TestDisk misuse: deleted all partitions because TestDisk detected them as such

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
Axonn
Posts: 5
Joined: 17 Jul 2018, 18:09

TestDisk misuse: deleted all partitions because TestDisk detected them as such

#1 Post by Axonn » 17 Jul 2018, 18:28

"If only the author could get 1 dollar for every time somebody misused its work..."

Well, not sure if this is purely my fault. Part of it is. I resized a fat32 partition using gparted and Ubuntu. I then returned to my windows but the partition was now "raw". I found about TestDisk.

I analyzed. I saved log on C drive, main Windows OS, where I was running TestDisk from. It showed partitions approximately like so:

Uefi
Windows reserved
Windows main
Linux
Linux user
Linux swap
My fat32 as raw partition
Another data partition

There were a couple more. Anyway, the weird thing I noticed was that TestDisk showed almost all as deleted. Except the uefi I think.

Well, I assumed it won't delete stuff I don't mess with, like gparted. So I just switched my freshly resized partition to P as primary instead of deleted, wrote and rebooted.

Assumption is the mother of all......

So, here I am. I wonder if I can restore from this bear-astrophe. I just left it do a deep search now and left home for a bit. It was showing something but not very encouraging. It got to 63% and was showing me some windata partitions (3 identical ones) and then 2 mac (why?!) also identical.

I did not write any data on the disk and I assume that I can recover the log file. Perhaps using that I could reconstruct the partitions via gparted?

As any user in my situation, I would be immensely grateful for any ideas. I'm offering a small financial reward (lunch or dinner size) just in the spirit of how I started the post.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 4425
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#2 Post by cgrenier » 18 Jul 2018, 06:00

When testdisk lists all partitions, use the arrow keys to switch the partitions to recover/keep as P(rimary) instead of D(eleted).
If you have all your partitions, on next screen, choose Write, confirm, Quit and restart your computer.

Axonn
Posts: 5
Joined: 17 Jul 2018, 18:09

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#3 Post by Axonn » 18 Jul 2018, 12:28

Hello! :). An honor to have you answering, thank you Christophe :).

Well, the thing is that now, it does NOT detect anything anymore. I believe that after having wrote and rebooted, something got lost. The thing is that I am running it under Linux now, whereas I was running under Windows when I broke it. Under Windows it detected the drive as UEFI, but now on Linux it detects it as Intel. Anyway, I tried a Quick Search using both types and it does NOT find the original partitions in either case. So unfortunately it is not as easy as selecting to undo something anymore :(.

Yesterday, the Deep Search didn't work that well :(. It eventually only found those 3 windata and 2 mac partitions.

Fortunately, the trial version of RStudio allowed me to recover the TestDisk log from the drive. RStudio DOES seem to see my partitions pretty well. Some labels are missing so I am unsure if the data is correct, but thanks to the recovered log, I believe I can match the partitions for a possible restore.

I am afraid that if I attempt to restore partitions using gparted I ONLY HAVE ONE SHOT. If I write the wrong stuff, then my partitions are lost forever. And the problem is that I have a Linux partition I really need to recover. I have valuable information there. It shows as encrypted in RStudio even though I'm pretty sure I did not set up a passphrase when asked and it was working just fine just with user login under Linux. That's why I'm trying to recover my laptop. I am currently using a Live Ubuntu USB to access my NVME SSD.

Interestingly enough, the TestDisk log does NOT show what I saw when I ran it under Windows. It shows the partitions as "P", whereas I remember VERY WELL that they were all marked with "D" just before I pressed "write" and I'm also pretty damn sure that I didn't go to each and every one of them and set them to "D" by hand :D.

Anyway, I'm attaching you the TestDisk log and a screenshot from RStudio where you can see the partitions (can't do it via the Forum because 500 KB is too large, so I put them online). Can you please look at least a little bit and advise? Any idea what went on? Any idea what should I use to restore my partitions?

TestDisk log:
https://pastebin.com/5cfe3bp7

RStudio Screenshot of partitions:
https://pasteboard.co/Hv1btVD.png

I'm very grateful for your time! Will donate :)

Axonn
Posts: 5
Joined: 17 Jul 2018, 18:09

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#4 Post by Axonn » 18 Jul 2018, 18:18

Additionally, here it how my SSD looks in Gparted now, after the accident. Before, I had about 8 partitions: 3 for Windows, 3 for Linux, the UEFI and the one I resized (a FAT32).

https://pasteboard.co/Hv3tOmD.png

Axonn
Posts: 5
Joined: 17 Jul 2018, 18:09

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#5 Post by Axonn » 21 Jul 2018, 08:52

I'm back with an update. TestDisk didn't ever see the broken drive :(. Don't know why. The previous report of the search I did was actually on the USB drive I was running Ubuntu from. I just hadn't noticed that.

What I did now is to use the dd command to make an image of the broken drive onto an external USB drive, because I aimed to do some partition recovery experiments WITHOUT touching my broken drive, in the hope that the less I interfere with it, the better.

Interestingly enough, TestDisk DOES SEE the EXTERNAL USB drive, and I performed an analysis on it and my partitions show up! It's still running but the results are very encouraging.

Now the question is: why does TestDisk not see the internal nvme drive?

And even more importantly, do you think I can risk performing the repair on the USB drive and then dd back to the NVME? What if dd missed something?

I'd rather experiment with TestDisk on the USB but then performing the actual repair on the NVME.

P.S. I donated :)

Axonn
Posts: 5
Joined: 17 Jul 2018, 18:09

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#6 Post by Axonn » 02 Aug 2018, 07:55

Coming back with a short story. I never did manage to recover my drive using TestDisk. It managed to restore functionality to the Linux bootloader, but the Windows was permanently lost. Fortunately, TestDisk was good enough to restore every other partition so I didn't lose a single file. What I lost was the hours that went into configuring my Windows & Linux installations, which I had to reinstall after a reformatting and repartitioning of the disk.

That's not entirely bad because I don't mind a clean install every couple of years. Too bad it was forced on me by what I believe to be a bug.

In any case, I'd like to point out two major issues with the software:

1. I noticed it has the option to restore from backups. Then why, before applying changes, doesn't it OFFER TO MAKE SUCH BACKUPS? The option wasn't ever mentioned to me and if it were, it might have saved me. I would be sincerely grateful if you'd consider adding such a message :).
2. After doing a Quick Search, there is a sort of usability problem. If one presses ENTER, then all the quick scan data is basically lost because the only option is doing Deeper Search. Going back returns the user waaaay back to the main menu. And then another 2 hours of waiting begins.

In any case, my donation comes with no strings attached. It is meant to thank you for the hours you already put in the program. I'm sure it saved a lot of people :), despite my case being unfortunate, with TestDisk listing my totally valid partitions as "deleted".

User avatar
cgrenier
Site Admin
Posts: 4425
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#7 Post by cgrenier » 02 Aug 2018, 09:12

The option to backup the existing partition table is available when the results of "Analyse" are displayed.

I have added some new code to ask user confirmation when no partition is selected for recovery after Quick Search and Deeper Search:
https://git.cgsecurity.org/cgit/testdis ... 72508c5a32
Previously it was available only after Deeper Search.
I have added to my TODO the "possibility to return to partition selection".

User avatar
cgrenier
Site Admin
Posts: 4425
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: TestDisk misuse: deleted all partitions because TestDisk detected them as such

#8 Post by cgrenier » 06 Aug 2018, 12:16

I have uploaded a new 7.1-WIP version (code not committed to git yet). Can you try it ?

Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests