Broken partition table after accidental format

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Alien
Posts: 4
Joined: 02 Jan 2016, 23:51

Broken partition table after accidental format

#1 Post by Alien »

Hello,

I had "one of those days" where I selected the wrong drive in Windows Disk Management and thus accidentally did an "Initialize" and file system quick format of a TrueCrypt encrypted non-system disk.

Context:
4TB non-system drive, full drive encrypted via TrueCrypt (thus Windows says "please initialize") and partition was created via TrueCrypt as NTFS, 4TB, 64kb cluster size.

What I did so far:
I was able to restore the TrueCrypt volume header via the embedded backup. Windows of course cannot "open" the drive letter, because "it's on of those days".
I read many forum posts on TrueCrypt "oops" things. I tried to find information on using WinHEX to force write a new partition table on the disk, but I cannot seem to find this. (I don't even know if one can simply do this even.)
I came across TestDisk and QPhoteRec and data recovery software in general I already have experience with.
After reading up on many forum topics I still didn't manage to find the information I am looking for: How to recover the metadata on my drive.

Where I am now:
TestDisk, I tried initially using NONE, but now via NTFS. It says something about GTP invalid entries and is currently scanning the full drive. I doubt it will find the NTFS-partition at this stage. It did find a "Mac HFS" (via the NONE) which I didn't even know exists, but obviously that isn't mine..
Using QPhotoRec it does manage to find and restore files, however of course all (directory) names are garbled, some files are just plain garbage and apart from all of that: 4TB is a lot of random files..
GetDataBack for NTFS does see an NTFS filesystem, but with nothing on it, so I figure this is the accidentally created filesystem. No luck with it otherwise.

I would really like to know if recovering the previous partition in its previous glory is possible at all. I just couldn't find (all) the numbers on what sectors I broke vs the number of sectors that contain vital metadata.
Can I simply write a new GPT structure knowing that the drive is 4TB, the first 512 bytes is TrueCrypt-header and the rest is/should be (?) partition table and then data?

Thanks!

Locked