Restore Veracrypt partition after accidental deletion of partition table

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bopqul
Posts: 1
Joined: 17 Apr 2017, 15:48

Restore Veracrypt partition after accidental deletion of partition table

#1 Post by bopqul »

Hello guys and girls!

I 've accidentally deleted some initial portion (little I think) of my drive through the following command: openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt < /dev/zero > /dev/sda

The following partitions existed prior to my fault:

sda1/2 (Windows) - about 100GB
sda3 (Extended) - about 100GB
sda4 Veracrypt - about 700GB
some Unallocated space

With the above command I wanted to fill with noise the sda3 partition, but due to a mistake while typing the number 3, didn't reach the command, so as soon as I noticed it (pretty quickly) I hit CTRL+C (about 1 sec after the initial ENTER).

What I 've done already:

1) Run testdisk with the following outputs:

Intel/PC partition option prior to analyzing https://paste.linux.community/view/ac96223c

Non partitioned media option prior analysis https://paste.linux.community/view/a352742e

So the first scan only came up with:

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors

Linux 12858 253 4 24340 40 20 184444928

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
ext4 blocksize=4096 Large_file Sparse_SB, 94 GB / 87 GiB

so that should be the Extended Linux partition (that is sda3, before sda4)

and the second one with those (among other little FAT partitions):

P NTFS 6436 37 34 19282 67 17 206372864

Structure: Ok.

Keys T: change type, P: list files,
Enter: to continue
NTFS, blocksize=4096, 105 GB / 98 GiB

P ext4 12858 253 2 24340 40 18 184444928

Structure: Ok.

Keys T: change type, P: list files,
Enter: to continue
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 94 GB / 87 GiB

2) Run gpard /dev/sda with the following output after 24+ hours of the command running:

Begin scan...
Possible partition(DOS FAT), size(10mb), offset(6720mb)
Possible partition(Windows NT/W2K FS), size(0mb), offset(31042mb)
Possible partition(Windows NT/W2K FS), size(3mb), offset(33462mb)
Possible partition(Windows NT/W2K FS), size(3mb), offset(33466mb)
Possible partition(Windows NT/W2K FS), size(3mb), offset(33469mb)
Possible partition(Windows NT/W2K FS), size(3mb), offset(34282mb)
Possible partition(Windows NT/W2K FS), size(0mb), offset(38780mb)
Possible partition(Windows NT/W2K FS), size(100767mb), offset(50486mb)
Possible partition(Windows NT/W2K FS), size(953866mb), offset(953867mb)

*


** Fatal error: dev(/dev/sda): seek failure.

3) Run MiniTool partition recovery option & EaseUS one, through mounting the disk to Windows pc, with the scans not showing the veracrypt partition, but one of the (MiniTool) showing the above linux one (87.95GB)

My question is, do you know any possible way that I should proceed in order to recover the Veracrypt partition (previous sda4)? In the end thats the only data that I care of.

I look forward to your insights, as I am available for any clarifications! Thank you in advance for your time!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Restore Veracrypt partition after accidental deletion of partition table

#2 Post by cgrenier »

Choose PC Intel and post the testdisk.log file

Locked