this post was submitted on 06 Apr 2024
152 points (93.2% liked)

Linux

48182 readers
1221 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
152
submitted 7 months ago* (last edited 7 months ago) by t0mri@lemmy.ml to c/linux@lemmy.ml
 

I was editing my disk and when i wrote the changes and exited cfdisk, no cli command worked. Thats when i realized that im f-ed up.

This what happened: I have 3 partitions, 512M efi, a 100G root partition and some free (unallocated) space. I had 84G worth data in the root patition. I totally forgot that and shrinked the root partition to 32G to extend the free space. I was using cfdisk tool for this. I wrote the changes and rebooted my machine, by long pressing power button coz no cli commands worked after writing those chrnges, to see this.

So is it possible to recover my machine now?

:_ )

SOLUTION Thanks to @dgriffith@aussie.zone. cfdisk just updates the partition table. So no worry about data damage . To fix this, live boot -> resize the partition back its original size -> fsck that partition. For more explanation, refer @dgriffith@aussie.zone comment

top 50 comments
sorted by: hot top controversial new old
[–] vvv@programming.dev 83 points 7 months ago (2 children)

just to add a little more explanation to what the other posters are suggesting.... a hard drive, from the perspective of your OS is very very simple. it's a series of bytes. for the sake of this example, let's say there are 1000 of them. they are just a series of numbers.

how do you tell apart which numbers belong to which partitions? well there's a convention: you decide that the first 10 of those numbers can be a label to indicate where partions start. e.g. your efi starts at #11 and ends at #61. root at starts at #61 and ends at #800. the label doesn't say anything about the bytes after that.

how do you know which bytes in the partions make up files? similar sort of game with a file system within the bounds of that partion - you use some of the data as a label to find the file data. maybe bytes 71-78 indicate that you can find ~/.bash_histor at bytes 732-790.

what happened when you shrunk that root partions, is you changed that label at the beginning. your root partion, it says, now starts at byte #61 and goes to #300. any bytes after that, are fair game for a new partion and filesystem to overwrite.

the point of all this, is that so far all you've done is changed some labels. the bytes that make up your files are still on the disk, but perhaps not findable. however - because every process that writes to the disk will trust those labels, any operation you do to the disk, including mounting it has a chance to overwrite the data that makes up your files.

this means:

  • most of your files are probably recoverable
  • do not boot the operating system on that drive, or any other that will attempt to mount it, because you risk overwring data
  • before you start using any data recovery tools, make a copy of the raw bytes of the disk to a different disk, so that if the tools mess up you have an option to try again

ONLY after that is done, the first thing I'd try is setting that partion label back to what it used to say, 100gb.. if you're lucky, everything will just work. if you aren't, tools like 'photorec' can crawl the raw bytes of the disk and try and output whatever files they find.

good luck!

[–] some_guy@lemmy.sdf.org 19 points 7 months ago

While I appreciate the jokes, this is the only comment I’ll upvote because this was a call for help and this one helps.

[–] t0mri@lemmy.ml 7 points 7 months ago

Yeah i remember now. I have to format the partitions to complete partitioning. Thanks for info

[–] lurch@sh.itjust.works 46 points 7 months ago (2 children)

just restore the backup you made like reasonable people do

[–] melroy@kbin.melroy.org 37 points 7 months ago (1 children)
[–] oo1@kbin.social 27 points 7 months ago (1 children)

Is it that wierd little box thing that you have to take out of your smoke alarm to stop it beeping?

load more comments (1 replies)
[–] brax@sh.itjust.works 4 points 7 months ago

But the backup is on the hard drive. /s (but also not necessarily)

[–] Floshie@lemmy.blahaj.zone 42 points 7 months ago* (last edited 7 months ago) (2 children)
[–] TimeSquirrel@kbin.social 14 points 7 months ago

Dude chill! There may be minors here.

[–] nfsu2@feddit.cl 12 points 7 months ago (1 children)

Pretty much, and do copy the UUID

[–] Prunebutt@slrpnk.net 21 points 7 months ago* (last edited 7 months ago)

and do copy the UUID

Good theing they have a screenshot ;)

[–] zurohki@aussie.zone 32 points 7 months ago* (last edited 7 months ago) (2 children)

If there's something really important on that disk, don't do ANYTHING, just unplug it and hand it over to a data recovery company.

If there isn't anything really important on there, go ahead and try and do it yourself.

Paying $100 to a data recovery company can save you a ton of headaches if it has the only copy of your thesis on there and you mess it up trying to fix things yourself.

[–] steersman2484@sh.itjust.works 18 points 7 months ago (1 children)

If you create an image of the disk in the current state from a live boot or an other machine. You can try fixing it without having to risk making things worse

[–] 7heo@lemmy.ml 11 points 7 months ago

Also, work off of the copy. Never touch the source.

