No undelete option on Win10 EFI GPT partition?
Posted: 04 Aug 2019, 19:30
I'm trying to recover some files using Testdisk on a Windows 10 HP laptop that were deleted by a robocopy /mir process. After selecting the partition type, there is no [Undelete] option - see clipped output below. Searching this forum, the only possible clue I found was that undelete is not available for the HFS/HFS+ filesystem (viewtopic.php?f=7&t=6459&p=22195&hilit= ... ion#p22195). Is undelete also not available for EFI GPT partitions or might there be some other reason? My laptop is also part of a corporate network and the disk is encrypted using Bitlocker, but since I'm logged in and can access files normally, I assume Testdisk can also access any files. I've tried a few other recovery softwares (Recuva, EaseUS) and they show many *.tmp files in the directory I'm interested in but not the .doc/xls files that were deleted.
Note no Undelete option above. It is available if I choose the USB disk that I'm running Testdisk from...
Code: Select all
TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA
Disk /dev/sdb - 32 GB / 29 GiB - SanDisk Cruzer Glide
Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA
Please select the partition table type, press Enter when done.
[Intel ] Intel/PC partition
>[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
[Humax ] Humax partition table
[Mac ] Apple partition map (legacy)
[None ] Non partitioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
Hint: EFI GPT partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.
Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA
CHS 31130 255 63 - sector size=512
[ Analyse ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ Quit ] Return to disk selection
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Partition Start End Size in sectors
1 P EFI System 2048 1023999 1021952 [EFI system partition]
2 P MS Reserved 1024000 1286143 262144 [Microsoft reserved partition]
> 3 P MS Data 1286144 495116287 493830144 [Basic data partition]
4 P Windows Recovery Env 495116288 500117503 5001216 [Basic data partition]
[ Type ] >[Image Creation] [ Quit ]