This forum is my last hope for my data to be recovered.
I have a DELL Inspiron 13 7000 laptop for work, property of my job company. It has only one 256 GB SSD.
Some time ago I created a partition (letter (D:)) in orther to have a dedicated location for my personal files, as I wanted to manage them better and independently.
Yesterday I was transferring some files to the main partition (C:) and I realised that it was becoming completely full, so I tried to reallocate some free space from (D:) to (C:) partition.
Unfortunately, I made a silly mistake during the process and formated the complete (D:) partition. After some "blind steps" (but no another format), I made it become a RAW one, exactly like in this video: 2:29 - 2:38 https://www.youtube.com/watch?v=w_JqR-9qcX8
Ignore (G:) disk, it is an external device where I will copy the recovered files.
I tried to follow the program guide and the wiki unsuccessfully, mainly because of my poor computering knowledge...
When I open TestDisk and follow these example steps: https://www.cgsecurity.org/wiki/TestDis ... ble_status, this is what I'm obtaining:
1) EFI GPT partition type; 2) [ Analyse ] to check the partition structure and search for lost partitions....
- Before Quick Search
- After Quick Search
More various images after press [ Continue ]: https://imgur.com/a/Dss9mjx
Here down you can check the .log created by the program after the quick search:
Sat Sep 16 14:48:38 2023
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000207286272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=227622780928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=9554624512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000205189120
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - KBG30ZMS256G NVMe TOSHIBA 256GB, S/N:0008_0D04_0069_ABFA., FW:ADDA0105
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WD My Passport 261B, S/N:190730400189, FW:3005
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - KBG30ZMS256G NVMe TOSHIBA 256GB
Partition table type: EFI GPT
Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=500118191 (expected 500118191)
hdr_lba_start=34
hdr_lba_end=500118158
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 1333248 1595391 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
3 P MS Data 1595392 446171135 444575744 [Basic data partition]
check_part_gpt failed for partition
4 P MS Data 446171136 464832511 18661376 [Basic data partition]
1 P EFI System 2048 1333247 1331200 [EFI system partition]
2 P MS Reserved 1333248 1595391 262144 [Microsoft reserved partition]
3 P MS Data 1595392 446171135 444575744 [Basic data partition]
4 P MS Data 446171136 464832511 18661376 [Basic data partition]
5 P Windows Recovery Env 470384640 472412159 2027520
6 P Windows Recovery Env 472412160 497618943 25206784
7 P Windows Recovery Env 497620992 500117503 2496512
Analyse Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=500118191 (expected 500118191)
hdr_lba_start=34
hdr_lba_end=500118158
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 1333248 1595391 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
3 P MS Data 1595392 446171135 444575744 [Basic data partition]
check_part_gpt failed for partition
4 P MS Data 446171136 464832511 18661376 [Basic data partition]
Current partition structure:
1 P EFI System 2048 1333247 1331200 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 1333248 1595391 262144 [Microsoft reserved partition]
2 P MS Reserved 1333248 1595391 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 1595392 446171135 444575744 [Basic data partition]
3 P MS Data 1595392 446171135 444575744 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
4 P MS Data 446171136 464832511 18661376 [Basic data partition]
4 P MS Data 446171136 464832511 18661376 [Basic data partition]
5 P Windows Recovery Env 470384640 472412159 2027520
6 P Windows Recovery Env 472412160 497618943 25206784
7 P Windows Recovery Env 497620992 500117503 2496512
search_part()
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
FAT32 at 0/32/33
FAT1 : 5606-6898
FAT2 : 6899-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1331199
sectors : 1331200
cluster_size : 8
no_of_cluster : 165376 (2 - 165377)
fat_length 1293 calculated 1293
FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
EFI System 2048 1333247 1331200 [EFI System Partition] [ESP]
FAT32, blocksize=4096, 681 MB / 650 MiB
FAT32 at 82/252/49
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081
set_FAT_info: name from BS used
FAT32 at 82/252/49
FAT: Can't list files, bad cluster size.
