partition table Can a Partition Table Be Recreated?

[ProfessorError]

LTT Forum Members, 

 

Good morning, afternoon, and/or evening, and happy Friday and/or Saturday! I hope you are doing well. 

 

I tried asking this question on Reddit, but realized quickly that it would probably be buried and maybe unaddressed by that community (https://www.reddit.com/r/techsupport/comments/1bkokue/help_please_i_am_trying_to_recover_a_partition/). I then remembered that I have been watching LTT videos for years and Linus and team always mention how active and helpful the LTT forums are. For that reason, I created an account and brought my problem here to see if the LTT community could help me out. 

 

 

Now that the pleasantries are out of the way, I will get to my issue: I used a hard drive sled to partition a 14TB drive as exFAT using Debian 12. After formatting, I safely unmounted, unplugged then powered off the sled, and switched the sled over to my Windows PC where I had files I was holding temporarily. I moved these files onto the drive without issue, safely ejected the drive, unplugged then powered off the sled, and removed the drive from the sled. I powered-off the Debian PC, plugged the 14TB drive into the tower with SATA and power connectors, then powered the machine back on to begin the process of mounting the drive and setting up automatic mounting for continued use. 

 

To my surprise, the hard drive was recognized at a hardware level, but I was unable to mount it as the partition table was unable to be read. After researching and trying everything I could, I was unable to recover or recreate the partition table and I failed to take screenshots while working through these steps (as I thought this was a simple confusion from having used the sled). The further I went down the rabbit hole, the less partition information I was able to glean until I arrived where I am now. In a last-ditch effort to try to save the data on this drive, I humbly approach the LTT Forums community to see if anyone has had this issue and solved it or is enough of a linux (and/or data partitioning) master to help me solve my issue. 

 

Attached are 3 images: 1 is the details of the drive when connected via the sled to my Debian PC, 2 is the Gdisk details for the drive, and 3 is the Fdisk details for the drive. 

 

OS: Debian 12 (bookworm) 64-bit 

HDD: Western Digital 14TB WD140EDGZ 

HDD Sled: Sabrent EC-DFLT 

Software Used to Pull Information: Cockpit Web Console (https://cockpit-project.org/) 

 

Regarding the additional details required by the "Read before asking for help" thread: 

• I have searched for similar posts and could not find exactly what I am looking for: 
  • Example 1: https://linustechtips.com/topic/1536091-i-accidently-deleted-a-partition-using-diskpart-how-do-i-undo-it/#comment-16170355 
  • Example 2: https://linustechtips.com/topic/1523269-recover-files-from-an-unalocated-drive/#comment-16058827 
  • Example 3: https://linustechtips.com/topic/1539721-how-to-replace-a-system-and-primary-partition/#comment-16197491 
• Some of the troubleshooting forum posts I referenced and/or followed are: 
  • https://askubuntu.com/questions/1436508/trying-to-access-data-from-pmbr-gpt-disk 
  • https://askubuntu.com/questions/1332961/drives-partitioned-via-server-usb-caddy-not-recognized-by-workstation-esata-gpt 
  • https://www.howtogeek.com/106873/how-to-use-fdisk-to-manage-partitions-on-linux/ 
  • https://superuser.com/questions/597609/recover-lost-partitions-or-partition-table-after-fdisk-in-debian 
  • https://superuser.com/questions/57240/how-to-recover-a-partition-accidently-deleted-with-fdisk-linux 
  • https://superuser.com/questions/133799/how-do-i-restore-a-partition-without-losing-the-data 
  • https://www.cyberciti.biz/faq/linux-backup-restore-a-partition-table-with-sfdisk-command/ 
  • https://askubuntu.com/questions/386752/fixing-corrupt-backup-gpt-table/386802#386802 
• Considering this is not a POST or crash issue, I am leaving out: 
  • the entire system specs, including PSU wattage 
  • the BIOS version 
  • other system specs 
  • running software when crashed (there is no crash) 

If any of the omitted information would be needed to provide support, I will gladly provide. 

 

Thanks for any help you all can give me! 

 

 

 

[da na]

This is a total shot in the dark, but many years ago I managed to corrupt the file index of a drive on Linux, but a Windows machine was able to rebuild the index and make the drive usable again.

