Partition can't be recovered! Any advice? Thanks.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Partition can't be recovered! Any advice? Thanks.

#1 Post by Cathal »

Hi there everyone,

I see on the forum that you have been of great assistance to a number of people who have problems with data recovery. I'm hoping you can give me some advice on how best to use TestDisk. I'm not a whizzkid by any means so I apologize in advance if what I did seems stupid - I know it was. I will explain my problem and what I have done so far. In organising my backups, I made a terrible mistake. I have a nearly full 2 TB Seagate external drive which stores video files (which I will call Drive A) and a second 2TB drive which was a backup of the first drive (Drive B). I reorganised Drive A, updating folders, deleting older material etc. Then I wanted to clone this to Drive B as the backup. This is when my thought process failed me. I began by formatting Drive B using disk utility (iMac (2.8 Ghz Core i7) running Mac OS X 10.6.8).

When this completed, I accidentally began the process of formatting Drive A! Utterly stupid I know. I'll never know why I did this. It is like my brain new this was a crazy thing to do and subconsciously made me do it. I immediately panicked and pulled the cable from Drive A. It had only begun the formatting process by perhaps two or three seconds. After my panic subsided, in a cold sweat I tried to mount Drive A and of course it would not mount.

I have been at my wits end for the past week in trying to find a solution. These are the steps I have taken. I used Data Rescue 3 to do a deep scan on Drive A and then copy the "Found Files" to a new 2TB drive I bought (Drive C). It all looked really promising. All the data seemed to be recovered. However, when I mounted Drive C and tried to open any of the files, it says "This is not a movie file". Something has been corrupted. The files are the correct size and are in the correct folders, but none will open. I read online that TestDisk could be a solution, but I am not a computer expert (and from what I did with hard drive - perhaps a computer idiot). I have run a TestDisk scan on Drive C and these seem to be the results/problems:

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
Partition Start End Size in sectors
>D FAT32 LBA 6 76805 76800 [EFI]
D HPFS - NTFS 2048 488376319 488374272 [Seagate Expansion Drive]
D HFS 76806 488345871 488269066

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
Partition Start End Size in sectors
No partition found or selected for recovery

The following partition can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 488376319 976750590 488374272
Structure: Ok.

Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 6 76805 76800 [EFI]
check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD)
FAT32 LBA 12 76811 76800 [EFI]
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
HPFS - NTFS 2048 488376319 488374272 [Seagate Expansion Drive]


I can submit the full log if you think it would help more. Could anyone be of assistance? Should I run some TestDisk scans on the original drive (Drive A)? I'm afraid to make any changes to drive A as I understand that writing new data to it could destroy my files for good. I'm fully aware that you offer advice on TestDisk and that you are not a data recovery service so I appreciate any advice you can give and thank you in advance for your time.

Kindest regards,

Cathal

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Partition can't be recovered! Any advice? Thanks.

#2 Post by Fiona »

Efi is a system partition only and probably doesn't contain any important data.
Did you try to list your files of your NTFS-partition?

Fiona

Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Re: Partition can't be recovered! Any advice? Thanks.

#3 Post by Cathal »

Hi guys

I have tried to follow your advice but I do not seem to get anywhere. I ran a deep scan on the HFS partition and this was the result:
Disk /dev/disk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2009 GB / 1871 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

HFS 109581 488378646 488269066

HFS 109611 488378676 488269066

HFS 109615 488378680 488269066

HFS 109619 488378684 488269066

HFS 109623 488378688 488269066

HFS 109627 488378692 488269066

HFS 109631 488378696 488269066

HFS 109636 488378701 488269066

HFS 109648 488378713 488269066

HFS 109665 488378730 488269066

[ Continue ]

HFS+ blocksize=4096, 1999 GB / 1862 GiB

When I press continue I get this:

Disk /dev/disk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)

Partition Start End Size in sectors

D DOS_FAT_32 6 76805 76800 [EFI]

D DOS_FAT_32 12 76811 76800 [EFI]

