(solved) Accidentally "formatted" running drive using Fat32Formatter

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
krs7
Posts: 7
Joined: 15 Mar 2016, 20:57

(solved) Accidentally "formatted" running drive using Fat32Formatter

#1 Post by krs7 »

Hello everyone!


I know someone posted a very similar case some years ago but I still haven't found a solution - so I opened the topic.

I currently have the folowing problem and I hope someone could help me:

I wanted to format a microSD card using Fat32Formatter.

Accidentaly - the wrong drive was selected (my running SSD Drive with Windows) and after i clicked "initialize drive" the Laptop crashed: Bluescreen etc.

Restarting the PC doesn't help - no drive is found.

In my experience "initializing drive" doesn' format it, but it makes the drive space "unallocated"

Someone posted in another Forum that he managed to get his system back running with testdisk after the same problem so here I am.

Assuming I just have to create a partition Table, I created a bootable USB.

Testdisk doesn't find any recoverable partitions in the quick search, but in the Deeper search.
I actually have only one partition and testdisk is finding more that one and I am not sure which one to select.

so I just tryied it :writing the partition table. I tryied this procedure a couple of times but now I get annother error:

I don't get the error 'no drive found "
when starting, the Windows Bluescreen is reporting that windows needs to be repaired and I would need to insert the Windows CD/USB in order to start the Windows repair process.

So - before I make any more damaged I figured maybe someone can give me some usefull advice: maybe which partition to select or if it would be OK to start the Windows Repair process.

Also: Just started Gparted.
at first Gparted showed the hole ssd-drive als unallocated( 240gb)
an now I get:
/dev/sda1/-------------NTFS-------------System------------1,46GB------------boot
/dev/sda2/-------------NTFS-------------tI3136300B-------211.66GB----------no flag
unallocated-------------unallocated--------------------------10.44GB

I was using Windows 10 Pro 64 bit (didn't even write down the windowskey after the update from windows7)
I am using testdisk with the Gparted Live Bootable USB

I will post some shots so you can maybe unterstand the problem better. (I can't find he log file )

i'm very grateful if you could help. thanks in advance.
Last edited by krs7 on 23 Apr 2016, 16:11, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Accidentally "formatted" running drive using Fat32Format

#2 Post by cgrenier »

Run TestDisk, Advanced, for each partition, try Boot, RebuildBS, List. If you can see your files, choose Write and confirm.

You probably also have to use "bootrec /fixmbr" and "bootrec /fixboot" as described in
http://www.cgsecurity.org/wiki/TestDisk ... able_again


krs7
Posts: 7
Joined: 15 Mar 2016, 20:57

Re: Accidentally "formatted" running drive using Fat32Format

#4 Post by krs7 »

Hi!

So I've tryied to follow the instructions.

Boot- rebuild BS - List

after the rebuild BS I get the followings message for both partitions:

Boot Sector OK
Backup boot sector: OK
Sectors are identical

Under List I can see the files.

after that, you posted "f you can see your files, choose Write and confirm."

so know I have 2 quiestions:

1. after "List" I can't seem to find the write and confirm option.

in which submenue should I look for it?

or do you mean analyze > quick/deep search and write partition table !?

2. I would have to run "bootrec /fixmbr" and "bootrec /fixboot" from the recovery console.

to get to the recovery console I would have to use a Windows 10 Boot-USB, right ?


Thanks again.

krs7
Posts: 7
Joined: 15 Mar 2016, 20:57

Re: Accidentally "formatted" running drive using Fat32Format

#5 Post by krs7 »

Hey you guys,

I still didn't manage to get any further, would really appreciate it if someone can help me out!

thanks!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Accidentally "formatted" running drive using Fat32Format

#6 Post by cgrenier »

After RebuildBS, List. If you see your files, use Quit to return to RebuildBS results, here you can choose Write.

Copy/paste the testdisk.log file content if you need more help with a description about the actual problem (it may have evolve since your first post).

krs7
Posts: 7
Joined: 15 Mar 2016, 20:57

Re: Accidentally "formatted" running drive using Fat32Format

#7 Post by krs7 »

Hi!

