cgsecurity.org

Hi, I have a server with samba service, first someone users tell me that the directory and files (7gbs) have been deleted, after another user with same problem
100gb deleted, I shutdown the server, I thinked tha was the user self or another user have deleted the files, I was to use extundelete, but how have that execute in live cd,
i have decided, to put the hd on another server in slave mode, to run testdisk, when I put on the hard disk in another server, I can't mount the partition more
I dont know why I have decided write another partition table detected by testdisk on hard drive and now I can't access more my partition, still is possible to repair?
Whein I use
gdisk /dev/sdb
Found valid MBR and GPT. Which do you want to use?

gdisk find two partition table, MBR e GPT, I think that the correct is GPT
(MBR)
Number Start (sector) End (sector) Size Code Name
1 2048 482136063 229.9 GiB 8300 Linux filesystem
(GPT)
Number Start (sector) End (sector) Size Code Name
1 2048 1050623 512.0 MiB EF00
2 1050624 968407039 461.3 GiB 8300
3 968407040 976771071 4.0 GiB 8200

I can't mount the second partition, I have cloned the harddisk, but after rewrite partition table , to to do more try, dd if=/dev/sda of=/dev/sdb
I have tried too fsck.ext4 -vy /dev/sdb1 but dont worked.

After Analyse, Quick Search or Deeper Search, use 'p' to list the files for each partition found by TestDisk.
Switch from D(eleted) to P(rimary), *(bootable) or L(ogical), the partitions you want to recover.
Disks over 2 TB uses EFI GPT, smaller disk can use MBR or EFI GPT.