Storage partition was overwritten

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
tinyhead
Posts: 2
Joined: 05 Apr 2015, 03:07

Storage partition was overwritten

#1 Post by tinyhead »

Hello all!

Here is my current setup/predicament:

I have a 120GB SSD with 2 partitions. One with windows 7 and one with Ubuntu. I also have 4 x 3TB drives in a RAID 5 configuration to make one large storage array. Single partition.

I wanted to try Windows 8.1 and decided I'd install it on the Ubuntu partition. I created a bootable USB to install it and let it load up. The setup failed after a few minutes stating that there was no appropriate partition available (it was the very beginning of the install, where it states that it's going to copy files. Never left 0%). Not a big concern. Booted back into Windows 7. That's where I noticed it...

The install - for whatever reason - decided that my RAID array was where it wanted to try and install windows. It repartitioned my ~8.5TB drive into 3 partitions. I now have the standard windows 100MB partition, a 2TB 'OS' partition (empty) and the remainder is now unallocated. I'm LOST. I've gone into TestDisk and it shows a 100MB partition, the 2TB and then it shows a 735GB partition (I don't understand the 735GB part... if it was the other 6TB, that would make sense to me). I'm not sure where to go at this point, or what to do in order to get my data back. I tried to list the files in the 735GB partition and it didn't come up with any. I don't want to use photorec unless absolutely necessary. There'd be WAY too many files to sift through.

I haven't done a 'deeper' scan as I'm fairly certain that will take a few days due to the size. Are there any steps I should be doing, or anything I can do to 'revert' the partitions the way they were? I've gone through the step-by-step instructions, but I feel like that's for cut and dry missing or deleted partitions. Not necessarily one that's been overwritten.

If someone could offer a hand, it would be greatly appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Storage partition was overwritten

#2 Post by cgrenier »

Using TestDisk 7.0-WIP, select the Raid array, choose Analyse, Quick Search, Stop, Deeper Search, Stop.
If you are lucky, TestDisk will find the NTFS backup boot sector (assuming the Raid filesystem was NTFS) and you will be able to rewrite the partition table and restore the boot sector.

tinyhead
Posts: 2
Joined: 05 Apr 2015, 03:07

Re: Storage partition was overwritten

#3 Post by tinyhead »

Thanks for the quick reply!

Ok. I did what you said. It now gives me four partitions, all marked deleted. The 100MB, a 3TB, a 2TB and my full ~8.5TB. I set the 8.5TB to P (primary) and left the others marked deleted. Saved the table and rebooted.

Upon boot, it says the drive needs to be formatted. I said 'No'. When I run testdisk again and Analyse, it gives me:

Error: size boot_sector 401448960 > partition 4294967295
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 16 133 34 267365 202 36 4294967295
1 P HPFS - NTFS 16 133 34 267365 202 36 4294967295
No partition is bootable

I went back through advanced to try and restore the boot sector and I get:

Boot sector
Error: size boot_sector 401448960 > partition 4294967295
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

I tried Rebuild BS then List, but it was unable to show the filesystem, so I didn't write. If I don't go to Boot and hit List, I'm able to see all my files. I'm so close, I just don't know how to cross the finish line.

Thanks again for the reply!

Locked