cgsecurity.org

Hi there,

(First of all, if this post is in the wrong section, please move it to the right one.)

Despite reading wiki articles, I'm really not sure what to do in this current situation.

Details & History:
Windows partition became empty probably after a bad linux distro installation (even though it was specified to be installed on right drive and not to wipe detected OS). After that, Bootrec & Chkdsk may have 'worsen' it.
GetDataBack Simple shows some files (mostly chkdsk logs) but nothing like it should be (Windows folders and files). (Curious fact: during GBD recovery scanning, thumbnails of some image files (photos) which 'were' in this partition, were shown.)

Current situation:
TestDisk log should detail it better than I would.
PS: I added some comments at the end of the log.

If you select F:, choose None for the partition table type as there is no partitions inside a partition.
If you select the PhysicalDrive, choose PC/Intel or EFI GPT.

Hello again.

I'm sorry about not replying this post for over a week.

At first I didn't understand the answer but then I looked at this guide (Undelete files from NTFS with TestDisk) and managed to recover most if not all the data I needed.

I did another recovery using Recuva to maintain folder structure and while looking at the state of the files, I bumped on this:
$BadClus has actually the size of the partition which 'became' empty. (Date is incorrect but I believe the data is there.)

My question now is: should I backup the entire disk before attempting to recover and/or rebuild NTFS boot sector/MFT of this partition or it's safe to do as it is?

I really appreciate any help you can provide.