*HELP* Whole NTFS disk/partition recovery?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
timtimtim
Posts: 4
Joined: 22 Jul 2015, 11:51

*HELP* Whole NTFS disk/partition recovery?

#1 Post by timtimtim »

Firstly apologies if this is a basic question here or in the wrong sub-forum, i'm new

Last night I did the thing of nightmares. I had physically installed a new 2TB WD disk (WDC WD20EZRX) alongside my existing setup of a 1TB SSD (OS) and a identical 2TB WD disk (WDC WD20EARS).

Disk Manager didn't pick it up so I began to provision the disk using DISKPART in order to format the drive

I was using Windows DISKPART the existing setup looked like this;

Code: Select all

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          931 GB      0 B 
  Disk 1    Online         1863 GB      1863 GB
  Disk 2    Online         1863 GB      0 B
For whatever reason (it was midnight) my stupid head decided that Disk 2 was the new disk. (Disk 2 was not the new disk, but my existing Multimedia drive that was almost full of Media and personal documents pictures etc. from the previous 20 years of my life. Basically everything I have).

I then proceeded to;

Code: Select all

DISKPART> select disk 2
DISKPART> clean
DISKPART> create part pri
DISKPART> select part 1
DISKPART> format fs=ntfs quick
(I did not set to active)

A few seconds later I realised what I had done as I saw my multimedia disk disappear from My Computer. I crapped my pants. :(

Having done this the existing disk shows up in Disk Manager as a healthy partition. I obviously haven't added it into windows. I haven't written to the disk at all since the above f*ck up.

So my question is this; Is it possible to recover this disk as a whole and reinstate it as it previously was, somehow recovering the previous NTFS partition?
I have used the 'analyse' feature of TestDisk and it shows only the newly created partition. I am currently running a Deep Search (which has found an invalid FAT boot sector thus far).

Or will I have to try and recover the files manually using PhotoRec?
Upon starting to do the data recovery the est. time remaining went up to 150hrs+ but it was recovering files (I had nearly 2TB of content).

I really still feel sick at the thought of losing all my content and really hope you guys can help.

Thanks In Advance. Tim

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: *HELP* Whole NTFS disk/partition recovery?

#2 Post by Fiona »

Quick formatting overrides your MFT, boot sector and its backup.
The result would be a freshly formatted empty partition.
Then, you'll need datarecovery software.
If you didn´t create a partition exactly like before, you'd have a chance to get your data back.
Did you complete Deeper Search?
Exactly the last sector of your previous NTFS-Partition contains the backup of the boot sector.
If the backup of your bootsector of your previous partition would be found, testdisk displays the partition for recovery.
You can press p on your keyboard to have a try to list your files.
Please run another diagnose and copy and paste the content of your testdisk.log into your next post.

Fiona

timtimtim
Posts: 4
Joined: 22 Jul 2015, 11:51

Re: *HELP* Whole NTFS disk/partition recovery?

#3 Post by timtimtim »

Thanks for the reply Fiona,

I have just completed the 'deeper search' with the final screen displaying invalid FAT* partitions:
Final screen of the deeper search
Final screen of the deeper search
deepersearch.jpg (56.04 KiB) Viewed 2740 times
Here is the contents of the .log

Code: Select all


Wed Jul 22 11:38:00 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999835041792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=121432064
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 999 GB / 931 GiB - CHS 121556 255 63, sector size=512
Drive D: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive E: - 121 MB / 115 MiB - CHS 28 64 32, sector size=2048

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896
No partition is bootable

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(6,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(6,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(6,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
BAD_RS LBA=2261990189 4565655
check_part_i386 failed for partition type 06
     FAT16 >32M           140802  96 12 244793 235 13 1670624174
This partition ends after the disk limits. (start=2261990189, size=1670624174, end=3932614362, disk end=3907029168)
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2013 GB / 1875 GiB)
The following partition can't be recovered:
     FAT16 >32M           140802  96 12 244793 235 13 1670624174

Results
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896
No partition is bootable

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(6,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(6,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(6,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896
Thanks again. Tim

timtimtim
Posts: 4
Joined: 22 Jul 2015, 11:51

Re: *HELP* Whole NTFS disk/partition recovery?

#4 Post by timtimtim »

Hi Fiona,

What are your thoughts looking at the log?

Please let me know if you need any more detail.

Thanks,
Tim

timtimtim
Posts: 4
Joined: 22 Jul 2015, 11:51

Re: *HELP* Whole NTFS disk/partition recovery?

#5 Post by timtimtim »

If anyone has any suggestions or help regarding the log that would be great. i'm at a loss.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: *HELP* Whole NTFS disk/partition recovery?

#6 Post by Fiona »

Did you complete Deeper Search?
Regarding this message:
Search for partition aborted
If Deeper Search doesn't help, you can try PhotoRec.
Info:
http://www.cgsecurity.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
You can use the menu FileOpt and press s to deselect all file types and only mark those file types, where you'd like to recover.

Fiona

Locked