[–] survivalmachine@beehaw.org 6 points 7 months ago (1 children)

Where is data recovery $100? In my country, data recovery is like $1000 USD to look at your drive, and then they tell you how much they can recover and a full quote.

load more comments (1 replies)
[–] ReversalHatchery@beehaw.org 30 points 7 months ago* (last edited 7 months ago) (2 children)

There's something to know in the future, which others don't seem to have mentioned. Resizing a partition is 2 steps: resizing the filesystem, and resizing the partition.

When shrinking, you first resize the filesystem, and with this you make sure that the filesystem does not want to use data outside of the wanted shrinked size. If that not possible because you don't have enough free space, the shrink operation should tell that. After shrinking is done, you can continue with changing the partition table, to actually resize the partition.

When expanding you first expand the partition (so that the fs will have room to expand to), and then expand the filesystem.

If you're familiar with partitioning from the tools of microsoft windows, it's disk manager does the 2 steps without you noticing. This is just how most graphical partition managers work.
But it's important to be aware that the partition and the filesystem is not one and the same object. The filesystem resides in the partition like your feet does in your shoes, and the beginning of the partition helps for the system to find the beginning of the file system, which must end at the partition's end (or before that, but that's not efficient).

If you prefer graphical partition managers (I do too, it's much easier), Linux has a few of them. I recommend you to use GParted. It's a Linux based pendrive-bootable partition editor. They have an official live image, but I would recommend using the SystemRescue system (a live system too), which includes that and many other tools.
In this case, that the problem had already happened, it may or may not be easier to use this.

[–] Cyber@feddit.uk 3 points 7 months ago

Excellent explanation - I might use your "feet in shoes" analogy in the future

GParted has solved so many things over the years... my data, my reputation... maybe even my job on 1 occasion.

[–] teawrecks@sopuli.xyz 3 points 7 months ago

Instructions unclear, toes sticking out front of shoes.

[–] ryannathans@aussie.zone 16 points 7 months ago (3 children)

Simply change the partition size back to exactly what it was before. Larger might be acceptable too, not sure

[–] 7heo@lemmy.ml 3 points 7 months ago (1 children)

Larger might be acceptable too, not sure

It should.

load more comments (1 replies)
[–] bizdelnick@lemmy.ml 3 points 7 months ago (1 children)

That's correct answer. If you did not write anything in the space you freed (i.e. did not create a partition there AND format it), your data is not damaged.

load more comments (1 replies)
[–] t0mri@lemmy.ml 3 points 7 months ago (1 children)
[–] ryannathans@aussie.zone 2 points 7 months ago

Solid work, now set up backups haha

[–] toni_bmw@lemmy.world 10 points 7 months ago* (last edited 7 months ago) (1 children)

I always love working with partitions because of the knowledge it gives you, but it is also certainly dangerous and from time to time it is unnevitable to suffer an accident. In any case I always try to do this type of operations with parted and if possible with GUI (gparted).

Being in the photo situation, can't you make a fsck as the error messages tell you?

fsck /dev/nvme0n1p2

If not, the most practical would be, IMHO, to boot from a rescue live, e.g. https://www.system-rescue.org/Download/ Once booted, you can lift the graphical interface with startx and do with gparted the operations you need on these partitions.

[–] t0mri@lemmy.ml 9 points 7 months ago (2 children)

For sure.

For fsck /dev/nvme0n1p2:

[–] dgriffith@aussie.zone 30 points 7 months ago* (last edited 7 months ago) (1 children)

The filesystem driver knows the size of the filesystem is larger than the physical size of the partition it is on. Because of that it refuses to do anything with it until that discrepancy is sorted.

Boot to a USB/ISO, run cfdisk, extend the partition size back to original or larger, then run fsck on the partition again.

[–] t0mri@lemmy.ml 26 points 7 months ago* (last edited 7 months ago) (4 children)

😭😭😭🤧 THANKS!!

im saved. My machines saved. Thanks a lot!!

Whrt happened anyway? Why cfdisk didnt wipe the data? I thought it would everything after 32g, but all my data is un touched. What happened?

[–] dgriffith@aussie.zone 16 points 7 months ago (1 children)

The partition table is just a set of pointers to various places on the physical disk where partitions should be, inside those partitions are filesystems with all your data. It's like the table of contents in a book. You can mess around with the table of contents and make the page numbers for chapters different, but all the words in the book are still there.

Now you're lucky that filesystem drivers are fairly smart these days. They sanity check things all the time. When you write the partition table to disk all the active filesystem drivers get notified of the changes, so they can keep track of things. When the driver noticed that the size of your filesystem exceeded the size of your partition, it basically was like "Hold it right there, I'm not touching any of this!". At that point the filesystem would have been forcibly unmounted and disconnected, which is why none of your commands worked after running cfdisk, they were on that filesystem.

