Deep Search shows tons of deleted partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Deep Search shows tons of deleted partitions

#1 Post by manuyavuz »

Hi all,

I've accidentally repartitioned my external drive, and trying to recover using testdisk.

I've run "Quick Search", and it showed only currently active partitions, there were no deleted partitions.

Then I've run "Deep Search", this time it found thousands of deleted partitions whose sector sizes are the same but start/end values are shifted by some margin.

And because the partition that I want to save is an HFS partition, I can't try using "list" option and detecting which of the listed partitions will show the file list.

How can I detect which of the partitions is the true one?
Result of "Quick Search"
Result of "Quick Search"
quicksearch.jpg (168.24 KiB) Viewed 7978 times
Warning after "Deep Search" completion
Warning after "Deep Search" completion
deepsearcherror.jpg (145.01 KiB) Viewed 7978 times
Result of "Deep Search"
Result of "Deep Search"
deepsearch.jpg (177.2 KiB) Viewed 7978 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deep Search shows tons of deleted partitions

#2 Post by cgrenier »

To find the correct HFS+ partition, you should try the partition where "+ Backup" is listed on the last line of the screen when highlighted.

manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Re: Deep Search shows tons of deleted partitions

#3 Post by manuyavuz »

Thanks for the fast response!

So I'll move with the following partitions:

Code: Select all

>P EFI System                    40     409639     409600 [EFI] (Which can list files via "p" button)
>P Mac HFS                   411648  488692895  488281248 (HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB)
>P Mac HFS                488955040 1465517535  976562496 (HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB)
>P Mac HFS               1465779680 1758486527  292706848 (HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB)
>P MS Data               1758748672 1953523711  194775040 (exFAT, blocksize=131072, 99 GB / 92 GiB) (Which can list files via "p" button)
Changing these from Deleted to Primary and then continuing would be enough right?

manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Re: Deep Search shows tons of deleted partitions

#4 Post by manuyavuz »

I've tried to write new partition table but write failed with "write error" message.

By the way, I see that the above partition table which I selected from deleted partitions seems to be exactly the same with current partition structure, which is the folowing:

Code: Select all

 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   411648  488692895  488281248 [Apple_HFSX_Untitled_2]
 3 P Mac HFS                488955040 1465517535  976562496 [TimeMachine]
 4 P Mac HFS               1465779680 1758486527  292706848 [MacMini]
 5 P MS Data               1758748672 1953523711  194775040 [windows]
 
What should I do to be able to correctly write deleted partition and reach the files?

manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Re: Deep Search shows tons of deleted partitions

#5 Post by manuyavuz »

Hi again,

I had to run a Deeper Search from scratch. Here is the full log file :
testdisk.log.zip
(53.55 KiB) Downloaded 279 times
Is it possible to switch only one partition from deleted to primary? I really need to save only one partition, namely the following (most probably):

Code: Select all

HFS+ magic value at 1465517534/0/1
part_size 976562496
     Mac HFS                488955040 1465517535  976562496
     HFS+ found using backup sector!, 499 GB / 465 GiB
which has the same Start/End sectors with the current partition table:

Code: Select all

 Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   411648  488692895  488281248
     HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB
   P Mac HFS                488955040 1465517535  976562496
     HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
   P Mac HFS               1465779680 1758486527  292706848
     HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB
   P MS Data               1758748672 1953523711  194775040
     exFAT, blocksize=131072, 99 GB / 92 GiB
How should I continue now? Would switching only the above partition work without switching EFI System to primary?

Locked