Recover ext4 partition initialized by win10

Forum rules
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Locked
CloudyStef

Recover ext4 partition initialized by win10

Post by CloudyStef »

Hi guys, please help!
I have 3 drives in my dual-boot system: an SSD (NVME) hosting win10 pro, a 1TB HD hosting Linux LMDE, and recently I added a 3TB drive (WD RED) to store my family archive. This 3TB drive is with the problem, which I caused. I formatted it as single partition in ext4, thinking that keeping my photos under Linux will protect them from ransomware.
As in the end the partition was not full (about 500GB remaining) I decided to shrink that partition to make room for a second one of 400GB, planning to format it in NTFS so I could move large file between Linux and win10. I did shrink that with Gparted then I re-booted into windows, to format the 400GB (I know Linux can do it too). After boot win10 immediately prompted me to initialize the disk. Stupid me clicked OK thinking of the new partition, not the whole disk.
I disconnected the 3TB disk immediately after realizing the mistake to avoid overwriting on it, and I now am searching for a tool to undo the initialization and recover the 2.2TB of data. I think there is such software (or used to at least) but I worry that a windows utility might not be able to recover a partition foreign to windows like ext4. I read about TestDisk in Linux, but with warnings that one needs to know what they are doing with this utility, otherwise it is risky.
My questions, if anyone has good advice to give:
a) what is the best approach to recover the ext4 partition?
b) if TestDisk is indeed the best tool, where would I find a detailed tutorial? or maybe some of the knowledgeable authorities of the forum might walk me through the steps?

Please help or my wife might permanently reduce the number of your readers by 1!
Stefan
Last edited by LockBot on Wed Dec 28, 2022 7:16 am, edited 1 time in total.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
User avatar
catweazel
Level 19
Level 19
Posts: 9763
Joined: Fri Oct 12, 2012 9:44 pm
Location: Australian Antarctic Territory

Re: Recover ext4 partition initialized by win10

Post by catweazel »

CloudyStef wrote: Sun Apr 14, 2019 4:34 pm Please help or my wife might permanently reduce the number of your readers by 1!
https://www.cgsecurity.org/wiki/TestDisk_Download
"There is, ultimately, only one truth -- cogito, ergo sum -- everything else is an assumption." - Me, my swansong.
Mute Ant

Re: Recover ext4 partition initialized by win10

Post by Mute Ant »

Of course drives fail, or users format them, or the weather blows up the computer by stuffing 500V down the telephone line. You were unlucky.

o Don't delete the originals... put them somewhere safe, like USB sticks in the sock-drawer or a stack of DVD-R or a detachable hard drive or in a cloud-store.

o Don't use superuser privileges on your work machine.

o Expect the hardware to fail at any moment. It doesn't, but it can, for no obvious reason.

Testdisk (photorec) does a wonderful job on JPEG files, it's relatively poor with anything else, so you can get your pictures back without help... the rest is probably unusable.

An EXT partition can be 'reformatted' without re-writing the inodes and file-names. It's technically complex and interactive. If you really need that data I think it's time to employ a professional recovery expert.

Alan says: "There's only 10[2] sorts of computer user, those who have lost data and those who are going to lose data."
CloudyStef

Re: Recover ext4 partition initialized by win10

Post by CloudyStef »

Thank you catweazel and Mute Ant, the link lead me to detailed tutorials on wiki, I'll read them carefully.
Basically what is the difference Between TestDisk and Photorec? There were some hints that they might work together (like "TestDisk and its companion Photorec")? In any case I got my work cut out, thank you for the response!
Mute Ant

Re: Recover ext4 partition initialized by win10

Post by Mute Ant »

The package testdisk contains both commands, testdisk and photorec, so you sudo apt-get install testdisk to get both.

Photorec is totally read-only, so that's the one to go for when it's 'forensic' and you absolutely must not change anything on the drive (recommended).

I have never tried the testdisk command. If it's that broken I return the drive to the owner unchanged :(
CloudyStef

Re: Recover ext4 partition initialized by win10

Post by CloudyStef »

Thanks, that's what I'll do then after studying the tutorials.
Locked

Return to “Storage”