rajind.dev

Recovering Accidentally Formatted ext4 Partition / Fixing Superblock

Published by Rajind Ruparathna 5–6 minutes

Today, I made the silly mistake of accidentally formatting one of the ext4 partitions in my Ubuntu 16.04 machine to NTFS instead of formatting the pen drive, which I was hoping to format. So if you are reading this most probably you have done something similar or perhaps someone you know has gone down that path and you maybe trying to help him/her.

Fortunately I was able to recover my partition completely and in this post I’ll go through the few things that helped me recover my partition. There is still hope my friend. 🙂

First I must thank Shane for this askubuntu answer, the author of this blog post for giving pointers and my friend Janaka for helping me out. Have a look at those two posts as they are very helpful.

If you accidentally formatted your partition (or in any case of lost partitions or data), the most important thing is avoiding any data writes on that partition. Another important thing is creating a backup image of the messed up disk.

Quoting Shane,

If your messed up drive is sda, and you wanted to store the image in yourname’s home directory for instance: dd if=/dev/sda of=/home/yourname/sda.img.bak bs=512

to restore the image after a failed recovery attempt: dd if=/home/yourname/sda.img.bak of=/dev/sda bs=512

You could of course use /dev/sda1 if you are only interested in the first partition, but as some of these utilities alter the partition table, it is perhaps a better idea to image the whole disk..

Also, if you are using dd for a large operation, it is very helpful to see a progress bar, for which you can use a utility called pv which reports progress of data through a pipeline

for instance: pv -tpreb /dev/sda | dd of=/home/yourname/sda.img.bak bs=512

First of all I tried TestDisk tool. I was able to get some files recovered but I wasn’t able to find a way to recover the whole partition using TestDisk tool.

Then I started following the other blog post I shared above. In their first thing was identifying the affected partition. I already knew mine, however if you want to get info on that you can run sudo fdisk -l command. Output for me was as follows.

fdisk-output

Now the idea for the next step is that, since I did not write anything on the formatted disk, my previous ext file system data should be still there. In ext, file system data are kept in a record called Superblock which keeps the characteristics of a filesystem, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups. (You can read more about it here if you are interested). So what what we are trying to do here is to fix the ext file system.

In my case, I was able to do it with the following file system check command. (Note that the same command is there for ext2 and ext3 as well). Before you run the command, make sure the partition is unmounted.

sudo fsck.ext4 -v /dev/xxx

First part of the output for me was as follows. I was able to see the original partition name (“Personal”) which I had previously given to my ext4 partition and it gave me a slight relief. So if you are able to see the same, hopefully things will turn out better.

fcsk-output-part1

At the bottom of the above screen capture, you could see a prompt asking it it is okay to fix certain blocks count. I went with yes here and it was actually the only option for me to go as well. There were few more prompts of the similar manner and seemed like a lot more is coming. So I stopped the command and went with the following which basically says yes to all prompts.

sudo fsck.ext4 -vy /dev/sda10

Then after a number of fix prompts, I got the following output.

fsck-output-success

When I mount the partition everything was back to normal. Hopefully you will be able to recover yours as well. Please note that this might not be the recovery method for all the scenarios. I’m just noting this down hoping that this will help someone else like me. Make sure you understand the steps well before doing these.

EDIT (03/09/2017):

If you have a dual boot set-up, once you boot up the other OS (e.g. Windows) you might lose the partition again since in the other OS the partitioning might be different. So it’s better to make sure to get a backup once the recovery is done.

Further even if you lose the partition again once you login to the other OS, you can still recover using the fcsk.ext4 command.

Cheers! 🙂

~ Rajind Ruparathna