How to recover a corrupted Linux partition with TestDisk

Why does Linux fail to recognize your partition?

When you plug a disk into Linux and the system fails to mount the partition, or shows errors regarding invalid tables, the issue often lies in the partition table. The GPT (GUID Partition Table) is the modern standard that stores where each partition begins and ends. If this header is damaged, the operating system becomes 'blind' to the disk's contents, even if your files are perfectly intact.

Instead of trying to brute-force the file system, we use TestDisk. It acts like a detective that scans the disk looking for signatures of previous partitions. If you have ever resolved complex permissions, such as fixing Linux file permissions with chmod and chown, you know that understanding the logical structure is vital. TestDisk works at the hardware layer, ignoring the damaged file system to rebuild the original logical table.

Preparation and Data Safety

Before any intervention, remember: never write new data to the problematic disk. Any writing can overwrite sectors where your lost files might still reside. If the disk is mechanical, watch for strange noises, which would indicate a physical failure. If it is a logical error, the following procedure is safe.

To start, ensure TestDisk is installed on your system. In Debian or Ubuntu-based distributions, use sudo apt install testdisk. Also, having a clear view of what is happening with network and I/O helps to diagnose if there are physical problems, somewhat similar to how we find packet loops with Wireshark, but here the focus is on local storage.

Step-by-Step: Rebuilding the GPT

With the terminal open, let's start the deep scan process on the disk:

1. Run the command sudo testdisk to launch the interface.
2. Select 'Create' to generate a new log file.
3. Choose the correct hard disk from the list provided.
4. Select the partition table type (TestDisk usually detects 'EFI GPT' automatically).
5. Choose 'Analyse' and then 'Quick Search' so the tool scans for deleted or lost partitions.
6. If the partitions appear in the list, select 'Write' to write the new structure to the disk's partition table.

Recovering Files from an Inaccessible Partition

If the partition table is not recoverable, you can still extract your data. Within the TestDisk interface, when listing files, you will see a structure similar to your system. Browse folders using the arrow keys and press 'c' to copy the file or directory to a safe location on another disk.

This is extremely useful when the file system is so damaged that kernel mounting fails. Much like how we use tools to monitor TCP connections on Linux, having direct visibility of your data via TestDisk allows you to recover what is vital without needing to restore the entire disk to its previous state.

Final Considerations

Recovering a corrupted GPT partition table requires patience and caution. TestDisk is a powerful tool, but it does not replace the need for constant backups. Whenever possible, keep copies on different media, as logical corruption can just be a warning sign of an impending physical failure.

After finishing the recovery, ensure you perform an integrity check of the recovered data, especially if they are critical databases or configuration files. Log analysis tools, such as journald, can also provide clues about why the corruption occurred initially, allowing you to prevent future incidents.