There's a chance plugging it back into a Windows system might repair the partition table.

I hate to hit you with the "just chkdsk, bro" answer but that genuinely did solve my very similar issue in the past. 

[ProfessorError]

1 hour ago, da na said:

This is a total shot in the dark, but many years ago I managed to corrupt the file index of a drive on Linux, but a Windows machine was able to rebuild the index and make the drive usable again.

There's a chance plugging it back into a Windows system might repair the partition table.

I hate to hit you with the "just chkdsk, bro" answer but that genuinely did solve my very similar issue in the past. 

@da na I appreciate the quick response and I did try reconnecting it to Windows, but I did not really go too much further because I was not sure what I could do to try to fix it using Windows. Unfortunately, it does not get assigned a drive letter and therefore cannot run chkdsk on it. Do you know of any way I could force Windows to assign a drive letter to it? I am assuming this may not be possible due to there being no potential mount point without the partition table, but I am pretty far outside the borders of my technical know-how.  [EDITED "to" to "too" above.] 

 

 

[da na]

2 minutes ago, ProfessorError said:

@da na I appreciate the quick response and I did try reconnecting it to Windows, but I did not really go to much further because I was not sure what I could do to try to fix it using Windows. Unfortunately, it does not get assigned a drive letter and therefore cannot run chkdsk on it. Do you know of any way I could force Windows to assign a drive letter to it? I am assuming this may not be possible due to there being no potential mount point without the partition table, but I am pretty far outside the borders of my technical know-how.

Oh wow so it's reverted back to GPT Protective Partition. Ouch.

What you could do is use drive recovery software to hopefully recover the files you have moved from the Windows system's hard drive - that's also saved my ass in the past. Recuva is a go-to. Don't recover to the same drive, that might overwrite the file you're trying to reclaim.

At this point I would recommend downloading CrystalDiskMark and checking the health of that HDD, since if you properly ejected it that absolutely should not happen at all.

 

Would you mind opening cmd as admin, running Diskpart, and running List Disk and List Volume?

I wonder if the drive would still be listed as a volume despite being corrupted so heavily.

 

[ProfessorError]

28 minutes ago, da na said:

Oh wow so it's reverted back to GPT Protective Partition. Ouch.

What you could do is use drive recovery software to hopefully recover the files you have moved from the Windows system's hard drive - that's also saved my ass in the past. Recuva is a go-to. Don't recover to the same drive, that might overwrite the file you're trying to reclaim.

At this point I would recommend downloading CrystalDiskMark and checking the health of that HDD, since if you properly ejected it that absolutely should not happen at all.

 

Would you mind opening cmd as admin, running Diskpart, and running List Disk and List Volume?

I wonder if the drive would still be listed as a volume despite being corrupted so heavily.

 

@da na Decent news, I was able to look up another support article (https://superuser.com/questions/518634/running-chkdsk-on-a-disk-partition-without-a-drive-letter) and maybe come up with some additional information. After following the troubleshooting steps above, I came up with the images 6 and 7 below. Image 7 came after trying the other two "NO MOUNT POINTS" volumes which I believe are boot and/or recovery partitions for the Windows boot drive. Oddly, the filesystem listed is FAT32 which I know is incorrect because some files on the drive exceed the 4GB maximum file size of that filesystem (it is why I chose exFAT specifically). 

 

I followed your recommendation by downloading and running Recuva, which showed me that the volume ID in image 7 was actually incorrect. All 3 of the IDs provided by mountvol were actually each the boot and 2 recovery partitions on the Windows boot drive. I was able to find in the Recuva dropdown that there are 4 "HarddiskVolume" numbered IDs, but I get the error "Unable to determine file system type." when I try to scan them. I enabled all toggles in Recuva as well (see image 9). 

 

[EDIT: added this sentence and one additional image at the end of the post.] I also ran DiskPart and "list volume", but the volumes were not revealed (see image 10). 

 

 

 

 

 

[da na]

17 minutes ago, ProfessorError said:

@da na Decent news, I was able to look up another support article (https://superuser.com/questions/518634/running-chkdsk-on-a-disk-partition-without-a-drive-letter) and maybe come up with some additional information. After following the troubleshooting steps above, I came up with the images 6 and 7 below. Image 7 came after trying the other two "NO MOUNT POINTS" volumes which I believe are boot and/or recovery partitions for the Windows boot drive. Oddly, the filesystem listed is FAT32 which I know is incorrect because some files on the drive exceed the 4GB maximum file size of that filesystem (it is why I chose exFAT specifically). 

