I booted my Qubes system from a live USB to install a different distro on an external drive. I thought I was certain the external drive was selected but alas it wasn’t. I chose create partition table from the GParted menu. Realized my mistake instantly and did not apply anything. Terrified, I hard reset the computer expecting to be greeted by a familiar screen. Instead, my computer was searching for a network to boot from.
In GParted, booted from a flash drive once again, I can see the EFI partition and subsequent 1GB ext4 partition with the lvm flag. The remaining 236.89GB of space is “unallocated.” I didn’t write anything over the data so it’s still there, somewhere.
Can this be recovered? I’m currently running GParted’s attempt data rescue command (or similar, I forget exactly). Searching for file systems is all I see and an activity bar. I’ve never used GParted for this so I’m not sure.
There is a backup, even if it is a couple of weeks old. More good news there. I partitioned that disk, though did not write anything to where the backup is/was. R-Studio’s demo sees it so I’m guessing that is recoverable too.
I guess I’m asking what a wiser Qubes user than myself would do here. I’m of course goijng to let the GParted tool finish. TestDisk is showing: LUKS 2 (Data size unknown), 272 GB / 254 GiB but it’s also showing that partition under The following partitions can’t be recovered so that doesn’t seem to be an option.
I desperately want to figure this one out. Would anyone be willing to point me in the correct direction? Thank you so much for any suggestions/assistance!
Unfortunately the partition table is often a direct operation that does not have an apply button “later”.
I learned that one the hard way evidently.
I think, if I mess with TestDisk long enough, I can get to that backup file that R-Studio is finding but won’t let me copy without a license.
As an expert of making mistakes, may I recommend:
if you have the time, and some large backup storage, to use your rescue boot system to make a backup copy of the whole device, in an image file on external storage disk?
If you identify the device, then you can use dd …only this time the source and destination must definitely be correct.
That way, you can have another try, if gparted makes a mistake, or does not work.
Second, do you remember how you installed qubes on that disk? What version installer, and what partitioning options? If it was default/automatic, then the disk layout is probably simple.
I really appreciate the suggestion. I actually grabbed another TB external SSD in preparation to test it.
I decided to give R-Studio’s free software, R-Linux, a go. It pulled the Qubes backup file from the missing partition that hadn’t been written to. Copied it to a flash drive. Not wanting to overwrite the broken Qubes on the internal NVME in case this didn’t work, I used an external disk that I have to run various distros and installed latest Qubes on a partition. Once installed and running, I copied the backup file, chose appropriate options per the Backup and Restore article here and… I found the the three vital Qubes ready for restore. Restored. KeePassXC data was there as expected. My heart sank for a moment until I remembered that I manually installed Kleopatra. The data was there, just not the application. One DNF command later and I’m viewing my certificates.
My takeaways, for anyone who finds this post, is be very careful with GParted. That was insane. ALWAYS make a backup. Try not to get into a position where you need to recover your backup. And, at least for now, R-Linux is a great free tool for recovering files.
Thank you for taking the time!
If it’s just the partition table, then run testdisk, do the scan, then write the partition table back.
If the partition table goes wrong, then you can just scan the disk and recover everything anyway.
take a few moments to do the initial write the partitions back, but the scan may take a little longer.
With GParted, you have to click APPLY before it will apply the changes.
So GPARTED would not be the issue.
If you were using PARTED, then that is different.
If you were using FDISK, that is different again as you have to do a (w)rite to apply the changes.