Score:2

Plugged in ext4 to Windows, how to recover the data in Ubuntu?

in flag

I moved all my data to a new drive and it seems to be lost. Please help me to recover the data.

Here is what I did to make the problem occur:
I moved, not copied the data. (First mistake) The HDD was making noises when I moved the data. Since the drive is new and the SMART values all looked good, I didn't worry too much about it, but maybe I should have?
To use the data I plugged in the drive into a Windows machine. (Second mistake) I tried to use DiskInternals LinuxReader to be able to read the ext4 format. Some files were readable other folders threw an error or appeared empty. I plugged in the drive into the original Ubuntu machine, only to see the same results.

What I tried to fix it:

  • The first recommendation was to make a dd backup of the entire disk. I did that.
    Although when checking afterwards with df -h the original disk showed 981G used and the copy only showed 80K in use. So maybe something there went wrong?

  • This morning I tried to continue after a reboot and suddenly I couldn't mount either disk:

    special device /dev/sdb1/ does not exist (a path prefix is not a directory).
    I tried what was suggest here and run sudo blockdev --rereadpt on both disks, but it ran without any feedback and the mount was still not possible. Since I planned on using e2fsck, I didn't worry about that too much, since I had to use an unmounted disk anyway.

  • I ran gdisk with r to get to recovery options and then with b and c to read and recover the partition table from the secondary table. Since v gave no errors, I confirmed the write with w.

  • Since that didn't work, I finally tried e2fsck. I confirmed everything it asked me to. Mostly invalid checksums, empty or "garbage" inodes and wrong counts for groups. Everything I read said this process might take hours, but it only ran ten minutes.

After that the mount finally worked, but df -h shows only 6.9G (There should be 981G) in use. The drive appears to be empty apart from around 50 entries in lost+found, so not nearly enough to cover all the files lost.


I don't know how to proceed and can't seem to find more answers on my own.
Why weren't the drives mountable anymore? - Answered by @mchid, thanks!
What can I try next, to have a chance at recovery of the data?

And if someone has the patience to educate me:
Did plugging the ext4 drive into a windows machine corrupt it? If so, why? From what I understood with the correct drivers (i.e. LinuxReader) it should be readable.

Any reply is greatly appreciated. Thanks for any help in advance!


Edit to add:

lsblk output:

NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda      8:0    0    8G  0 disk
├─sda1   8:1    0    1M  0 part
└─sda2   8:2    0    8G  0 part /
sdb      8:16   0  3.7T  0 disk
└─sdb1   8:17   0  3.7T  0 part
sdc      8:32   0  3.7T  0 disk
└─sdc1   8:33   0  3.7T  0 part
sdd      8:48   0 1000G  0 disk
└─sdd1   8:49   0 1000G  0 part /data

parted output:

(parted) print
Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sdb: 4001GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start   End     Size    File system  Name  Flags
 1      1049kB  4001GB  4001GB  ext2
crip659 avatar
pl flag
It sounds like most of the problem is the HDD itself. HDDs making noises are usually never a good sign and being new does not mean that much, besides being able to get your money back. Don't think Windows did much to data as long as you just tried to read it.
HahaMuntz avatar
in flag
@crip659 I wasn't too worried about the noise, since another drive has been running flawlessly for a few years and makes similar noises. I figured those are just normal operational noises. Should hard drives be silent?
crip659 avatar
pl flag
Not dead silent, since they do rotate and have moving parts. Anything more than a quiet hum at a few feet away could be cause for concern.
Score:4
bo flag

The mount problem is that /dev/sdb1/ refers to a directory, not a device.

The correct file path to the device is /dev/sdb1

The error: special device /dev/sdb1/ does not exist (a path prefix is not a directory) says that /dev/sdb1/ is incorrect because you have a trailing forward slash at the end which indicates a path to a directory.

When you run the mount command, use /dev/sdb1 instead of /dev/sdb1/.

HahaMuntz avatar
in flag
It can be so simple. Thank you very much!
mchid avatar
bo flag
@HahaMuntz Awesome. Don't forget to click the checkmark icon to the left to mark this as the accepted solution if this solved your issue.
HahaMuntz avatar
in flag
The main question is sadly still open. I can mount the drives again, but the data is still not recovered and I don't know how to proceed.
mchid avatar
bo flag
@HahaMuntz Are you trying to mount the drive using Ubuntu or Windows? It looks like Ubuntu but I don't want to guess. After you mount the drive it shows no files? What does `lsblk` show? Does `gparted` show any errors or other partitions? If the data is completely deleted, you can still use the `photorec` command from the `testdisk` package to recover deleted files but the files will not be indexed so they will have random strings instead of their original file names.
HahaMuntz avatar
in flag
Thanks for the new ideas. I put the output in the original question, but used `parted`, since it's a headless system. I wouldn't mind losing the filenames, as long as I get the data back. I'm not sure how to do that with `testdisk` though. Edit: And I use Ubuntu
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.