Getting the deleted partition back using TestDisk or Timeshift?

Applications
, ,
1

This has ben “A” day…one I will not soon forget.

First, went into Kubuntu (my 2nd Linux on dualboot) and checked everything was ready for getting rid of it so I can add that space to my Linux Mint partition.

All personal data (home folders) on external HDD, so nothing needed my attention.

Using gparted, deleted the partition and added it to LM partition via “resize.”

Well, DERP, forgot about grub. Spent a loooooong time getting those commands entered correctly,. Not sure how the whole directory structure works when deleting partitions. Example: does former dev/sdc1 become sdb1? Of course, hard to tell in grub as we are using (HD2,2), etc.

So once I got grub fixed, booted up, grub remains, and Ubuntu is top choice. Hmmm, had that happen yesterday (after a hard reboot after system freeze) where instead of Linux Mint and Ubuntu, I had Ubuntu ver.xx.x and Ubuntu verxx.x but later it corrected itself and showed Linux Mint and Ubuntu.

Did it boot? Yes. KUBUNTU booted. OMG! Are you serious? I deleted the WRONG partition and added it to the other? Or did the commands in grub shell do this?

ls (hd2,2)/

I had to be looking at the right disk then, as it detected the Linux filesystem. And when I entered:

cat (hd2,2)/etc/issue
Ubuntu 23.10 \n \l

At that point, I did not consider which Linux was ver 23.10. Was that Kubuntu recently updated? or did the last LM update move from 23.04 to 23.10.

Not sure if I am thinking right, but once i deleted the partition, when I resized the other, it started after the deleted partition. But in gparted, as I grew the remaining partition, the deleted one shrunk accordingly, even though it was before it. So is it possible that I deleted the right partition (Kubuntu) and added it to LM, but setting the particular vmlinuz-6.5.0-15-generic and maybe pointing to the wrong /dev/sd? I made grub now only show booting to the Kubuntu kernel or is that even possible?

My brain is fried trying to think this through. So I searched and found the Testdisk solution as a possibility.

Of course, during all of this frantic researching for how to get it back, internet goes down…for the 3rd time this week.

After getting to the point in Testdisk that I am unsure (and we all know not to do ANYTHING in Testdisk till we are sure) I searched ITSFOSS for relative info and did find a good thread from 2019, but ALAS it never got a solution.

So we need to get a solution here fellow Linux techy people. :grin:

After going “deeper” I get:
The following partitions can’t be recovered:
Linux filesys. data about 10 rows

But Continue was highlighted and selecting that displayed a lot of deleted parts, including EFI, Swap and a lot of MS Data as well as Linux filesys.data.

PXL_20240126_213129238
PXL_20240126_2131292381920×2560 232 KB

PXL_20240126_213146293
PXL_20240126_2131462931920×2560 306 KB

So after looking at all of that, the first question is:

Can we recover it enough to actually boot to LM after recovery? Or am I beating a dead horse?

Note that I am not needing personal items (Thank God!) just dreading having to reset up all those custom apps accumulated over the past year.

Backups? Of course. But how do I restore from a backup without the system in place? Even Timeshift cannot do that, can it? If it can, that would be great–except–doesn’t Timeshift require the snapshots to reside on the same partition?

So while awaiting the restoration of high speed internet (vs. my cell phone hot spot) I will wait and hope that someone here can assist me. Ever the optimist, if it cannot be done, I will resinstall and count this as furthering my Linux education.

Thanks,
Sheila Flanagan

2

Sorry to hear of your issues. I am similarly brain fried today. I have a grub issue to deal with after trying to rename a volume group. Ugh.

I’ll let @nevj advise. You wouldn’t want any advice from me today. I can barely type at this point.

3

ROFL!!! I hear you.

Thanks,
Sheila

2 Likes
4

That is right. You need Clonezilla backups made with a Clonezilla usb drive. Then you can use the usb drive to start Clonezilla for a restore. Your backup software needs to be on an independent medium.

