Partition lost after using Windows Media Creation Tool

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
chrisd75
Posts: 2
Joined: 04 Jan 2018, 17:59

Partition lost after using Windows Media Creation Tool

#1 Post by chrisd75 »

Hi Cristophe!

I have a 500 GB external HDD from which I installed Windows 10 to my mother's PC successfully.
'Originally' I created an 8 GB MacOS install drive and the remaining space for music backup formatted HFS+. I reformatted the 8 GB space to NTFS for the Windows 10 installation and from the remained space I created a 100 GB NTFS partition for backup and there were left an almost 400 GB HFS+ formatted space on the HDD where my music is.
Windows Media Creation Tool successfully tarnsformed the whole disk into a 32 GB ESD-USB drive.

I ran TestDisk DeepSearch and the lost 391 GB / 364 GiB HFS+ partition I need is there as a deleted partition. I tried to change the partition from 'D' (deleted) to 'P' (primary) and write the 'changes' but I got write error.

My question is: how to restore this partition to recover the data from.

Waiting for your kind reply.
Krisztián

Of course I have the whole log. I will send it to you if you need it.
Below you can find the relevant part of the log file where you can see the operation I made.

Results
FAT32 LBA 2048 67110911 67108864 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
FAT32 LBA 2054 67110917 67108864 [NO NAME]
FAT32, blocksize=32768, 34 GB / 32 GiB
HPFS - NTFS 20723 26896 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
HPFS - NTFS 26896 33069 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT12 73024 75903 2880 [EFI System Partition] [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 75904 78783 2880 [EFI System Partition] [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
HFS 409640 765573479 765163840
HFS+ found using backup sector!, 391 GB / 364 GiB

HFS 224376870 224419797 42928
HFS+ found using backup sector!, 21 MB / 20 MiB
HFS 224416436 224459363 42928
HFS+ found using backup sector!, 21 MB / 20 MiB
HFS 224419794 224462721 42928
HFS+ blocksize=4096, 21 MB / 20 MiB
HFS 224459360 224502287 42928
HFS+ blocksize=4096, 21 MB / 20 MiB
FAT32 LBA 334097883 599241631 265143749
FAT32 LBA 682467929 801196188 118728260
FAT32 LBA 765835624 960885983 195050360 [100GB]
FAT32, blocksize=32768, 99 GB / 93 GiB
FAT32 LBA 765835630 960885989 195050360 [100GB]
FAT32, blocksize=32768, 99 GB / 93 GiB
HPFS - NTFS 777837895 778405335 567441
HPFS - NTFS 945785273 961148128 15362856
NTFS found using backup sector, blocksize=4096, 7865 MB / 7501 MiB
HPFS - NTFS 961148128 976510983 15362856 [8GB]
NTFS, blocksize=4096, 7865 MB / 7501 MiB

interface_write()
1 P HFS 409640 765573479 765163840
write!

write_mbr_i386: starting...
file_nopwrite(5,1,buffer,0(0/0/1)) write refused
write_all_log_i386: starting...
No extended partition

Partition: Write error

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partition lost after using Windows Media Creation Tool

#2 Post by cgrenier »

If you are running testdisk under Mac OS X, you need to umount all partitions from this disk before starting testdisk.
In a Terminal, use 'mount' to get a list of all mounted partitions and for each partition to unmount, run something like "umount /volumes/directory_name"

chrisd75
Posts: 2
Joined: 04 Jan 2018, 17:59

Re: Partition lost after using Windows Media Creation Tool

#3 Post by chrisd75 »

Hi Christophe!

Thank you for your answer.

Yes, I'm on MacOS. I'll give a try again, but I remember that I unmounted the partitions before write attempt.

Could you help me, how to get to the 'partition-writing-phase' without running a DeepSearch again?

Kind regards,
Krisztián

Locked