Did Windows update corrupt a Linux partition?

Question

I have a dual boot system with Linux Mint 18.1 and Windows 10, which I only use occasionally. I booted into Windows 10, and it started applying updates. Upon restarts I was presented with the:

error: no such partition.
Entering rescue mode...
grub restore>

Most of the threads I found suggested going through all the disks found by ls to find the one with boot, and calling ls (hd0,1) or ls (hd0,msdos1) but all of those resulted in unknown filesystem .

I tried using set prefix=(hd0,1)/boot/grub and set root to similar, but when I ran insmod normal I also got unknown filesystem

So I tried using Rescatux, but it wouldn't recognize a number of the drives (no-flags).

So I tried boot-repair from a pendrive, selected the "Recommended repair" and it said it had succeeded, however when I rebooted, it booted straight into Windows.

So I tried following the instructions for running boot-repair from the live Linux installation disk which recommends running gparted, and this is where I'm getting worried. The screenshot seems to indicate that /dev/sda3 which is my Linux partition, has mostly unallocated space. The swap is there, but my partition, which going by the numbers, seems like it should be dev/sda4 is nowhere to be seen.

Can anyone shed any light on this, and tell me how I might be able to bring that partition back?

I've heard that Windows 10 can be "greedy" when running updates, and steal space from other partitions if the updates don't fit on the Windows partition. Could this be what has happened here? Or could Windows have otherwise corrupted those drives?

So my question is whether anything can be done given what you can see in the above.

There are a few related "grub recovery" questions on SO and other forums, but all of them seem to assume the partition is still there.

I want to ascertain whether this is an issue relating to grub/mbr, in which case I can address it in those terms, or if it's beyond that and I should look at partition recovery.

I ran testdisk, and it's telling me the hard disk seems too small. I don't know what to make of that, or understand how that happened.

Answer 1

OK, I think I've come to one resolution, though if anyone has anything to add, feel free!

The part where testdisk lists partitions that can't be recovered is a bit misleading, because you can select through them like menu options, however there is nothing to choose here, you just select continue which provides you with further options, and has no bearing on what entry had focus at the point of hitting enter, so just a quirk in the design of the program.

(This screen answers one part of the question, which is "Can Windows updates corrupt a Linux partition" and the answer to that is sadly YES)

Hit enter continue, you might get another warning about disk size and the geometry being wrong, but I just continued, at which point you get a list of partitions and options:

I decided to use P which prints out the files and dirs, and from those listings you can copy to another location, such as a mounted hard drive.

It shows files that can't be recovered in red, however many of these are actually files that were deleted long ago:

That's not always the case however, and I also found that files marked in red sometimes still copied perfectly, so try before you despair.

Some directories had lots of odd files in them that I didn't recognize, but given the above I can't be sure if these are deleted files showing up, or if those are a result of the file system damage that seems to have happened as a result of the windows update (I suspect the former).

However, some of my files did fail to copy, so there is some data corruption, so it seems I will need to reinstall Linux from scratch. Although this time, without Windows on the same machine, as it just can't be trusted.