 

I followed your recommendation by downloading and running Recuva, which showed me that the volume ID in image 7 was actually incorrect. All 3 of the IDs provided by mountvol were actually each the boot and 2 recovery partitions on the Windows boot drive. I was able to find in the Recuva dropdown that there are 4 "HarddiskVolume" numbered IDs, but I get the error "Unable to determine file system type." when I try to scan them. I enabled all toggles in Recuva as well (see image 9). 

That is remarkably bizarre.

I'm sorry, but from here I have no idea where to go. 

With Recuva, there is a chance you could recover your files from whatever drive you copied files from - I know you said you temporarily stored them on this Windows machine before moving them to this drive? 
Scan whatever disk those files were on with Recuva. Chances are you'll find some remnants of files. It typically works better on small files like photos.

At this point, professional data recovery might be your only option, unfortunately.

[ProfessorError]

8 hours ago, da na said:

That is remarkably bizarre.

I'm sorry, but from here I have no idea where to go. 

With Recuva, there is a chance you could recover your files from whatever drive you copied files from - I know you said you temporarily stored them on this Windows machine before moving them to this drive? 
Scan whatever disk those files were on with Recuva. Chances are you'll find some remnants of files. It typically works better on small files like photos.

At this point, professional data recovery might be your only option, unfortunately.

@da na Sorry for the abrupt radio-silence, I ended up getting pretty tired and headed to bed. Later tonight, I will give Recuva a try on the drive the files came from to see what I can find (thanks for that tip!). 

 

As far as the professional data recovery goes, do you have any recommendations on places/people to contact? 

[da na]

3 minutes ago, ProfessorError said:

As far as the professional data recovery goes, do you have any recommendations on places/people to contact? 

@Pickles von Brine might know.

 

DriveSavers comes to mind, though. 

[BoomerDutch]

This is just last resort method use it if you need it.

 

• Use linux to Format drive and make it readable.
• Use recuva on it with deep scan.

It will take while but you will be able to recover some files.

 

It worked for me even I've formatted it and forgotten backup files so I've used Recuva just recover it and it succeeded.

 

Only files are really gone is it's been overwritten.

 

Maybe in future buy small nas and connect nfts drive to it and use it only for important files.

 

[ProfessorError]

On 4/6/2024 at 9:52 AM, BoomerDutch said:

This is just last resort method use it if you need it.

 

• Use linux to Format drive and make it readable.
• Use recuva on it with deep scan.

It will take while but you will be able to recover some files.

 

It worked for me even I've formatted it and forgotten backup files so I've used Recuva just recover it and it succeeded.

 

Only files are really gone is it's been overwritten.

 

Maybe in future buy small nas and connect nfts drive to it and use it only for important files.

 

@BoomerDutch I honestly never thought about this. Thanks for the tip! Do you know how many of the files on the drive you were able to recover? And, if I may ask, what command or application did you use to format in Linux? Did you format to the same filesystem?

[BoomerDutch]

20 minutes ago, ProfessorError said:

@BoomerDutch I honestly never thought about this. Thanks for the tip! Do you know how many of the files on the drive you were able to recover? And, if I may ask, what command or application did you use to format in Linux? Did you format to the same filesystem?

As for Linux my favorite disk manager is KDE partition manager 

 

 I was able to recover quite bit.

Most photos and videos and couple documents. You could determine if you haven't overwritten with anything just formatted it and haven't touched it.

This case was accidental deletion of partitions.

 

Yes ive formatted same filesystem.

 

You just forbid yourself to add any files to the drive. Although windows will probably write temporary files to it so it will overwrite something but not everything.

 

Hope you have second drive that is big enough to take all recovery files.

 

Remember once its booting with linux they may take time to boot because linux will also try read disk once it gave up and continues boot then you be able to continue.

[ProfessorError]

Sorry all, it looks like nothing worked. I even tried using GParted after booting up a live version of https://www.system-rescue.org/ and couldn't make it work.

 

Thanks for the attempts!