux can do it too). After boot win10 immediately prompted me to initialize the disk. Stupid me clicked OK thinking of the new partition, not the whole disk.
I disconnected the 3TB disk immediately after realizing the mistake to avoid overwriting on it, and I now am searching for a tool to undo the initialization and recover the 2.2TB of data. I think there is such software (or used to at least) but I worry that a windows utility might not be able to recover a partition foreign to windows like ext4. I read about TestDisk in Linux, but with warnings that one needs to know what they are doing with this utility, otherwise it is risky.
My questions, if anyone has good advice to give:
a) what is the best approach to recover the ext4 partition?
b) if TestDisk is indeed the best tool, where would I find a detailed tutorial? or maybe some of the knowledgeable authorities of the forum might walk me through the steps?

Please help or my wife might permanently reduce the number of your readers by 1!
Stefan

Re: Recover ext4 partition initialized by win10

Posted: Sun Apr 14, 2019 4:55 pm
by catweazel
CloudyStef wrote:
Sun Apr 14, 2019 4:34 pm
Please help or my wife might permanently reduce the number of your readers by 1!
https://www.cgsecurity.org/wiki/TestDisk_Download

Re: Recover ext4 partition initialized by win10

Posted: Sun Apr 14, 2019 5:10 pm
by Mute Ant
Of course drives fail, or users format them, or the weather blows up the computer by stuffing 500V down the telephone line. You were unlucky.

o Don't delete the originals... put them somewhere safe, like USB sticks in the sock-drawer or a stack of DVD-R or a detachable hard drive or in a cloud-store.

o Don't use superuser privileges on your work machine.

o Expect the hardware to fail at any moment. It doesn't, but it can, for no obvious reason.

Testdisk (photorec) does a wonderful job on JPEG files, it's relatively poor with anything else, so you can get your pictures back without help... the rest is probably unusable.

An EXT partition can be 'reformatted' without re-writing the inodes and file-names. It's technically complex and interactive. If you really need that data I think it's time to employ a professional recovery expert.

Alan says: "There's only 10[2] sorts of computer user, those who have lost data and those who are going to lose data."

Re: Recover ext4 partition initialized by win10

Posted: Sun Apr 14, 2019 6:51 pm
by CloudyStef
Thank you catweazel and Mute Ant, the link lead me to detailed tutorials on wiki, I'll read them carefully.
Basically what is the difference Between TestDisk and Photorec? There were some hints that they might work together (like "TestDisk and its companion Photorec")? In any case I got my work cut out, thank you for the response!

Re: Recover ext4 partition initialized by win10

Posted: Mon Apr 15, 2019 5:28 am
by Mute Ant
The package testdisk contains both commands, testdisk and photorec, so you sudo apt-get install testdisk to get both.

Photorec is totally read-only, so that's the one to go for when it's 'forensic' and you absolutely must not change anything on the drive (recommended).

I have never tried the testdisk command. If it's that broken I return the drive to the owner unchanged :(

Re: Recover ext4 partition initialized by win10

Posted: Mon Apr 15, 2019 8:32 pm
by CloudyStef
Thanks, that's what I'll do then after studying the tutorials.