Sillily deleted partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
scott14521345
Posts: 1
Joined: 24 Aug 2020, 20:04

Sillily deleted partitions

#1 Post by scott14521345 »

Hi there,

I installed a new drive, and was changing the drive letters to match what I was used to.
I noticed my 2 TB HHD had a windows recovery partition from my previous install, I went to remove it and expand the partition on this HDD, and I somehow failed.

The entire drive is marked as RAW in disk management.
I am 90% certain it was an NTFS drive.

When I run testdisk, it finds the partition, but tells me The harddisk (2000 GB / 1863 GiB) seems too small! (< 2000 GB / 1863 GiB) and that it thus can't be recovered.

See log below:

Code: Select all



Mon Aug 24 20:23:23 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, August 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=16170196480
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=16170196480
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999610183168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=499608354816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=16169041920
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM006-2DM164, S/N:Z4Z7W340, FW:CC26
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 850 EVO 500GB, S/N:S2RBNX0HA47506X, FW:EMT02B6Q
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 860 EVO 500GB, S/N:S3Z2NB1K778095P, FW:RVT01B6Q
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 970 EVO 1TB, S/N:0025_3854_0141_5FCF., FW:2B2QEXE7
Disk /dev/sde - 16 GB / 15 GiB - CHS 1965 255 63, sector size=512, S/N:0912241409377a, FW:0.00
Drive H: - 16 GB / 15 GiB - CHS 1965 255 63, sector size=512, S/N:0912241409377a, FW:0.00

Partition table type (auto): Intel
Disk /dev/sda - 2000 GB / 1863 GiB - ST2000DM006-2DM164
Partition table type: Intel

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 * FAT16 >32M               0  32 33 243201  45 44 3907024896
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
 1 * FAT16 >32M               0  32 33 243201  45 44 3907024896
 1 * FAT16 >32M               0  32 33 243201  45 44 3907024896

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 70/29/24
filesystem size           3907020800
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             70  29 24 243270 232 34 3907020800 [Bulk Storage]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=1126400, size=3907020800, end=3908147199, disk end=3907029168)
file_pread(4,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     HPFS - NTFS             70  29 24 243270 232 34 3907020800 [Bulk Storage]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.



Any help would be very much appreciated.

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Sillily deleted partitions

#2 Post by recuperation »

Did you stop with the simple analysis or did you run deep search?
Your logfile seems so short.

Locked