Question re recovering from dd misuse

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
step21
Posts: 3
Joined: 15 Oct 2018, 05:50

Question re recovering from dd misuse

#1 Post by step21 »

Hi, so I have had an external 3 tb drive for a while that I accidentally made unusable by overwriting the beginning of the drive with an iso image, when I mixed up drive letters. Never happened before or since but well...
Since that happened, I haven't done anything to the drive, and now I finally have the space and some time to maybe recover it.
I cancelled the process before it was finished and the iso image probably was somewhere between 1-2 GB max (Ubuntu 14.04 iso image) so most files should be intact. I also created a full image of the drive, so in case something goes wrong with recovery there is a backup.

Since it has been a while, I do not remember the partition layout exactly, but there is definitely one big ntfs partition, and maybe some smaller backup partitions of linux partitions though those could be as images as well (in which case I think deep search still finds them)

My problem now seems to be that there is no obviosly right partition. Either the partition can list files, but no files are listed, or on some where I think this should be the right one, it says that the file system is damaged and thus no files are shown. It is of course true that (part of) the file system is damaged, but can I somehow still check files?

Any tips are appreciated. I would like to reactivate the partition, as there are way too many files on there to recover them with photorec or another similar utility where you get the data but no filename or other metadata.

Also, as a sidenote, is there some way to save analysis results? It happens way too often that I accidentally press q too often or something similar and then I have to scan everything again, which is not only bad for the drive but also for my nerves.
Output of Analysis can be pasted if you think that helps to give advice.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Question re recovering from dd misuse

#2 Post by cgrenier »

If you think there was a single NTFS partition, it should be found at the end of Deeper Search. If you copy/paste the output of testdisk, I can tell you which partition to try to recover.
If you are using latest 7.1-WIP, you should be able to find it quickly using Analyse, Quick Search, Stop, Deeper Search, Stop.
With this version, it should be harder to discard the results by mistake.
Once the partition has been recovered, try to fix the NTFS boot sector (menu Advanced).

Locked