No undelete option on Win10 EFI GPT partition?
Posted: 04 Aug 2019, 19:30
I'm trying to recover some files using Testdisk on a Windows 10 HP laptop that were deleted by a robocopy /mir process. After selecting the partition type, there is no [Undelete] option - see clipped output below. Searching this forum, the only possible clue I found was that undelete is not available for the HFS/HFS+ filesystem (viewtopic.php?f=7&t=6459&p=22195&hilit= ... ion#p22195). Is undelete also not available for EFI GPT partitions or might there be some other reason? My laptop is also part of a corporate network and the disk is encrypted using Bitlocker, but since I'm logged in and can access files normally, I assume Testdisk can also access any files. I've tried a few other recovery softwares (Recuva, EaseUS) and they show many *.tmp files in the directory I'm interested in but not the .doc/xls files that were deleted.
Note no Undelete option above. It is available if I choose the USB disk that I'm running Testdisk from...
Code: Select all
TestDisk 7.2-WIP, Data Recovery Utility, July 2019 Christophe GRENIER <firstname.lastname@example.org> https://www.cgsecurity.org Select a media (use Arrow keys, then press Enter): >Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA Disk /dev/sdb - 32 GB / 29 GiB - SanDisk Cruzer Glide Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA Please select the partition table type, press Enter when done. [Intel ] Intel/PC partition >[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...) [Humax ] Humax partition table [Mac ] Apple partition map (legacy) [None ] Non partitioned media [Sun ] Sun Solaris partition [XBox ] XBox partition [Return ] Return to disk selection Hint: EFI GPT partition table type has been detected. Note: Do NOT select 'None' for media with only a single partition. It's very rare for a disk to be 'Non-partitioned'. Disk /dev/sda - 256 GB / 238 GiB - MTFDDAV256TBN-1AR15ABHA CHS 31130 255 63 - sector size=512 [ Analyse ] Analyse current partition structure and search for lost partitions >[ Advanced ] Filesystem Utils [ Geometry ] Change disk geometry [ Options ] Modify options [ Quit ] Return to disk selection Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63 Partition Start End Size in sectors 1 P EFI System 2048 1023999 1021952 [EFI system partition] 2 P MS Reserved 1024000 1286143 262144 [Microsoft reserved partition] > 3 P MS Data 1286144 495116287 493830144 [Basic data partition] 4 P Windows Recovery Env 495116288 500117503 5001216 [Basic data partition] [ Type ] >[Image Creation] [ Quit ]