D HFS 76806 488345871 488269066

>D HFS 91724 488360789 488269066

D HFS 91735 488360800 488269066

D HFS 91749 488360814 488269066

D HFS 91763 488360828 488269066

D HFS 91789 488360854 488269066

D HFS 91804 488360869 488269066

D HFS 91821 488360886 488269066

D HFS 91831 488360896 488269066

D HFS 91840 488360905 488269066

D HFS 91874 488360939 488269066

D HFS 91886 488360951 488269066

D HFS 91890 488360955 488269066

D HFS 91896 488360961 488269066

D HFS 91902 488360967 488269066

D HFS 91918 488360983 488269066

D HFS 91931 488360996 488269066

D HFS 91949 488361014 488269066

D HFS 91971 488361036 488269066

D HFS 91989 488361054 488269066

D HFS 92003 488361068 488269066

D HFS 92023 488361088 488269066

D HFS 92037 488361102 488269066

D HFS 92055 488361120 488269066

D HFS 92073 488361138 488269066

D HFS 92094 488361159 488269066

D HFS 92107 488361172 488269066

D HFS 92127 488361192 488269066

D HFS 92229 488361294 488269066

D HFS 92264 488361329 488269066

And this list goes on and on, this is just a part of it.

I also got this result when I do a quick search of the drive:

check_FAT: Unusual media descriptor (0xf0!=0xf8)
Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD) EFI System 6 76805 76800 [EFI] check_FAT: Unusual media descriptor (0xf0!=0xf8) Warning: number of heads/cylinder mismatches 16 (FAT) != 1 (HD) Warning: number of sectors per track mismatches 32 (FAT) != 1 (HD) EFI System 12 76811 76800 [EFI] Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD) Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD) MS Data 2048 488376319 488374272 [Seagate Expansion Drive]
and this

The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in sectors
> MS Data 488376319 976750590 488374272
[ Continue ]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Could anyone give me some advice? I have been trying this for a week and have had no success. To be honest I am blind as I am following advice on blogs and can't seem to make any progress. Is there anyway to reconstruct the partition so that it can read? I have tried data rescue 3 but although it does rescue the files - none of them work.
What I need from the drive are .mov files between 5gb and 30gb. All my files are listed on the drive when it mounts - but none will play.

I would appreciate any advice.

Kindest regards,

Cathal

Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Re: Partition can't be recovered! Any advice? Thanks.

#4 Post by Cathal »

something seems to have happened - or I must have scanned in another manner: I got this

Disk /dev/rdisk2 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
Partition Start End Size in sectors
D EFI System 6 76805 76800 [EFI]
D EFI System 12 76811 76800 [EFI]
>D MS Data 2048 488376319 488374272 [Seagate Expansion Drive]
D Mac HFS 76806 488345871 488269066
D Mac HFS 91724 488360789 488269066
D Mac HFS 91735 488360800 488269066
D Mac HFS 91749 488360814 488269066
D Mac HFS 91763 488360828 488269066
D Mac HFS 91789 488360854 488269066
D Mac HFS 91804 488360869 488269066
D Mac HFS 91821 488360886 488269066
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, blocksize=4096, 2000 GB / 1863 GiB


When I choose to list the files on the Seagate Expansion Drive I get this:

MS Data 2048 488376319 488374272 [Seagate Expansion Drive]
Directory /

>dr-xr-xr-x 0 0 0 21-Feb-2014 11:53 .
dr-xr-xr-x 0 0 0 21-Feb-2014 11:53 ..
dr-xr-xr-x 0 0 0 21-Feb-2014 07:17 Seagate
-r--r--r-- 0 0 182 23-Feb-2012 10:07 Autorun.inf
-r--r--r-- 0 0 1644118 5-Mar-2012 07:44 SeagateExpansion.ico
-r--r--r-- 0 0 156312 16-Jan-2009 08:14 Setup.exe
This is strange? Why does it not list all the files and folder I see when I mount the drive?

Thanks in advance for any advice or tips.

Cathal

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Partition can't be recovered! Any advice? Thanks.

#5 Post by Fiona »

That's a NTFS-Partition.
Would it be possible that you've had only a Mac-partition?
Please confirm in TestDisk at Analyse and your current partition structure (partition table) appears.
Can you upload your testdisk.log or create a screen shot and uploading it?

If you were formatting you disk exactly like beforem, it might be possible that your previous file system is overridden.
In case only datarecovery might help.