MS Data 1333248 5527551 4194304 [NO NAME]
FAT32, blocksize=4096, 2147 MB / 2048 MiB
SYSV4 Marker at 8195/54/62
recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 131656138 303347075017 303215418880 [UÉ>¨9æ]
SysV4, 155 TB / 141 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition
NTFS at 29280/22/55
filesystem size 2027520
sectors_per_cluster 8
mft_lcn 84480
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 468357121 470384640 2027520
NTFS found using backup sector, blocksize=4096, 1038 MB / 990 MiB
NTFS at 29280/22/55
filesystem size 2027520
sectors_per_cluster 8
mft_lcn 84480
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 470384640 472412159 2027520 [WINRETOOLS]
NTFS, blocksize=4096, 1038 MB / 990 MiB
NTFS at 29406/75/46
filesystem size 25206784
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 447205377 472412160 25206784
NTFS found using backup sector, blocksize=4096, 12 GB / 12 GiB
NTFS at 29406/75/46
filesystem size 25206784
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 472412160 497618943 25206784 [Image]
NTFS, blocksize=4096, 12 GB / 12 GiB
NTFS at 30975/120/57
filesystem size 496025600
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1595392 497620991 496025600
NTFS found using backup sector, blocksize=4096, 253 GB / 236 GiB
NTFS at 30975/120/57
filesystem size 496025600
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 497620991 993646590 496025600
NTFS, blocksize=4096, 253 GB / 236 GiB
This partition ends after the disk limits. (start=497620991, size=496025600, end=993646590, disk end=500118192)
NTFS at 30975/120/58
filesystem size 2496512
sectors_per_cluster 8
mft_lcn 104021
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 495124481 497620992 2496512
NTFS found using backup sector, blocksize=4096, 1278 MB / 1219 MiB
NTFS at 30975/120/58
filesystem size 2496512
sectors_per_cluster 8
mft_lcn 104021
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 497620992 500117503 2496512 [DELLSUPPORT]
NTFS, blocksize=4096, 1278 MB / 1219 MiB
file_win32_pread(576,11,buffer,500118186(31130/233/58)) read err: read after end of file
file_win32_pread(576,8,buffer,500118189(31130/233/61)) read err: read after end of file
file_win32_pread(576,14,buffer,500118180(31130/233/52)) read err: read after end of file
file_win32_pread(576,14,buffer,500118181(31130/233/53)) read err: read after end of file
file_win32_pread(576,14,buffer,500118182(31130/233/54)) read err: read after end of file
file_win32_pread(576,14,buffer,500118183(31130/233/55)) read err: read after end of file
file_win32_pread(576,14,buffer,500118184(31130/233/56)) read err: read after end of file
file_win32_pread(576,14,buffer,500118186(31130/233/58)) read err: read after end of file
file_win32_pread(576,14,buffer,500118188(31130/233/60)) read err: read after end of file
file_win32_pread(576,14,buffer,500118190(31130/233/62)) read err: read after end of file
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (256 GB / 238 GiB) seems too small! (< 508 GB / 473 GiB)
The following partition can't be recovered:
MS Data 497620991 993646590 496025600
NTFS, blocksize=4096, 253 GB / 236 GiB
Results
P EFI System 2048 1333247 1331200 [EFI System Partition] [ESP]
FAT32, blocksize=4096, 681 MB / 650 MiB
MS Data 1333248 5527551 4194304 [NO NAME]
FAT32, blocksize=4096, 2147 MB / 2048 MiB
MS Data 1595392 497620991 496025600
NTFS found using backup sector, blocksize=4096, 253 GB / 236 GiB
MS Data 447205377 472412160 25206784
NTFS found using backup sector, blocksize=4096, 12 GB / 12 GiB
MS Data 468357121 470384640 2027520
NTFS found using backup sector, blocksize=4096, 1038 MB / 990 MiB
MS Data 470384640 472412159 2027520 [WINRETOOLS]
NTFS, blocksize=4096, 1038 MB / 990 MiB
MS Data 472412160 497618943 25206784 [Image]
NTFS, blocksize=4096, 12 GB / 12 GiB
MS Data 495124481 497620992 2496512
NTFS found using backup sector, blocksize=4096, 1278 MB / 1219 MiB
MS Data 497620992 500117503 2496512 [DELLSUPPORT]
NTFS, blocksize=4096, 1278 MB / 1219 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
- After Deeper Search
From now on, neither I do know what should I do to properly use the [ Write ] command and recover the partition table, nor continuing and being able to recover the lost files from (D:).
My biggest fear it to apply some wrong changes that not only will break all the possibilities for the recovering, but also lead into more data corrupted...
Here down you can also check the .log created by the program after the deeper search:
XXXXXXXXXXXXXX To be updated
I don't know if the followings links should be also taken into account: https://www.cgsecurity.org/wiki/Undelet ... h_TestDisk; https://www.cgsecurity.org/wiki/Partiti ... nd_logical
I have also used PhotoRec and it doesn't find any files in the image.dd of the (D:) partition.
I greatly appreciate any kind of help.
Thank you so much!!
PS: If the recovery is not possible, I would like to know if there is by chance a method for viewing the lost data and know exactly what I'm losing.