1

I dun goof'd.

Up until about an hour a I had a working installation of 14.0 on my 2013 Macbook Air, with full disk encryption as set up in the standard installation process.

But tonight, in the process of of trying to fix a corrupt SD card, I accidentally called "Parted" on /dev/SDA/, and then ran a mklabel on in. Below is a transcript of the damage:

ubuntu@ubuntu:~s sudo parted 
GNU Parted 2.3
Using /dev/sda
welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel
New disk label type? msdos
warning: Partition(s) on /dev/sda are being used.
Ignore/Cancel? I
warning: The existing disk label on /dev/sdb will be destroyed and 
all data on this disk will be lost. Do you went to continue?
Yes/No? y
Error: Partition(s) 1 on /dev/sda have been written, but we have been 
unable to inform the kernel of the change, probably because it/they 
are in use. As a result, the old partition(s) will remain in use. You 
should reboot now before making further changes.
lgnore/cancel? c
(parted)

Lo and behold upon rebooting, I'm greeted with a flashing folder questionmark - which I think is Mac-speak for "I can't find a boot/system partition". I've got a liveboot Ubuntu USB and can get it to start off that, but when I look at the main SSD in disk utility it just sees 250gb of free space.

Yep, I'm a muppet, no argument there. But at least I know when to stop and get help fromthose who know better. I could try out random stuff from Google, but I really do't know quite what Im doing and I dontwant to make this worse. I worry my encryption might complicate things.

Any guidance on how to find out just what damage I've done and how to recover it?

1 Answers1

1

Well, in the end, someone else on another forum DID take a few minutes moment to walk me through Testdisk, have a look at what I got, and explain how to interpret it and what the next step should be.

In the end, it wasn't just a case of "Use Testdisk".

Found this:

http://ubuntuforums.org/showthread.php?t=895224 (oddly enough, no-one helped this guy out either...)

Long story short, even if you nuke your partiton table with mklabel, the data IS stil there, and if you can find out the sectors where the partitions used to be, you CAN put a new partition table in place and it will let you access the data.

So I gave gdisk a go, because apparently it's supposed to be able to restore backup GPT table....except it didn't. No idea why, but despite apparently finding a backup table, restoring it did nothing.

Then by sheer luck I found this:

http://ubuntuforums.org/showthread.php?t=2214497 (also another person who had to "bite the bullet" and go for it without advice...)

Again, summarizing -

Despite what it says (or rather, doesn't say) on its documentation Testdisk for whatever reason can't restore full LUKS partitions. In fact it cant even find them!! But - you can at least use it to get some ideas on what sector the LUKS partition might have started - it at least picks up the LUKS header as a 4096 / 2MB partition.

You can then take the starting sector of this header and make a new partition manually from there to the end sector of the disk (assuming you encrypted all the remaining disk - if you don't know the end sector you're in trouble, testdisk can't find it. But if you get it right and write a new partitions table with those sectors, viola - you have a mountable partition and can recover your data. If you can find the sectors you can restore the EFI and boot partitions too (test disk at least can do this itself, it picks up the FAT and efs2).

However no matter what flags I put on them, it still wouldn't boot.So instead, I dd'd each of these recovered partitions separately onto an external drive, re-installed a a fresh encrypted copy of ubuntu, then dd'd the recovered partitions back into their respective places. The partiton sizes are all identical and it all booted up like nothing had ever changed, even swap worked.

So, what have I learned? Well, if you fry your partition table, even with an encrypted install, the data IS recoverable.

And motorbike forums provide apparently provide more tech help in an afternoon than the actual Ubuntu support sites provide in a month... :/

And folks wonder why people won't use Linux...