cgsecurity.org

Hi - I had a USB drive with a bunch of data on it. The external enclosure failed, so I borrowed a USB > IDE adapter and plugged it in. The drive came up inactive and RAW. Obviously at this time I know the best thing to do at this point would have been to grab a copy of the disk before doing anything else (with dd for example).

Instead, I initialized the disk and threw a new partition on there so I could use Recuva to try to gather the data. Obviously that was a mistake. Photorec did a better job and I recovered much of the data.

I´d stil like to get the partition back if possible, though. That brought me to testdisk. I see the following error when running a deeper scan. I´m really interested in finding out if that HPFS - NTFS parition it lists is what I´m after. Any advice would be GREATLY appreciated:

---------------------------------------------------------------------
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /media/nabk/FreeAgent Drive/old.dd - 250 GB / 232 GiB - CHS 30402 255 63

The harddisk (250 GB / 232 GiB) seems too small! (< 2750 GB / 2561 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 99210 82 38 130994 123 22 510612528
FAT32 LBA 243107 18 39 334344 148 42 1465730599

[ Continue ]
261 GB / 243 GiB
---------------------------------------------------------------------

I have a problem that looks similar.

I connected a new disk (SSD, 128 GB), and when looking at the list of devices, I noticed drive H: of which, when clicked, the system (Win 8.1) said that it had to be formatted in order to be used, so I did a quick format. At that point, I realized that my external 500 GB backup disk was not listed among the drives. It used to be listed with a red bar, because it is almost full (The other disks I have in the system have a green bar, and indicate they're about half-full.

Turns out that somehow, the system mixed up the 500 GB drive and the new 128 GB SSD, and formatted the 500 GB drive, which now has a 127 GB partition on it...

TestDisk indicates that the drive seems to small (which isn't the case) but the numbers are not correct, so I guess what's happened with this disk (quick format on only part of the disk, I guess) leads to wrong conclusions. I wonder if there's a way TestDisk can be helpful to recover the data. Could it be that to restore the data on this disk, first the incorrect quick format should be undone (to set/get the original size of the disk correctly), and that only then the original index could be recreated?

In addition, I think the disk was formatted using FAT-32 (it is quite old Could it also be that the quick format (NTFS) has partly overwritten the

Before I found TestDisk, I tried other recovery tools and one seemed to find the old data (but would only restore 1 GB for free). It also turned out that it required a different disk to write the data too, where I was expecting the disk's index to 'just' be restored, and the laptop I ran this tool didn't have space for the restore.

Windows isn't very clear either, stating that it's 500 GB, but also that it is 127 GB.

Cheers, Richard.

Please go on next screen to see the results that TestDisk considers correct. A valid 500 Gb NTFS partition should be listed.