MBR disk overwritten by rogue GPT based installer

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
skivy71
Posts: 1
Joined: 15 Aug 2018, 12:39

MBR disk overwritten by rogue GPT based installer

#1 Post by skivy71 »

Hi,

I've had an unfortunate incident where a chrome os installer targeted the wrong disk during an install (yes it never even asked).

In short, a working MBR disk containing windows 7 (NTFS) was overwritten by a new GPT parition table with umpteen new partitions.

I've tried photorec but nothing useful happens there.

So, when using testdisk, using a deepscan I can find what appear to the the existing MBR partitions (i only want the data off it).

But attempts to restore the MBR partitions have failed so far (i created an img via dd so I can always revert back to the original overwritten state).

Where I'm confused, is the restore process, specifically as my original scheme was MBR and the disk is not detected as GPT.

I specify intel / pc, should I leave it as GPT?

It's quite difficult to set which partitions to recover as they overlap.

Am I flogging a dead horse?

Thanks for any help / comments.

Kind regards,

Neil

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: MBR disk overwritten by rogue GPT based installer

#2 Post by cgrenier »

For each partition found by testdisk, you can the key 'p' to list its files.
This way you should be able to find which partitions you want to recover.
Use the arrow keys to switch them from D(eleted) to P(rimary), *(bootable) or L(ogical).
On next screen, choose Write, confirm, Quit and restart your computer.

Locked