Background
I have a new ASUS PC with Windows 8.1 and 1 HD of 1TB, on which I installed Ubuntu 16.04.1 in dual boot mode, with the intention of using the DATA partition to store files generated by both systems.
My problem.
Some days ago, I turned on Windows from Ubuntu and I found that all files in the partition had been erased except those created by Windows.
Before groping the recovery of files I tried to copy the contents of the partition on other support, by DD commands. During the first attempt to copy I made a mistake: I set as destination for copy the DATA partition itself. After a few seconds I realized the error and I stopped the process, hoping not to have done much damage. Then I successfully copied the DATA partition on other external media.
In summary, the DATA partition suffered two incidents: the intervention of Windows data deletion (I do not have the certainty, but I can not find other explanation) and the writing of a small part of the partition by DD.
So with difficulties given by my inexperience, I started making attempts to partition recovery, firstly with TestDisk, then with QPhotoRec (I have written in this topicviewtopic.php?f=5&t=6624, then I went back to try using TestDisk 7.0-1.
A few days ago GParted reported following strucure of the disk
This morning I started TestDisk and I got the following screen after performing Quick Search(Partition DATA should be the one with the right arrow)
Code: Select all
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
D FAT32 0 32 33 12 223 19 204800 [SYSTEM]
D HPFS - NTFS 12 223 20 127 155 28 1843200
D HPFS - NTFS 143 236 30 26606 103 57 425119744
D Linux Swap 26606 103 58 28136 49 9 24576000
D Linux 28136 49 10 33298 245 35 82939904
>D HPFS - NTFS 33299 55 37 119641 178 25 1387091968
D HPFS - NTFS 119641 210 58 121601 57 56 31477760
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, blocksize=4096, 710 GB / 661 GiB
TestDisk answered "No partition found or selected for recovery". Then I started the Deep Search, lasting about 3 hours, and I got:
Code: Select all
Warning: the current number of heads per cylinder is 255
but the correct value may be 8.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
Code: Select all
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
>* FAT32 0 32 33 12 223 19 204800 [SYSTEM]
P HPFS - NTFS 12 223 20 127 155 28 1843200
D HPFS - NTFS 143 236 30 26606 103 57 425119744
D HPFS - NTFS 143 236 30 48784 54 38 781406208
D HPFS - NTFS 26606 103 57 53068 226 21 425119744
D Linux Swap 26606 103 58 28136 49 9 24576000
D HPFS - NTFS 26606 103 58 28136 49 9 24576000
D Linux 28136 49 10 33298 245 35 82939904
D HPFS - NTFS 28199 238 8 33299 55 36 81920000
D Linux 30503 169 3 35666 110 28 82939904
D Linux 30505 16 40 35667 213 2 82939904
D Linux 30513 89 41 35676 31 3 82939904
D Linux 30513 154 42 35676 96 4 82939904
D Linux 30514 127 14 35677 68 39 82939904
D Linux 30515 164 50 35678 106 12 82939904
D Linux 30516 104 53 35679 46 15 82939904
D Linux 30518 82 29 35681 23 54 82939904
D HPFS - NTFS 33299 55 37 119641 178 25 1387091968
D Linux 48315 117 59 48562 3 17 3960832
D HPFS - NTFS 48784 54 39 119641 210 57 1138327552
D FAT16 LBA 53100 30 51 53107 66 15 114688 [boot]
D Linux 53957 241 45 54204 127 3 3960832
D Linux 53997 119 11 54244 4 32 3960832
D Linux 58788 224 61 59035 110 19 3960832
D Linux 58794 190 21 59041 75 42 3960832
D Linux 63338 215 46 63585 101 4 3960832
D Linux 67845 151 19 68092 36 40 3960832
D Linux 67865 252 36 68112 137 57 3960832
D Linux 70909 62 2 71742 21 23 13379584 [root]
D Linux 75837 178 54 76313 248 31 7651328
D Linux 75843 111 45 76319 181 22 7651328
D Linux 80804 5 34 81156 194 62 5666816 [root]
D Linux 81952 32 1 82304 221 29 5666816 [root]
D Linux 85836 226 23 86189 160 51 5666816 [root]
D Linux 85837 36 24 86189 225 52 5666816 [root]
D Linux 85851 9 47 86203 199 12 5666816 [root]
D Linux 85851 74 48 86204 9 13 5666816 [root]
D Linux 85855 29 63 86207 219 28 5666816 [root]
D Linux 88297 1 1 88649 254 63 5670882 [root]
D Linux 88297 9 33 88649 198 61 5666816 [root]
D Linux 88298 79 38 88651 14 3 5666816 [root]
D Linux 88299 52 10 88651 241 38 5666816 [root]
D Linux 88309 167 51 88662 102 16 5666816 [root]
D Linux 88310 42 53 88662 232 18 5666816 [root]
D Linux 88310 75 22 88663 9 50 5666816 [root]
D Linux 88324 48 45 88676 238 10 5666816 [root]
D Linux 88324 113 46 88677 48 11 5666816 [root]
