Hi,
I'm not that familiar with all the terms, so I hope I can explain properly what happend.
I'm using WD My Passport, and several days ago I ran the command:
""dd if=/dev/sdb of=/dev/sda..."
After about 29GB have been copied, I stopped the process using CTRL + C, as I realised it wasn't just copying the data from one place to another, but over-writting in the process.
I was using a dual-booted computer, having windows 10 & Ubuntu 19.04.
In the last few days I tried recovering files from the external hard disk using PhotoRec.
However, because I over-written the partition info, only some of the disk's storage space partitions were displayed (as EFI partitions).
In the last 20hours testdisk is running (I chose the EFI option), and I wonder what I should do next and did I make the right choice?
I currently planned of following the Documentation's section 8.1 TestDisk: undelete file for FAT, exFAT, ext2.
Written into WD My Passport using dd command
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Written into WD My Passport using dd command
Using TestDisk, you should be able to recover the partitions starting after the first 29GB.
If the first partition was an NTFS, TestDisk may be able to find it using the NTFS boot sector (After Analyse, Quick Search and Deeper Search).
If it's the case, choose BackupBS when asked.
If the first partition was an NTFS, TestDisk may be able to find it using the NTFS boot sector (After Analyse, Quick Search and Deeper Search).
If it's the case, choose BackupBS when asked.
Re: Written into WD My Passport using dd command
I will try it as soon as the deeper search ends.
Is it normal that it analyses 1 cylinder/second?
When the Quick Search ended it found two partitions starting at 2048, one was the EFI system and the other was the desired My Passport partition (that was missing before).
Perhaps I can post some of the details in the log file for more details, where can I find it?
Is it normal that it analyses 1 cylinder/second?
When the Quick Search ended it found two partitions starting at 2048, one was the EFI system and the other was the desired My Passport partition (that was missing before).
Perhaps I can post some of the details in the log file for more details, where can I find it?
-
recuperation
- Posts: 2736
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Written into WD My Passport using dd command
in the folder with the Testdisk executable file
Re: Written into WD My Passport using dd command
The beginning of the log file:
Afterwards I received about 2000 rows along the lines of:
and
Finally, the quick search results:
Code: Select all
Sun Apr 5 12:28:07 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=263257587712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=26843545600
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPCX-24VHAT0, S/N:WD-WXF1A188YJFZ, FW:02.01A02
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Passport 25E2, S/N:WX71A87798Z4, FW:4004
Partition table type (auto): EFI GPT
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Passport 25E2
Partition table type: EFI GPT
Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3906963455)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
check_part_gpt failed for partition
4 P MS Data 922296320 974725119 52428800 [Basic data partition]
1 P EFI System 2048 534527 532480 [EFI system partition]
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
3 P MS Data 567296 514742271 514174976 [Basic data partition]
NTFS, blocksize=4096, 263 GB / 245 GiB
6 P Linux filesys. data 678582272 922296319 243714048
4 P MS Data 922296320 974725119 52428800 [Basic data partition]
5 P Windows Recovery Env 974725120 976773119 2048000 [Basic data partition]
Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3906963455 (expected 3906963455)
hdr_lba_start=34
hdr_lba_end=3906963422
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
check_part_gpt failed for partition
4 P MS Data 922296320 974725119 52428800 [Basic data partition]
Current partition structure:
1 P EFI System 2048 534527 532480 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
3 P MS Data 567296 514742271 514174976 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
4 P MS Data 922296320 974725119 52428800 [Basic data partition]
4 P MS Data 922296320 974725119 52428800 [Basic data partition]
5 P Windows Recovery Env 974725120 976773119 2048000 [Basic data partition]
6 P Linux filesys. data 678582272 922296319 243714048
search_part()
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513
FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM_DRV]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 35/79/45
filesystem size 514174976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=290455552, part_size=263257587712, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 35/79/45
filesystem size 514174976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 567296 514742271 514174976
NTFS, blocksize=4096, 263 GB / 245 GiB
LVM magic value at 32861/156/22
FAT12 at 56345/163/35
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-4
FAT2 : 5-8
start_rootdir : 9
Data : 41-4860
sectors : 4864
cluster_size : 4
no_of_cluster : 1205 (2 - 1206)
fat_length 4 calculated 4
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
FAT12 at 56345/163/35
EFI System 905192728 905197591 4864 [EFI System Partition] [NO NAME]
FAT12, blocksize=2048, 2490 KB / 2432 KiB
block_group_nr 49
recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/2799, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 91749888
recover_EXT2: part_size 733999104
Filesystem created: Sat Jul 21 10:10:22 2018
Linux filesys. data 1023724454 1757723557 733999104
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB
block_group_nr 2401
recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/2799, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 91749888
recover_EXT2: part_size 733999104
Filesystem created: Sat Jul 21 10:10:22 2018
Linux filesys. data 1143371974 1877371077 733999104
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB
NTFS at 243197/25/28
filesystem size 3906959360
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 3906961407 3906959360 [My Passport]
NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
NTFS at 243197/25/28
filesystem size 3906959360
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,3913252869(243588/184/58)) lseek err Invalid argument
file_pread(5,1,buffer,3913252869(243588/184/58)) lseek err Invalid argument
NTFS: Can't read MFT
MS Data 3906961407 7813920766 3906959360
NTFS, blocksize=4096, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=3906961407, size=3906959360, end=7813920766, disk end=3906963456)
file_pread(5,1,buffer,3906963456(243197/57/61)) ReadFile The drive cannot find the sector requested.
Code: Select all
file_pread(5,1,buffer,3906965505(243197/90/31)) lseek err Invalid argumentCode: Select all
file_pread(5,1,buffer,3906963456(243197/57/61)) ReadFile The drive cannot find the sector requested.Code: Select all
The harddisk (2000 GB / 1862 GiB) seems too small! (< 4000 GB / 3725 GiB)
The following partition can't be recovered:
MS Data 3906961407 7813920766 3906959360
NTFS, blocksize=4096, 2000 GB / 1862 GiB
Results
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM_DRV]
FAT32, blocksize=4096, 272 MB / 260 MiB
MS Data 2048 3906961407 3906959360 [My Passport]
NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
MS Data 567296 514742271 514174976
NTFS, blocksize=4096, 263 GB / 245 GiB
EFI System 905192728 905197591 4864 [EFI System Partition] [NO NAME]
FAT12, blocksize=2048, 2490 KB / 2432 KiB
Linux filesys. data 1023724454 1757723557 733999104
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB
Linux filesys. data 1143371974 1877371077 733999104
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 375 GB / 349 GiB
interface_write()
No partition found or selected for recovery
NTFS filesystem needs to be repaired.