Someone who uses Timeshift may correct me here…I dont think Timeshift is meant to recover from a complete disaster… I dont think you can start Timeshift from a usb drive… hope I am wrong

So what happened? Sounds like you deleted the Linux that controls grub… so there was no /boot/grub/gfub.cfg file to help grub setup its menu… If that is it, you could try a fresh new install of some Linux, let it write grub to the disk, get it to boot, enable os-prober, and do update-grub and then reboot and see what is in the grub menu… there may be enough there for you to be able to recover what you want.

Next time… do a Clonezilla backup first… make sure you dont remove the linux that controls grub. Put some other Linux in control of grub first.

Hope I never have one of those days

1 Like
5

Since Kubuntu booted after fixing grub, I would say that is what I did. Let’s see: if I deleted Kubuntu partition (as I thought I did) that would not have affected grub? Even though it did not control grub, it was part of grub.

So can you confirm that there’s no way I removed the Kubuntu and still had LM but made mistakes in grub shell that pointed to the wrong install?

Thanks,
Sheila

6

I was rather hoping to restore from Testdisk as I am afraid doing anything will wipe the recently deleted partition when it is actually still there, since I have not done one thing other than fix grub in grub shell today on that machine.

But I repaired grub in grub shell. Would that not show me anything it can find?

I have not touched the machine today after fixing grub and running testdisk for fear of overwriting the deleted partition that held LM.

Sheila

7

Are you sure you know what booted… they can all look the same inside a terminal

but, yes, … If LM controlled grub, I think you removed LM

You will find out for sure, if you do what I suggested … another fresh LM install and write grub, and do update-grub then reboot and the grub menu will tell you with certainty what is there.

8

Yep. You’re right, that was the issue: You are not sure when they are called Ubuntu in grub or Linux in terminal and since I had NOT been paying attention to the kernel used in Kubuntu, I couldn’t tell from that either–they may have both been using the same.

But I just read that timeshift CAN be used to restore a non-bootable system via live USB. BUT the issue remains: are the snapshots on that same partition I deleted? I do know you cannot use an external usb for the snapshots as believe me I tried.

Sheila

9

Maybe I should focus on restoring the Timeshift snapshots from the partition rather than hoping for a bootable LM by restoring everything.

I will see what else I can find on Testdisk restoring, but looking at my pics in the original post, I don’t know why there would be 2 efi files or 2 swaps, etc. And if restore both, what then? I would need to know how the app sees non-system files in Testdisk to determine restoring the snapshots.

Sheila

10

If snapshots are there, they should be in a partition of their own and Timeshift should be able to find them

I still vote for a fresh new install

11

Testdisk guide says this:

Partitions listed as D(eleted) will not be recovered if you let them listed as deleted. Use the arrow keys to switch the partitions you want to recover (check the partition size, list the file contents…) from D(eleted) to *(bootable), P(rimary) or L(ogical). Only one partition can be listed as *(bootable). It is not a problem if a partition is marked as bootable on a disk you will not start from (e.g. an external disk) but there MUST be a bootable partition on a disk you want to start your computer from.
Once all the partitions you want to keep and all the partitions you want to recover are properly marked as non deleted, continue on next screen. Review the partitions list. If all partitions are listed and only in this case, confirm at Write with Enter, y and OK. Now, the partitions are registered in the partition table.

Issue is when I use the arrow keys it only toggles between P and D; cannot keep listed as D(eleted) but P or L? And which would be bootable? all efi?

It’s confusing.

How could it find them if they were on a deleted partition? I don’t know.

But I think the shots I posted were deep diving into the EFI deleted partition. Now I am running the other part (main Linux?) i Testdisk and it is finding a LOT. Will update when that finishes.

Is your vote based on you thinking I would boot into LM? Cause I already booted into Kubuntu after grub repair. There’s no mistaking the login screen. And if I fresh install? Where? over Kubuntu cause remember it now has that deleted partition as part of it.

Sheila

1 Like
12

That might be because I was running the search in the EFI partition that was deleted. This might change after running the deep search on the other deleted partition.

Sheila

13

Apparently my attempts in the past to have Timeshift use my ext HDD must have been user error as it is capable of doing so. Here is the guide for restore:
Snapshots can be restored either from the running system (online restore) or from a live CD (offline restore). Restoring backups from the running system requires a reboot to complete the restore process.