Note that your approach was almost the right way to do it. To make your filesystem bigger you can expand the partition using cfdisk ( as long as there is physical room on the disk!) and then run a program called resize2fs , and it will expand the filesystem to suit.

Similarly, you can shrink the filesystem in the same kind of way, except you run resize2fs first and command it to shrink the filesystem to a particular size. It will do that (assuming there's enough free space in your filesystem to do so) then you shrink the corresponding partition with cfdisk to match.

Of course, as you've learned, resizing partitions is moderately risky so backups are a good idea. Having said that I routinely expand filesystems in VMs like this without backups - I make the VMs disk larger in its settings, then run cfdisk and expand the partition, then run resize2fs.

[–] t0mri@lemmy.ml 2 points 7 months ago

I sincerely appreciate your consideration to help and explain

Its funny that i tried resize partitions without knowing how to do that. I thought i should format new partitions after editing partition table coz thats what i did when installing linux, but im wrong again ig.

[–] kolorafa@lemmy.world 9 points 7 months ago

cfdisk only changes the partition table, this table like a small paper that you store at the front (or back) of drive where you put information, it's just a list of coordinates like from this point to this point is your home, from this to this is your yard, from this to this is your neighbor. Just because you changed the values on your paper doesn't actually make your neighbor closer or further.

System read this list to figure out where are the "borders" between different sections that you defined to load and use them logically for multiple file systems.

[–] onlinepersona@programming.dev 7 points 7 months ago

we would all like to thank @dgriffith@aussie.zone for his amazing, non-meme contribution 👏

Anti Commercial AI thingyCC BY-NC-SA 4.0

[–] toni_bmw@lemmy.world 5 points 7 months ago

It's a marvellous feeling, right?

We thank Dave for his decisive contribution. For future occasions try to backup everything before doing operations of this type. This small script works very well for me:

https://github.com/cleverwise/cya

That allows you to backup even hot systems. Just mount an external disc in /home/cya and run the script with sudo...

[–] toni_bmw@lemmy.world 3 points 7 months ago* (last edited 7 months ago)

The existing file system appears to have been damaged possibly because cfdisk has not adjusted (shrinked) the existing file system before changing the partition settings. In my case, this kind of thing I only dare to do with gparted if partitions contain file systems with data.

I would try the second option I mentioned above, as my last chance: to start a live-rescue and look that allows us to gparted, but I am not very optimistic about it

[–] lemmyreader@lemmy.ml 10 points 7 months ago (3 children)
[–] tester1121@lemmy.world 3 points 7 months ago

This has saved so many files from my mistakes before.

[–] IHawkMike@beehaw.org 3 points 7 months ago

That was going to be my suggestion as well. Testdisk should be able to fix this easily.

load more comments (1 replies)
[–] hperrin@lemmy.world 6 points 7 months ago

The most important thing you should do is never boot into that disk again until you have made a full backup image of it.

[–] SitD@feddit.de 6 points 7 months ago (1 children)

pff No one noticed it's just a weirdflex 😔 this dude's got a cool garden

[–] t0mri@lemmy.ml 2 points 7 months ago
[–] 30p87@feddit.de 6 points 7 months ago (2 children)

Live boot and, if possible back up everything first. Everything as in the whole disk. So ``` dd if=/dev/nvme0n1 of=backup-disk

[–] t0mri@lemmy.ml 3 points 7 months ago (2 children)

I dont think doing back up is possible. Coz i shrinked a 100g partition into 32g which had 84g of data. Is it possible?

[–] MartianSands@sh.itjust.works 6 points 7 months ago (1 children)

What they're suggesting is to back up the whole disk, rather than any single partition. Anything you do to the partition to try and recover it has the potential to make a rescuable situation hopeless. If you have a copy of the exact state of every single bit on the drive, then you can try and fix it safe in the knowledge that you can always get back to exactly where you are now if you make it worse

[–] MartianSands@sh.itjust.works 3 points 7 months ago

Also, it's probably possible to fix the partition so that it's as big as it used to be. It's likely that some of your data is corrupted already, but the repartitioning won't have erased the old data except here or there where it's written things like new file tables in space it now considers unused

[–] colournoun@beehaw.org 4 points 7 months ago* (last edited 7 months ago)

Yes a back up is possible. Don’t back up partitions, back up the whole device. All 150+g at once.

Whenever you try to mount the device or the filesystems, make sure to mount it read-only so that no changes are written to the device.

Also, shrinking 84g of data into 32g is definitely not possible. Just changing the fdisk partition table doesn’t shrink or relocate the data. You need a filesystem-aware resizing tool to shrink the filesystem before shrinking the partition.

Hopefully you can just change the partition table back to the original values and get a clean fsck.

load more comments (1 replies)
load more comments
view more: next ›