I will pay you to help me understand the right direction to restore a partition.

[a9ftNinja]

Hello, i may have lost every single picture of my kids and im literally in tears. the other information stored also contains data for a really important CASA(court appointed special advocate for children) case that i'm participating in. in-which the data will be presented in august for juvenile court. all that i can, and wish to say, is this is a very big deal. and i cannot just put this drive in another persons hands.

 

I converted a linux computer to windows for the purpose of building a newly needed security camera system.. and in the process deleted a couple partitions on my external drive.

 

I had the presence of mind to unhook all drives except the drive i wanted to install windows to, but i forgot to unhook my external usb drive. which had 3 main partitions. time machine partition, mac storage partition, and a shared storage partition(exFAT i believe but this one is still intact).

 

i remember thinking, man i dont remember linux needing this many partitions and WHAM it sunk in. i panicked and instead of hitting the undo button, i yanked the usb out of the computer. it was my usb extention that i use for my mouse receiver. not the usb for the external drive.. i killed power and turned it back on. still in a panic. it didnt register to me why my mouse wasnt working. then WHAM i got hit again. i turned the computer off, unhooked the external drive and now it sits.

 

the data on the 2 deleted partitions is the only data thats ever been on the drive. but i have no idea how mac has managed that data. but mac seems to frequently use the time machine partition.

 

at this point, i dont trust myself. i am asking for help, and im willing to do whatever it takes to find the RIGHT way to go about this. i will send some bitcoin to anyone and everyone that brings some help to the table and sees this through with me.

 

thank you in advance. i am so sorry.

[Origami Cactus]

I really hope you didn't corrupt anything by yanking that out. 

Now, the only advice. If it is really important data, go to data recovery experts. Don't plug it back in, send it straight to specialists.

Linus had a really impossible situation on his hand with his server, but werecoverdata.com helped him out of it, and it is a really good company. So I would start there.

 

If your first reaction to deleting a partition is to also potentially corrupt and completely destroy the data, I wouldn't trust you to do any recovery without potentially making it worse, no offence. So please use the experts, especially because you are already willing to pay to get the data back.

 

You wouldn't perform brain surgery on yourself, you would go to a doctor, the same goes for data recovery, so don't worry about "putting this drive in another persons hands", because their hands are far more trained than yours.

 

Just to reiterate, WeRecoverData has recovered data for the biggest companies on earth, they have recovered utterly unrecoverable data off burned down hdds by basically using magic, so recovering your data would be just a tuesday for them, so no need to worry at all, they will get your data for you.

[Sauron]

Absolutely contact specialists for important data recovery.

 

From your description of events it's possible nothing bad actually happened; if you didn't give the partition editor the go-ahead by confirming your new partition scheme it shouldn't have actually touched the drive. Yanking the drive out is a bad idea but if nothing was being written it may not have done any damage. Still, it's not worth risking actual data loss so I'd still contact a specialist rather than trying to plug it into anything.

 

Another cause for hope is that even if you actually deleted the partitions the files should still be there in an inaccessible state; in that case recovery should be perfectly possible for a specialist (again don't try anything yourself).

 

In the future I would advise you to never entrust important data to a single storage device, particularly an external consumer drive. Partitioning mistakes aside these devices are liable to fail spontanously, sometimes unrecoverably, and lose your data.

[Ralphred]

As long as you haven't tried to write any data to the areas of the disk that the partitions you "deleted" used to occupy, the data is still there.

A partition table is just a "map" telling the computer which "filling cabinet" to store things in, if you were to (for example, don't do this!) know the exact set-up of the partitions before you "deleted" them you could manually restore it and would notice no loss of actual data. So from that point of view, your data is OK.

 

File-system "formatting" works in a similar way, it just creates a bunch of blank index cards, the files are still there. The only times this wouldn't be true is if you switch to a file-system that need more "index space" and overwrites some old data with new blank indexes, or you performed a full format and wiped out the data.

 

Easiest thing to do, head over to https://www.cgsecurity.org/wiki/TestDisk and grab a live usb, make sure you have enough disk space on a separate drive from the one you wish to recover data. Read the instructions a couple of times, read them again, then before plugging the drive you want to recover from, test you know what you are doing by creating then deleting, then recovering a file on some inconsequential disk. Once you are happy you know what you are doing, plug your actual drive in and start recovering. If you treat your USB drive as "read only" and don't allow anything to write to it, the worst you can do is waste your time before you have to send it to a DR agent.

