Page 1 of 1

New data disappeared without overwriting old data.

Posted: 03 Aug 2017, 12:28
by AndyII
I have a 2 TB Seagate External drive that I use for backing up images of two computers using Acronis True Image. At one time recently, it became completely full and unusable. I used TestDisk to get some files off of it and reformatted it. I started using it again and limited the number of backup versions so it wouldn't get full. A couple days ago, it became a RAW drive with 1MB Unallocated.

There are two selections for the same drive when trying to select a media in TestDisk:
Disk /dev/sdb - 2000 GB / 1863 GiB
&
Drive H: - 2000 GB / 1863 GiB

Choosing Drive H:, the partition table screen defaults to [None} Non partitioned media. Analysing the drive just keeps getting read errors. It has been 24 hours and it is only 12% finished. I also can't stop it without closing the command prompt window completely. TestDisk is unresponsive to the Q key. When I tried looking at the file system, I got a message that the File System seems damaged.

When I used TestDisk to find lost partitions on the Disk /dev/sdb selection, it found previous partitions that should have been overwritten by the backups. The backups are not on the drive. How is that possible? I don't mind reformatting it again if I need to, but I'd rather get the backups back. How can they have just disappeared without a trace and without overwriting previous data?

Re: New data disappeared without overwriting old data.

Posted: 03 Aug 2017, 18:21
by cgrenier
It's probably a problem of bad sectors.
You should clone the disk to a new empty one using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf chapter "DDRescue: data recovery from damaged disk". Read also "Creating a live USB" it may help.
Be careful to not overwrite any other disk.

Re: New data disappeared without overwriting old data.

Posted: 04 Aug 2017, 12:31
by AndyII
That is quite a document. I don't have time to read it right now because I need to get to work. I will look at it later. Are you suggesting that I clone a RAW drive and recover from that?

I had to stop the scan of the H: drive. After 48 hours it was only 23% complete and my 500GB D: drive filled up with a 408GB TestDisk.log file. Now DISKMGMT no longer sees the H: drive. It sees Disk 2 as Unknown and Not Initialized. I just restarted TestDisk and it no longer sees the H: drive either. In fact, it seems that what I thought was old data was actually my boot drive. It's the same size as the external so I got confused. This might be a bad case issue. I'm going to have to break it open. Thanks for the document though. I will look at it later.