D Linux 88325 183 51 88678 118 16 5666816 [root]
D Linux 88337 114 34 88690 48 62 5666816 [root]
D Linux 88338 87 6 88691 21 34 5666816 [root]
D Linux 88355 75 41 88708 10 6 5666816 [root]
D Linux 88356 48 13 88708 237 41 5666816 [root]
D Linux 88356 113 14 88709 47 42 5666816 [root]
D Linux 88359 30 56 88711 220 21 5666816 [root]
D Linux 90071 149 63 90904 109 21 13379584 [root]
D Linux 90072 90 3 90905 49 24 13379584 [root]
D Linux 91982 236 31 92335 170 59 5666816 [root]
D Linux 92466 151 38 93299 110 59 13379584 [root]
D Linux 92467 91 41 93300 50 62 13379584 [root]
D Linux 92937 98 26 93290 32 54 5666816 [root]
D Linux 92939 11 1 93291 200 29 5666816 [root]
D Linux 92939 238 36 93292 173 1 5666816 [root]
D Linux 93411 222 60 93764 157 25 5666816 [root]
D Linux 93412 97 62 93765 32 27 5666816 [root]
D Linux 93415 210 44 93768 145 9 5666816 [root]
D Linux 93417 253 21 93770 187 49 5666816 [root]
D Linux 93420 236 1 93773 170 29 5666816 [root]
D Linux 93421 13 33 93773 202 61 5666816 [root]
D Linux 93421 46 2 93773 235 30 5666816 [root]
D Linux 93423 218 44 93776 153 9 5666816 [root]
D Linux 93424 28 45 93776 218 10 5666816 [root]
D Linux 93424 191 16 93777 125 44 5666816 [root]
D Linux 93425 33 49 93777 223 14 5666816 [root]
D Linux 93425 163 51 93778 98 16 5666816 [root]
D Linux 93702 136 3 94178 205 43 7651328
D Linux 93702 201 4 94179 15 44 7651328
D Linux 93702 233 36 94179 48 13 7651328
D Linux 93703 76 6 94179 145 46 7651328
D Linux 93703 238 40 94180 53 17 7651328
D Linux 93704 146 11 94180 215 51 7651328
D Linux 93704 243 44 94181 58 21 7651328
D Linux 93707 128 54 94183 198 31 7651328
D Linux 94186 116 11 94662 185 51 7651328
D Linux 94186 181 12 94662 250 52 7651328
D Linux 94186 213 44 94663 28 21 7651328
D Linux 94187 56 14 94663 125 54 7651328
D Linux 94187 218 48 94664 33 25 7651328
D Linux 94188 126 19 94664 195 59 7651328
D Linux 94188 223 52 94665 38 29 7651328
D Linux 94191 108 62 94667 178 39 7651328
D Linux 94673 1 1 95149 254 63 7662942
D Linux 94673 176 32 95149 246 9 7651328
D Linux 94674 116 35 95150 186 12 7651328
D Linux 94674 214 5 95151 28 45 7651328
D Linux 94677 99 15 95153 168 55 7651328
D Linux 95154 173 60 95630 243 37 7651328
D Linux 95158 31 42 95634 101 19 7651328
D Linux 95652 62 27 96128 132 4 7651328
D Linux 96140 62 51 96616 132 28 7651328
D Linux 99529 58 50 99775 199 8 3960832
D Linux 101472 0 1 101718 254 63 3968055
D Linux 101949 219 31 102426 34 8 7651328
D Linux 102436 84 49 102912 154 26 7651328
D Linux 103249 235 27 103726 50 4 7651328
D Linux 103250 45 28 103726 115 5 7651328
D Linux 103252 185 38 103729 0 15 7651328
D Linux 103254 0 43 103730 70 20 7651328
D Linux 103257 145 57 103733 215 34 7651328
D Linux 103269 11 39 103745 81 16 7651328
D Linux 105646 214 41 106123 29 18 7651328
D Linux 105647 122 12 106123 191 52 7651328
D Linux 105648 224 49 106125 39 26 7651328
D Linux 105649 99 51 106125 169 28 7651328
D Linux 105649 132 20 106125 201 60 7651328
D Linux 105650 7 22 106126 76 62 7651328
D Linux 105652 147 32 106128 217 9 7651328
D Linux 105653 22 34 106129 92 11 7651328
D Linux 108032 138 11 108508 207 51 7651328
D Linux 108045 106 30 108521 176 7 7651328
D Linux 108058 237 20 108535 51 60 7651328
D Linux 108072 243 12 108549 57 52 7651328
D Linux 108082 163 50 108558 233 27 7651328
D Linux 110237 22 58 110483 163 16 3960832
D Linux 112579 81 15 112825 221 36 3960832
D Linux 112586 84 11 112832 224 32 3960832
D Linux 114863 170 60 115110 56 18 3960832
D Linux 117152 155 60 117399 41 18 3960832
D Linux 117166 226 53 117413 112 11 3960832
P HPFS - NTFS 119641 210 58 121601 57 56 31477760
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=1024, 104 MB / 100 MiB
Code: Select all
NTFS, blocksize = 4096, 710 GB / 661 GiB
Code: Select all
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
1 * FAT32 0 32 33 12 223 19 204800 [SYSTEM]
2 P HPFS - NTFS 12 223 20 127 155 28 1843200
3 P HPFS - NTFS 33299 55 37 119641 178 25 1387091968
4 P HPFS - NTFS 119641 210 58 121601 57 56 31477760
>[ Quit ] [ Write ]
Return to main menu
My first question is: Standing data provided by TestDisk, do you think that my Partition DATA is recoverable or I have to consider my files as lost ?
Furthermore: If I would continue the TestDisk activity by allowing the Write process, would I run the risk to damage also other partitions?
Claudio