[Kilrah]

Testdisk can try to recover a partition table, but it'll write to the drive when doing so with the potential for making things worse, so you should make a full image of the drive onto other storage first and only work on that if you really want to attempt something yourself. 

 

And for next time remember that any storage device can fail at any time so having only one copy of important things is a no-no, make backups.

[Wild Penquin]

I agree with others in this thread that in OPs case, best thing to do is to take it to a specialist.  The data is too valuable to be lost, and it is probably still there. It might even not cost that much, since the recovery might be trivial for a specialist.

 

However, for others in the same boat (who might wander into this thread), YMMV. It the data is not valuable enough to take it to a specialist, one might attempt recovery themselves. There are already good tips in this thread. I'd go about it like this:

 

Preparation:

1. Calm down. Don't do stuff like OP (panick and yank out drives etc.). Remember: no data will be lost if you don't do anything. Don't rush. Keep this mindset throughout recovery.
2. Read the documentation of the tools you plan on using beforehand. There are many alternatives, and I will give one way, the one I would do it (since I am familiar with these tools).

Actual recovery (with any Linux system and GNU tools):

1. Get another drive with more free space than the total size of the disk you need to recover.
2. Set up a Linux system so that you can write to this new spare drive. Make sure all utilities mentioned in the steps below are available.
3. Make sure you know what you are doing before proceeding (up until this point you have not touched the drive to be recovered!)
4. Connect the drive to be recovered to the system.
5. Make an image of the drive (make sure you will not write on it doing this!). In this case, you can use dd. If there is physical damage (bad sectors) you might want to use ddrescue instead. Be prepared to say goodbye to the data in case of bad sectors, there is only so much ddrescue can do, and attempting reads might degrade the drive further (*). For a non-physically damaged drive, reading it is safe, however. (messing up parameters of dd is not!).
6. Do data recover on the image. Start by recovering the partitions. GNU parted has a recover partition option, which is helpful if you have even a vague idea where the partition(s) used to be.
7. Mount the partitions from the image read-only. Try to see if your data is in there. If you can find it, copy it somewhere safe.
8. If you can not mount the partitions, parted has misdetected them - or (worse) someone/something has written over the data. Try again from step 6 with different values for recovery.
9. If you can not recover the data - remember, you still have the original drive untouched (since the mishap occurred) - you can now change your mind and take it to a specialist!
10. Once you have your data copied, the recovery is complete! But in best case, you now have the values for the partitions which you can create on the original, too (since you don't need it anymore, as the data is safe!). Best scenario is, you can just boot off it like nothing happened!

The main point was already said in this thread: Don't write on the drive to be recovered! Instead, make an image and work on the image. This can be achieved with many tools.

 

Backups:

I might sound like a preacher here, but really, really do make backups. I know, it is boring. But strong anecdotal evidence tells OP is not the only one who has had similar loss of data (or, hopefully for OP, near loss). Too many people have lost all their family photos/videos taken over many decades, and people have even lost the only copy of their thesis (or similar) which they have been working on for a few years (hope it is not CS, that would be too embarrassing)!

 

Cheers!

*) p.s. A small (but important) sidenote: Some people recommend that for disks with known bad sectors or known as physically failing, making an image is not the best approach. Instead what is often recommended is to mount the filesystem read-only (on a non-invasive OS which does not "read the disk behind your back"; this might be made on a minimal live Linux), and copy over the most important data, and little by little less important data - and after that, perhaps as a last step try reading off an image. Reading a whole image is stressing a failing drive, and most of the data on the disk is usually not that important, such as free space and the operating system etc.; the most important data might in best cases be only a few magabytes, such as the thesis you've been working on

Edited April 26, 2022 by Wild Penquin
TYPOs / minor errors added

[a9ftNinja]

Update so far.

 

I called a few data recovery places. I have just enough experience to think I know what would have to be done to fix my issues. The dollar amount I was being quoted to get my data back was offensive.

 

I sat down and thought through the problem for a couple hours and came up with a few things.

