How to Recover a Deleted or Missing Partition


So you've deleted a partition (C: D: in Windows) by mistake or made a completely new partition table and the partitions are gone.

This guide is going to help you recover these partitions. It's very easy to recover everything in this case. You'll have to use Linux for this guide. No worries though, it will tell you exactly what you need to do.
Let's get started!

Making an Ubuntu Live USB

Download Ubuntu, a linux based OS.

If you have a 64bit PC, you'll want to use this link http://releases.ubuntu.com/16.04.4/ubuntu-16.04.4-desktop-amd64.iso

If you have a 32bit PC, you'll want to use this link http://releases.ubuntu.com/16.04.4/ubuntu-16.04.4-desktop-i386.iso

If you don't know if your PC is 32bit or 64bit, downloading the 32bit will work on both.

After downloading the file, head on over to https://www.linuxliveusb.com/en/download and install Linux Live USB Creator. Follow the instructions on how to make a Live USB.

If you're using mac osx click on https://tutorials.ubuntu.com/tutorial/tutorial-create-a-usb-stick-on-macos#0

Starting the Live USB

Plug the Live USB into the PC and then turn it on.
If you aren't greeted with an Ubuntu screen showing "Try Ubuntu" or "Install Ubuntu" click on Troubleshooting Starting a Live USB.

Choose "Try Ubuntu" you should get a desktop after a few mins.
If you're stuck at a black screen, click on Black Screen After Starting a Live USB.

After the desktop has loaded press Ctrl + Alt + T to open a terminal.
You should see a command prompt such as ubuntu@ubuntu:~$

Assessing the situation

Type sudo parted -ls

You should get a list of the disks and partitions
ubuntu@ubuntu:~$ sudo parted -ls
Model: ATA HGST HTS541010A9 (scsi) <---- Disk name
Disk /dev/sda: 1000GB <---- Disk name as known to linux with size
Sector size (logical/physical): 512B/4096B
Partition Table: gpt <---- Partition table type (gpt or msdos)
Disk Flags: 
Number  Start   End     Size    File system     Name                  Flags
 1      1049kB  316MB   315MB   fat16           EFI Partition         boot, esp
 4      316MB   9979MB  9664MB  linux-swap(v1)
 5      9979MB  16.8GB  6784MB  ext4
 2      16.8GB  896GB   880GB   ntfs            Microsoft basic data  msftdata
 3      896GB   1000GB  104GB   ext4

Model: Seagate BUP Slim BK (scsi)
Disk /dev/sdb: 2000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags: 
Number  Start   End     Size    Type     File system  Flags
 1      1049kB  2000GB  2000GB  primary  ntfs         boot
It's a good idea to make a copy of the disk if it's your first time doing anything like this.
Click on Making a Copy of a Disk to read about that.

If you're greeted with something like this on the other hand
Model: ATA HGST HTS541010A9 (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt
Disk Flags: 
Number  Start   End     Size    File system     Name                  Flags


This means that the partition table is empty, a new partition table was probably made.
The data and filesystems that hold the data are all still there.
If you know you had only one partition, such as a data HDD is, then click here on How to Recover a Single Partition and nevermind the rest of this page.
If you had numerous partitions such as on an operating system HDD, then click here on How to Recover a Partition Table and nevermind the rest of this page.

The idea here is that the disk has a partition table at the start of it.
That table points to where the partitions are located and that's what we're seeing above.
The partitions have a filesystem. The filesystem is very important, it's what keeps record of where the files are on the disk, and how much free space is left, and such.

When a partition is deleted, all what's really happened is that in the partition table, the line that points to where the partition is on the disk has been removed.

So the filesystem is still there on the disk, and all the files are intact, it's just that we don't know where the filesystem starts, so we can let the operating system mount it and access the files.

Attempting to Mount the Missing Partition

Linux sees the disks as /dev/sda /dev/sdb /dev/sdc etc. the partitions' numbers are under the left-most column "Number".
/dev/sda1 refers to disk sda and the 1st partition, /dev/sdb4 refers to disk sdb and the 4th partition, and so forth.
You'll be using these in the commands below, replace your disk name instead of /dev/sda if it's different.

From the above output, the disk name is /dev/sda
To get a more accurate location of the partitions in bytes, type sudo parted /dev/sda unit b print
You'll see something similar to this
Number  Start          End             Size           File system     Name                  Flags
 1      1048576B       315621375B      314572800B     fat16           EFI Partition         boot, esp
 4      315621376B     9979297791B     9663676416B    linux-swap(v1)
 5      9979297792B    16763584511B    6784286720B    ext4
 2      16763584512B   896394067967B   879630483456B  ntfs            Microsoft basic data  msftdata
 3      896394067968B  1000204869119B  103810801152B  ext4
After partition 2 has been deleted, it'll look like this
Model: ATA HGST HTS541010A9 (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: gpt
Disk Flags: 
Number  Start          End             Size           File system     Name                  Flags
 1      1048576B       315621375B      314572800B     fat16           EFI Partition         boot, esp
 4      315621376B     9979297791B     9663676416B    linux-swap(v1)
 5      9979297792B    16763584511B    6784286720B    ext4
 3      896394067968B  1000204869119B  103810801152B  ext4
As you can see above, the partition that started at 16763584512B and ends at 896394067967B has been deleted.
The idea here is that you need to follow the Start and End bytes to see any missing space, and that's where the deleted partition is likely to be.
In order to mount the filesystem, we can manually point the operating system to it.
We'll need the location of where the partition used to be, since the free space is after partition 5's end at 16763584511B we'll take that and try to mount the next byte, so 16763584512
Try to do the same for your partition table if you find free space and use that
(If it isn't very obvious where the partition was, or you have multiple partitions deleted then click here on Recovering Partitions in Unknown Locations and nevermind the rest of this page).

Type sudo mount -o offset=16763584512 /dev/sda /mnt

If no error or output happens, it means it mounted successfully.

Then type ls /mnt
If a bunch of files are listed then type sudo nautilus /mnt to browse them. If you have another hard disk attached and you want to copy something important you can do so by selecting it there and browsing to it to paste them.

Restoring the Partition

In order to restore the partition in the partition table,
unmount the partition by typing sudo umount /mnt (note the lack of n in umount)

Then from the output of "sudo parted -ls" take note if the partition table type is gpt or msdos.
If it's gpt type sudo cgdisk /dev/sda

If it's msdos type sudo cfdisk /dev/sda

You should be greeted by a friendly interface, go to the free space and press new and create a partition there using the defaults for the questions, and write the new partition table to disk.
Then type sudo partprobe
You should now be able to mount the new partition.
Type sudo parted -ls
It should appear in the table now

Number  Start   End     Size    File system     Name                  Flags
 1      1049kB  316MB   315MB   fat16           EFI Partition         boot, esp
 4      316MB   9979MB  9664MB  linux-swap(v1)
 5      9979MB  16.8GB  6784MB  ext4
 2      16.8GB  896GB   880GB   ntfs            Microsoft basic data  msftdata
 3      896GB   1000GB  104GB   ext4
The partition number is 2 from above
type sudo mount /dev/sda2 /mnt to mount the partition.


Related topics
Partition table, Partitions, Filesystem, Live USB, Ubuntu