Windows Partition nuked

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mattdhorstman
Posts: 1
Joined: 13 Sep 2014, 20:56

Windows Partition nuked

#1 Post by mattdhorstman »

Personal Backgound:
I have a degree in CS, and consider myself an advanced user. I am comfortable navigating in Ubuntu and on the command line (although I spend the majority of my time in Windows). That's what makes this mistake feel extra stupid.

Issue Background:
I dual boot my Lenovo (v570) laptop between Windows 7 and Ubuntu (previously ver 12.xx). I used Grub and had no issues with the previous setup. Yesterday I attempted to update Ubuntu to version 14.04.1 LTS (it had been awhile since I had been in Linux). I started the installation from inside of the Ubuntu installation, and the installation process failed. I'm unsure of the issue, but it went black, then went to the lock screen, but wouldn't let me log back in. So I rebooted into Windows (grub still worked and had all entries), grabbed the latest ISO install, popped it on a USB stick and rebooted into a live session, and installed. Ubuntu detected a previous installation of 14.04.1 and asked if I wanted to overwrite... I selected yes, because I was unaware of this bug...

https://bugs.launchpad.net/ubuntu/+sour ... ug/1265192

I had assumed it would use the previous partitions. But sadly it did not, and it wiped out my Windows partition.

Most of my data gets backed up, or lives in the cloud, but there is some non-backed up data that is irreplaceable that I would like to retrieve if possible.

NOTE: I used the installed version of Ubuntu for an hour or so before coming across information advising not to do that, I understand that this could cause an even larger loss of data.

Current Steps Taken:
I am currently running off of a live session of Ubuntu 14.04.1, I have an external HDD with enough space to copy any files that need backing up (or an entire image of the drive if necessary).

I found many answers to similar questions that pointed to this tool, and while the documentation for testdisk is good, I'm out of my depth here and thought I would come to the forums for help.

Here are the steps I've taken... and album of screenshots appears here:
http://imgur.com/a/ALoCk

0. I scanned the harddrive with GParted (http://i.imgur.com/SABdbL5.png)
1. I ran testdisk
2. I selected the drive from the list, it appears multiple times and I selected the /dev/sda listing (http://i.imgur.com/2examEx.png)
3. I selected EFI GPT because that is what was auto detected. (http://i.imgur.com/GqOOGQy.png)
4. The current Structure was identified (http://i.imgur.com/ARR5wON.png)
5. I ran a quick search which yielded the result seen in (http://i.imgur.com/eAqKRrT.png)
6. I ran a deep search which returned a lot of results labeled MS DATA, I attempted to use 'p' to view the files in one of these resutls and testdrive exited to the terminal prompt (No Image).
7. I re-ran testdrive and selected [Intel ] Partition type, because I thought maybe it meant the 'previous' partition. It returned the following structure: (http://i.imgur.com/nHf8IJI.png)
8. I ran a quick search and recieved the following results: (http://i.imgur.com/ex9zQ4O.png)
9. I ran a deep search, after going to a page where it listed several Linux partitions that could not be recovered, I was presented with this results screen: (http://i.imgur.com/jXoQiAp.png)
10. I selected the second HPFS - NTFS listing and attempted to 'P' list files, and testdisk crashed out to the terminal prompt.

That is where I am currently, I can run another deep search if necessary, but they take several hours to complete, and there is a sense of diminishing returns for time vs. the small amount of un-recoverable data.

Any advice for proceeding would be greatly appreciated. I can provide any additional information if necessary.

NOTE: I did not copy the logfile before attempting to restart testdisk, so it was overwritten. :(

~Matt

Locked