I've tryied these options but : if I go back once, I only have the options "dump" "list" and "quit"
if I go back with quit a second time I get "Quit" "List" "rebuild BS" "repair mft" "dump" so no "write" option.

the only write option is after "analyse" and "deeper Search"

I am using testdisk 7.0 2015 from Gparted live disk, and from this interface I can't acces the testdisk Folder to get the log file. Should I try another boot Medium??

krs7
Posts: 7
Joined: 15 Mar 2016, 20:57

Re: Accidentally "formatted" running drive using Fat32Format

#8 Post by krs7 »

Hello again, I just did not find to the existing log file (I have been using Gparted Live from a boot USB)
So i ran testdisk from the ultimate boot cd (testdisk version 6.9)

Here I could find pretty quick the log file
From ultimate boot cd i Just ran "analyse" , "deeper Searche" and "rebuild BS" for both partitions and "list" - after that "quit" - beaucse here I also had the "write" option only after the analysis and deeper search, not after the rebuild

anyway, here is the log, hope you can see something that helps
thanks



Sat Apr 2 13:59:14 2016
Command line: TestDisk

TestDisk 6.11-WIP, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.27.7-pmagic (#1 SMP Sat Nov 22 23:11:04 CST 2008)
Compiler: GCC 4.2 - Aug 8 2008 19:10:51
ext2fs lib: 1.41.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 0 1 1, sector size=512
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - ATA KINGSTON SV300S3
Disk /dev/sr0 - 3895 MB / 3715 MiB - CHS 1902208 1 1 (RO), sector size=2048 - MATSHITA DVD-RAM UJ8E2

Partition table type (auto): Intel
Disk /dev/sda - 240 GB / 223 GiB - ATA KINGSTON SV300S3
Partition table type: Intel

Analyse Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 191/89/27
Current partition structure:
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
2 P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
Computes LBA from CHS for Disk /dev/sda - 240 GB / 223 GiB - CHS 29186 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29186 255 63
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
NTFS at 191/89/27
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
NTFS at 27822/19/38
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 27822 19 38 27879 113 10 921600
NTFS, 471 MB / 450 MiB
NTFS at 27879/113/11
filesystem size 20977657
sectors_per_cluster 8
mft_lcn 765836
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 27879 113 11 29185 61 53 20977657 [HDDRECOVERY]
NTFS, 10 GB / 10 GiB

Results
D HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
D HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
D HPFS - NTFS 27822 19 38 27879 113 10 921600
NTFS, 471 MB / 450 MiB
D HPFS - NTFS 27879 113 11 29185 61 53 20977657 [HDDRECOVERY]
NTFS, 10 GB / 10 GiB

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29186 255 63
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
NTFS at 191/89/26
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS found using backup sector!, 1572 MB / 1500 MiB
NTFS at 191/89/27
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
NTFS at 27822/19/37
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS found using backup sector!, 227 GB / 211 GiB
NTFS at 27822/19/38
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 27822 19 38 27879 113 10 921600
NTFS, 471 MB / 450 MiB
NTFS at 27879/113/10
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 27822 19 38 27879 113 10 921600
NTFS found using backup sector!, 471 MB / 450 MiB
NTFS at 27879/113/11
filesystem size 20977657
sectors_per_cluster 8
mft_lcn 765836
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 27879 113 11 29185 61 53 20977657 [HDDRECOVERY]
NTFS, 10 GB / 10 GiB
NTFS at 29185/61/60
filesystem size 20977657
sectors_per_cluster 8
mft_lcn 765836
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 27879 113 18 29185 61 60 20977657
NTFS found using backup sector!, 10 GB / 10 GiB
NTFS at 27879/113/10
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 27879/113/11
filesystem size 20977657
sectors_per_cluster 8
mft_lcn 765836
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

Results
* HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
D HPFS - NTFS 27822 19 38 27879 113 10 921600
NTFS, 471 MB / 450 MiB
D HPFS - NTFS 27879 113 10 27936 206 45 921600
NTFS, 471 MB / 450 MiB
D HPFS - NTFS 27879 113 11 29185 61 53 20977657 [HDDRECOVERY]
NTFS, 10 GB / 10 GiB
D HPFS - NTFS 27879 113 18 29185 61 60 20977657
NTFS found using backup sector!, 10 GB / 10 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
2 P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 191/89/27
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
2 P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 128000
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 128000
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_ucstoutf8: iconv_open failed

