D disk reformated automatically after Windows comes back from suspension

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
gsingla
Posts: 2
Joined: 22 May 2016, 22:26

D disk reformated automatically after Windows comes back from suspension

#1 Post by gsingla »

Hello all and thanks for your help,

First question: Is it possible to recover the filesystem when windows has just formatted a new one?

Yesterday, I switch on Windows and I let it on rest mode. Today, when I opened it, I saw that the whole D:/ was totally empty... (no need to say that with pretty important info and no backup!...and yes, I know how stupid I am...). It looks like windows has just wiped all my data...wtf

I really hope you can help me with this. I've been looking for similar topics. The most relevants are:
1. help-drive-too-small-partition-ends-aft ... -t325.html
2. viewtopic.php?f=6&t=5376&p=17570&hilit= ... all#p17570
3. viewtopic.php?t=5619
...but, unfortunately, I'm totally stuck and I cannot find a similar case.

Some details :
- I was using 2 physical HDs. First HD (C:) has some partitions with a Windows 7 and a Ubuntu 14.04. (64b). I guess not relevant.
- I believe windows tried to install some updates.
- The second HD (D:) is used as data storage and to cross. Formatted as NTFS. Only one partition.

I'm passing testdisk on that hard drive (D:), using Ubuntu. I do the following:
- I execute analysis and quick search:
- testdisk finds a primary partition, but it corresponds to the "new" partition. Totally empty with no files.
- I go for a deeper scan. Finds another partition table. I wish it's the good one...
- When the search stops, the message "The harddisk seems too small!" appears and I can do nothing else.

If I try to go to advance. Only the first partition table is found. So, no data is there, and don't think RebuildBS is a good idea then. I attach the result of the deep search in case is useful. So I'm pretty much stuck there.

How can I continue? What should be the next recommended step?

Thanks for your help,
Kind regards,
Garbí

Code: Select all

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
BAD_RS LBA=486619357 18446744073709551615
check_part_i386 failed for partition type 07
     HPFS - NTFS          30290 166 50 235812  55 47 3301703935
This partition ends after the disk limits. (start=486619357, size=3301703935, end=3788323291, disk end=1953525168)
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1939 GB / 1806 GiB)
The following partition can't be recovered:
     HPFS - NTFS          30290 166 50 235812  55 47 3301703935

Results
   * HPFS - NTFS              0  32 33 121601  25 
Attachments
diskrecovery_testdisk_deppersearch_1.png
diskrecovery_testdisk_deppersearch_1.png (51.01 KiB) Viewed 2025 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: D disk reformated automatically after Windows comes back from suspension

#2 Post by cgrenier »

Try TestDisk, Advanced, Undelete.
If no file is found, try PhotoRec instead. Note that you will need to store the recovered files on another disk.

gsingla
Posts: 2
Joined: 22 May 2016, 22:26

Re: D disk reformated automatically after Windows comes back from suspension

#3 Post by gsingla »

cgrenier, Thanks for your quick reply.

I'm already trying photorec but I'd like to recover the whole filesystem. Photorec does find lots of files and stuff, so that's pretty cool.
Unfortunately, this disk is full of c code as well, just plain text. I'm not sure whether I would be able to restore my projects with the result of photorec. Advice is appreciated.

About my first question, sorry if it's too dummy. Windows seems to have created another NTFS partition where it was already one.
Theoretically, Is it possible to recover a filesystem when windows has just formatted a new one?

I will try advance/undelete as soon as photorec finishes. Thx for the tip.

Regards,
Garbí

Locked