Can you scan your disk using PhotoRec.
Some information:
http://www.cgsecurity.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
Please let me know, have you been able to recover lost files?
PhotRec doesn't keep file names and directories, thaht's why you have to check your files manually.
You can use PhotoRec and FileOpt to determine what kind of files you'd like to recover.
In FileOpt pleas press s to deselect all file types and mark only these file types where you´d like to recover.

Fiona

Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Re: Partition can't be recovered! Any advice? Thanks.

#6 Post by Cathal »

Hi Fiona,
Thanks for getting back to me. I have made no progress since. I will first answer your questions:
Would it be possible that you've had only a Mac-partition?
Yes. At least I think it is only a Mac partition. I always format my drives as Mac OS Extended (Journaled) in Disk Utility.
Please confirm in TestDisk at Analyse and your current partition structure (partition table) appears.
This is what I get from TestDisk:
Disk /dev/rdisk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO), sector size=4096
Partition table type (auto): EFI GPT Media is opened in read-only.
Disk /dev/disk1 - 2000 GB / 1863 GiB (RO)
Partition table type: Mac
Interface Advanced New options :
Dump : No Align partition: Yes Expert mode : No
Analyse Disk /dev/disk1 - 2000 GB / 1863 GiB - 488378645 sectors (RO)
Current partition structure: Bad MAC partition, invalid block0 signature read_part_mac: bad DPME signature
Does that help in any way?
Can you upload your testdisk.log or create a screen shot and uploading it?
I have been trying to upload the log files since I first wrote to you on both the forum page and in pm - however it says
The extension log is not allowed
Even if I try to send txt of a pdf. Any advice on how to attach the log?
If you were formatting you disk exactly like beforem, it might be possible that your previous file system is overridden.
Perhaps. I have no idea. What should I do?
In case only datarecovery might help.
Can you scan your disk using PhotoRec.
I can give it a go to see but I imagine it will take 50 hours, like TestDisk did.
Please let me know, have you been able to recover lost files?
Yes. I have used Data Rescue software to clone the drive and then I scanned the cloned drive to extract the files. This is the problem. The cloned drive has all the file and the folders. It appears to mount perfectly. However, when I try to open any of the quicktime files, it says this is not a movie file. Nothing opens. When I use Data Rescue software to reconstruct the files - these work. However, I only get a small percentage of the orignal files, and none of the larger files. The largest this returns is a 9GB QT file - I have files that go up to 30GB.
PhotRec doesn't keep file names and directories, thaht's why you have to check your files manually.
You can use PhotoRec and FileOpt to determine what kind of files you'd like to recover.
In FileOpt pleas press s to deselect all file types and mark only these file types where you´d like to recover.
I will try PhotoRec and see what happens. Let me know if I can send you the logfile somehow. Just to recap on my situation - I’m trying to recover circa 1.8 TB of data from a 2 TB Seagate Expansion Drive that was accidentally formatted. It began formatting using Mac OS Extended (Journaled) but within three seconds, when the mistake was realized it was unplugged while still mounted. This is what caused the problem.

I would love any advice. Thank you for your time.

Kindest regards

Cathal

Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Re: Partition can't be recovered! Any advice? Thanks.

#7 Post by Cathal »

Hi Fiona,
A final question. Should I work on the original drive that had the data or the one I have cloned? I have been using the cloned drive so that if any mistake happens, I still have the original drive as it was when the disaster happened.
Kindest regards
Cathal

Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Re: Partition can't be recovered! Any advice? Thanks.

#8 Post by Cathal »

Hi there guys
I used PhotoRec and set it to search only .mov files.
The type of files recovered were like these:
f2157282_ftyp.mov
f2252524_wide.mov
f2796883_moov.mov
f4686870_free.mov
They do not open except for some of the _ftyp.mov files.
Do you have any advice?
Kindest regards
Cathal

Cathal
Posts: 7
Joined: 20 Nov 2014, 09:55

Re: Partition can't be recovered! Any advice? Thanks.

#9 Post by Cathal »

Hi Fiona et al
I used PhotoRec but only a handful of .mov files can actually play. The vast majority of the files are corrupted somehow - they do not play. Is there any way to have PhotoRec extract files that work? It took it about 2 full days to extract them. Any advice?
Thanks

Locked