1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
Directory /
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:19 .
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:19 ..
36 dr-xr-xr-x 0 0 0 24-Nov-2015 03:27 Boot
79 -r--r--r-- 0 0 400228 4-Mar-2016 20:53 bootmgr
130 -r--r--r-- 0 0 1 4-Mar-2016 20:53 BOOTNXT
80 -r--r--r-- 0 0 8192 9-Dec-2015 14:19 BOOTSECT.BAK
142 dr-xr-xr-x 0 0 0 24-Nov-2015 03:27 Recovery
35 dr-xr-xr-x 0 0 0 23-Nov-2015 18:27 System Volume Information
50 -r--r--r-- 0 0 284 24-Nov-2015 03:21 WinREPartition.ini
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
Directory /System Volume Information
35 dr-xr-xr-x 0 0 0 23-Nov-2015 18:27 .
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:19 ..
37 -r--r--r-- 0 0 20480 23-Nov-2015 18:27 tracking.log
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
Directory /
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:19 .
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:19 ..
36 dr-xr-xr-x 0 0 0 24-Nov-2015 03:27 Boot
79 -r--r--r-- 0 0 400228 4-Mar-2016 20:53 bootmgr
130 -r--r--r-- 0 0 1 4-Mar-2016 20:53 BOOTNXT
80 -r--r--r-- 0 0 8192 9-Dec-2015 14:19 BOOTSECT.BAK
142 dr-xr-xr-x 0 0 0 24-Nov-2015 03:27 Recovery
35 dr-xr-xr-x 0 0 0 23-Nov-2015 18:27 System Volume Information
50 -r--r--r-- 0 0 284 24-Nov-2015 03:21 WinREPartition.ini
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 191 89 26 3072000 [System]
NTFS, 1572 MB / 1500 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
2 P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
NTFS at 191/89/27
NTFS at 191/89/27
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_ucstoutf8: iconv_open failed

2 P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
Directory /
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:20 .
5 dr-xr-xr-x 0 0 0 24-Nov-2015 03:20 ..
265310 dr-xr-xr-x 0 0 0 9-Dec-2015 14:32 Intel
139868 dr-xr-xr-x 0 0 0 23-Nov-2015 18:28 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 24-Nov-2015 03:21 Boot
32352 -r--r--r-- 0 0 383786 24-Nov-2015 03:22 bootmgr
84995 -r--r--r-- 0 0 1 30-Oct-2015 07:18 BOOTNXT
32353 -r--r--r-- 0 0 8192 24-Nov-2015 03:22 BOOTSECT.BAK
21655 dr-xr-xr-x 0 0 0 10-Mar-2016 05:40 Config.Msi
32435 dr-xr-xr-x 0 0 0 24-Nov-2015 03:22 Documents and Settings
139896 dr-xr-xr-x 0 0 0 23-Nov-2015 19:04 Dokumente und Einstellungen
8866 -r--r--r-- 0 0 6377455616 9-Dec-2015 14:35 hiberfil.sys
85217 dr-xr-xr-x 0 0 0 9-Dec-2015 14:23 inetpub
23360 dr-xr-xr-x 0 0 0 12-Mar-2016 07:58 OneDriveTemp
1208 -r--r--r-- 0 0 8589934592 20-Jan-2016 18:37 pagefile.sys
25012 dr-xr-xr-x 0 0 0 30-Oct-2015 07:24 PerfLogs
25016 dr-xr-xr-x 0 0 0 9-Dec-2015 14:23 Program Files
28076 dr-xr-xr-x 0 0 0 9-Dec-2015 14:23 Program Files (x86)
28185 dr-xr-xr-x 0 0 0 30-Oct-2015 07:24 ProgramData
139909 dr-xr-xr-x 0 0 0 23-Nov-2015 19:04 Programme
11501 dr-xr-xr-x 0 0 0 9-Dec-2015 14:30 Recovery
11562 -r--r--r-- 0 0 16777216 9-Dec-2015 14:30 swapfile.sys
139841 dr-xr-xr-x 0 0 0 24-Nov-2015 03:27 System Volume Information
1419 dr-xr-xr-x 0 0 0 24-Nov-2015 03:21 Toshiba
28394 dr-xr-xr-x 0 0 0 30-Oct-2015 08:09 Users
28540 dr-xr-xr-x 0 0 0 9-Dec-2015 14:25 Windows
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

ntfs_boot_sector
2 P HPFS - NTFS 191 89 27 27822 19 37 443887616 [TI31361300B]
NTFS, 227 GB / 211 GiB
NTFS at 191/89/27
NTFS at 191/89/27
filesystem size 443887616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Accidentally "formatted" running drive using Fat32Format

#9 Post by cgrenier »

When you are listing the files from the partitions System and TI31361300B, do you see your files ?

krs7
Posts: 7
Joined: 15 Mar 2016, 20:57

Re: Accidentally "formatted" running drive using Fat32Formatter

#10 Post by krs7 »

Hello everybody.
I just wanted to let you know how I solved my problem.
Using the windows ISO cd didnt help. I could not repair the startup process and I could not reset the Windows because Windos repair could not acces the windows files.
I was almost giving up but I still tryed some options with testdisk. After i re-wrote the partition table for all 6 partiions, I still got the same error. Then I observed the primary partition is set to a 1500 mb partition so I changed it to the 210 GB partition. ---and it worked!!!!! so...that was the succes! :mrgreen: :mrgreen: :lol: Windows is booting!
I think pretty easy an probably have had to see it earlier - but better too late than never

Anyway - thanks a lot to cgrenier for the support and of course for testdisk!!

Locked