● In an online restore you are restoring the very system that you are running from. The system will be rebooted to finish the restore process. Does not apply to me?

● An offline restore is when you restore a system other than the one that you are currently running. If you have a multi-boot setup, then you can boot into one installed OS and then restore another OS that may be installed on another disk. You can also boot from a Linux Live CD or USB, install Timeshift and then restore the installed system. An offline restore using a Live CD/USB may be required if your installed system is not bootable. Boot into Kubuntu to restore and maybe since partition data is still there Timeshift would find it?

● The snapshots to be restored can be of any Linux distribution. For example, let’s say you are currently using Xubuntu and decide to try out Linux Mint. You install Linux Mint on your system and try it out for a week before deciding to go back to Xubuntu. Using Timeshift you can restore the last week’s snapshot to get your Xubuntu system back. Timeshift will take care of things like reinstalling the bootloader and other details. Since installing a new Linux distribution also formats your root partition you need to save your snapshots on a separate Linux partition for this to work. Also, since formatting a partition changes the unique identifier (UUID) for the partition, you will have to map the target devices manually when you restore the snapshot. Not sure this will help in my situation.

Sheila

14

I thought you could not boot anything.
If you can boot Kubuntu, temporarily make it the grub controller with grub-install, enable os-prober, then do update-grub, and reboot, and the grub menu should display everything that is there.

I am very wary of Testdisk. It could confuse things further.

15

Why would we do this when grub already booted with Kubuntu and all the memtest, etc. options? Would grub have not found LM then? Although, I am stumped why there was a grub in the 1st place with only one OS. Unless it was my doing in the grub shell after it would not boot at all.

Let me exit gparted and reboot as is and I’ll show you grub.

Sheila

16

Current Grub menu:

PXL_20240127_002810129.MP
PXL_20240127_002810129.MP1920×2560 148 KB

And this Ubuntu is:

PXL_20240127_002832709.MP
PXL_20240127_002832709.MP1920×2560 168 KB

Kubuntu

So should I still do what you said to make it grub controller? As first place it is controlling grub, right?

Sheila

17

I am not positive it will work, but I did find my LM snapshots on the external HDD from October. Reason I am unsure, is I had read some forums where copying the snapshots did not work and I must have copied the folders of snapshots from the internal OS partitions to the external drive.

I will need to boot LM from my Ventoy, install Timeshift on the drive and run it to test
a) what it finds on the current internal drive (that includes the deleted partition) as well as
b) point to that external HDD and see if those are recoverable.

That would be better than a complete reinstall.

Thoughts?
Sheila

18

OS-prober shows no other system installed.

Sheila

19

Okay. I booted Kubuntu and ran Timeshift from there and it gave me the attached external HDD folder of snapshots. I do see snapshots from this week there, but not sure how to read the data:

PXL_20240127_010601836
PXL_20240127_0106018361920×2560 580 KB

This appears to be more recent on efi and boot as well as a lot of other folders, but have no idea what the times or percentages mean.

So now I will attemtp to boot live (offline) vs online (in Kubuntu) and see if Timeshift finds anything on the internal drive more recent.

Will update in a bit.

Thanks,
Sheila

20

Okay. I booted into live Linux Mint and started Timeshift and it found “TODAY’S” boot & hourly snapshot!!! Not sure, but maybe I did point to the ext HDD for snapshots?

So now I can restore to the single partition drive where Kubuntu currently resides, but I have to make choices I am unfamiliar with:

Path Device
/ sda2~ext4 (1000GB) This is right
/boot keep on Root Device Is this right?
/boot/efi sda1~vfat (537MB) vfat? must be right as other option(s) are on root (nope) or other drives
/home Keep on Root Device I will use symlinks later to point to the files already on the external HDD for Linux Mint
Bootloader Options:
Reinstall GRUB2 on:
Internal 1TB (MBR)
Don’t update initramfs
DO update Grub menu

So should I just go with this (fingers crossed) rather than hope to recover anything from Testdisk?

I guess if all else fails, I am back to fresh install and setup everything again.

Thanks for any input,
Sheila