NTFS partition overwritten

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Deleted User 9796

NTFS partition overwritten

#1 Post by Deleted User 9796 »

Hello,

I'm new here but I think testdesk gives me the biggest chance to get my data back.
I have a 4 TB drive that was filled 95% with data which I'm missing now. This is what I did:

Wanted to get the drive ready for a mdadm RAID 5:

Code: Select all

sudo parted /dev/sdx mklabel gpt
sudo parted -a optimal -- /dev/sdx mkpart primary 0% 100%
sudo parted /dev/sdx set 1 raid on
I don't know if it is important for you but I did this procedure twice (don't ask why...)

Okay that's all what I did. I did NOT format it, I did NOT add it to the RAID, no data has been written on the drive.

I started panicking... Downloaded several get-data-back tools, was able to restore 1.64 TB of data. I was able to see all files, all software I've tried only were able to restore these 1.64 TB. (3.64 TB - 2.00 TB which is MBR limit afaik = 1.64 TB hmmmmm... )

After this I finally downloaded testdsik. This program just did not came to my attention before. I've found a NTFS partition with quicksearch (I did not recognize that this NTFS partition was about half the size of the disk), was able to list all files, wrote it to the disk but after reboot I was not able to access the data.
Then I've tried to look at the boot sector.

Boot sector: Bad

Backup boot sector: Bad

-> Rebuild boot sector. Result: No access to my data. Windows now actually shows the drive, shows the one folder that was on it but when i try to access it, windows tells me, that the data is corrupt. Also windows reports the partition to be sized at 2TB.

Image

I am currently running a full quick search to see if testdisk can find my original partition (I've calculated that this will last at least 35h).

What I've found out:

When I select the disk in testdisc, go to advanced it reports the following partition:

Image

Now, I go on Type, change the partition to MS Data -> NTFS. Then I select Boot and it shows an intact backup bootsector.

Image


What should I do now? Wait for scans? Restore this backup boot sector? Or will it get worse when I try this? Please help me :(

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS partition overwritten

#2 Post by cgrenier »

In Advanced, choose Boot and BackupBS, confirm, Quit and restart.

Your disk should be listed as AFI GPT, not as basic (PC Intel) as Windows does...

Deleted User 9796

Re: NTFS partition overwritten

#3 Post by Deleted User 9796 »

Hi,

that did not work. I was not able to list the files - bad MFTs. I'm rebuilding boot sector now, takes a while.

Deleted User 9796

Re: NTFS partition overwritten

#4 Post by Deleted User 9796 »

I was not able to rebuild the boot sector and test disk only found bad MFTs.

After a long, long google search, I've found a tool named DMDE. I am able to recover every single file with this software. It is recovering at the moment.


Altough testdisk did not recover my partitions or files I would like to shout out a big thanks to the developer, testdisk is a great tool and it's free, I really appreciate that. It also has a very good documentation. In addition, I would have never found out about DMDE without testdisk.

Locked