 

Testdisk creates images of partitions. And I have A TON of experience with Tesdisk and PhotoRec. Due to all those pictures of my kids originally being mixed on different drives over the years. Some of which weren't treated with the respect they deserved considering the data they held.

 

My Data was mostly on an exFAT partition because that at the time of breaking up my new external seemed like the likeliest option that linux, Mac, and Windows would all be able to read and use.

 

I also have an APFS partition for TimeMachine backups

 

And a Mac OS Extended Journaled partition for Macs own storage.

 

Mac knew nothing about me deleting the partitions and expected those drives to still be there. That got the gears turning. I plugged the drive in and there we are. Access.

 

I immediately chopped up the new drive the same way the old was. I first made a TimeMachine backup and copied the data from the other partitions over to the new partitions.

 

Then I made an images of what I could.

 

I have my data safe and the old drive sitting as it was for experimentation. As time permits I want to follow some steps outlined by you beautiful helpful people and give some feedback. I hope for all of us to learn from this situation

[tkitch]

So, this is a lesson in the 3-2-1 backup theorem.

 

At least 3 copies, on 2 different media, with at least 1 being offisite.

 

Your best bet is a backup solution like BackBlaze B2 or similar.  it's 5$/month per TB backed up, and 10$ per TB to download.  Which is pretty cheap all in all.  Other companies may be similar, depending on what you want specifically.

[FUIT1985]

Evidence files in court must be verified to prove that they have not been tampered with. So if you do not have an analog copy of these files you must contact an expert.

On 4/26/2022 at 11:01 AM, a9ftNinja said:

Hello, i may have lost every single picture of my kids and im literally in tears. the other information stored also contains data for a really important CASA(court appointed special advocate for children) case that i'm participating in. in-which the data will be presented in august for juvenile court. all that i can, and wish to say, is this is a very big deal. and i cannot just put this drive in another persons hands.

 

I converted a linux computer to windows for the purpose of building a newly needed security camera system.. and in the process deleted a couple partitions on my external drive.

 

I had the presence of mind to unhook all drives except the drive i wanted to install windows to, but i forgot to unhook my external usb drive. which had 3 main partitions. time machine partition, mac storage partition, and a shared storage partition(exFAT i believe but this one is still intact).

 

i remember thinking, man i dont remember linux needing this many partitions and WHAM it sunk in. i panicked and instead of hitting the undo button, i yanked the usb out of the computer. it was my usb extention that i use for my mouse receiver. not the usb for the external drive.. i killed power and turned it back on. still in a panic. it didnt register to me why my mouse wasnt working. then WHAM i got hit again. i turned the computer off, unhooked the external drive and now it sits.

 

the data on the 2 deleted partitions is the only data thats ever been on the drive. but i have no idea how mac has managed that data. but mac seems to frequently use the time machine partition.

 

at this point, i dont trust myself. i am asking for help, and im willing to do whatever it takes to find the RIGHT way to go about this. i will send some bitcoin to anyone and everyone that brings some help to the table and sees this through with me.

 

thank you in advance. i am so sorry.

 

On 4/27/2022 at 5:20 PM, a9ftNinja said:

Update so far.

 

I called a few data recovery places. I have just enough experience to think I know what would have to be done to fix my issues. The dollar amount I was being quoted to get my data back was offensive.

 

I sat down and thought through the problem for a couple hours and came up with a few things.

 

Testdisk creates images of partitions. And I have A TON of experience with Tesdisk and PhotoRec. Due to all those pictures of my kids originally being mixed on different drives over the years. Some of which weren't treated with the respect they deserved considering the data they held.

 

My Data was mostly on an exFAT partition because that at the time of breaking up my new external seemed like the likeliest option that linux, Mac, and Windows would all be able to read and use.

 

I also have an APFS partition for TimeMachine backups

 

And a Mac OS Extended Journaled partition for Macs own storage.

 

Mac knew nothing about me deleting the partitions and expected those drives to still be there. That got the gears turning. I plugged the drive in and there we are. Access.

 

I immediately chopped up the new drive the same way the old was. I first made a TimeMachine backup and copied the data from the other partitions over to the new partitions.

 

Then I made an images of what I could.

 

I have my data safe and the old drive sitting as it was for experimentation. As time permits I want to follow some steps outlined by you beautiful helpful people and give some feedback. I hope for all of us to learn from this situation