Data recovery on re-partitioned drive.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Bridden
Posts: 2
Joined: 03 Oct 2016, 15:14

Data recovery on re-partitioned drive.

#1 Post by Bridden »

Hello all,

So I need some advice, and I'll start with why I need it.
A couple of days ago I was using Acronis to clone a hard drive over to a new SSD. (done it many times with other software) I made the HUGE mistake of clicking on the destination as the source. So, this took a empty, blank partition and wrote over the hard drive I was supposed to be cloning FROM. I knew not to over write or anything, and I did make a bit-by-bit back-up before trying to recover.

Now, I have already ran a 'deeper' scan of the hard drive, which took many hours. I would attach the entire log, but it is 1500 lines. This is the very end of the log.
interface_write()
P NTFS 0 0 1 38912 253 62 625137281
P NTFS 5 24 21 100 245 18 1540096
P NTFS 29 174 22 30 17 21 6174
P NTFS 30 17 21 30 115 20 6174 [Boot]
P NTFS 31 70 60 31 168 59 6174
P NTFS 31 168 59 32 11 58 6174 [Boot]
P NTFS 100 245 18 196 211 15 1540096
P HFS 230 15 15 752 57 48 8388610 [ÿÿÿºD]
P FAT12 1131 86 32 1132 160 43 20739 [NO NAME]
P HFS 2798 67 21 3500 114 9 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 2814 110 24 3516 157 12 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 2853 55 9 3502 97 63 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 2869 98 12 3518 141 3 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P NTFS 3348 164 53 3349 7 52 6174
P NTFS 3349 7 52 3349 105 51 6174 [Boot]
P NTFS 3349 8 8 3349 106 7 6174
P NTFS 3349 106 7 3349 204 6 6174 [Boot]
P NTFS 3349 106 26 3349 204 25 6174
P NTFS 3349 204 25 3350 47 24 6174 [Boot]
P FAT12 3350 47 27 3350 93 8 2880 [EFISECTOR]
P FAT12 3350 93 9 3350 138 53 2880 [EFISECTOR]
P HFS 3500 114 6 4202 160 57 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3502 97 60 4151 140 51 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3516 157 9 4218 203 60 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3518 140 63 4167 183 54 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3530 190 20 4232 237 8 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3535 96 9 4237 142 60 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3541 242 61 4244 34 49 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3575 171 60 4277 218 48 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3585 178 8 4234 220 62 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3590 83 60 4239 126 51 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3596 230 49 4246 18 40 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3627 208 2 4591 23 62 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 3630 159 48 4279 202 39 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3641 201 45 4605 17 42 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 3753 78 61 4455 125 49 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 3808 66 49 4457 109 40 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 3963 185 8 4588 99 32 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 3977 178 51 4602 93 12 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 4110 187 17 4600 93 56 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 4124 180 60 4614 87 36 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 4232 237 5 4935 28 56 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 4234 220 59 4884 8 50 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 4237 142 57 4939 189 45 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 4239 126 48 4888 169 39 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 4244 34 46 4946 81 34 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 4246 18 37 4895 61 28 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 4277 218 45 4980 10 33 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 4279 202 36 4928 245 27 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 4455 125 46 5157 172 34 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 4457 109 37 5106 152 28 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 4588 99 29 5213 13 53 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 4591 23 59 5554 94 56 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 4600 93 53 5090 0 29 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 4602 93 9 5227 7 33 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 4605 17 39 5568 88 36 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 4614 87 33 5103 249 9 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 9127 18 61 9751 188 22 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 9218 37 27 9920 84 15 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9231 131 44 9933 178 32 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9236 37 41 9938 84 29 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9240 198 38 9942 245 26 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9245 104 35 9947 151 23 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9273 25 15 9922 68 6 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9286 119 32 9935 162 23 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9291 25 29 9940 68 20 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9295 186 26 9944 229 17 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9300 92 23 9949 135 14 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9751 188 19 10376 102 43 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 9916 89 23 10541 3 47 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 9920 84 12 10622 130 63 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9922 68 3 10571 110 57 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9933 178 29 10635 225 17 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9935 162 20 10584 205 11 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9938 84 26 10640 131 14 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9940 68 17 10589 111 8 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9942 245 23 10645 37 11 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9944 229 14 10594 17 5 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 9947 151 20 10649 198 8 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 9949 135 11 10598 178 2 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 10541 3 44 11165 173 5 10035232 [AZQBuAHQAcwAgAGEAbgBkACAAUw]
P HFS 11251 214 35 11954 6 23 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 11306 202 23 11955 245 14 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 11545 203 50 12247 250 38 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 11600 191 38 12249 234 29 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 11954 6 20 12656 53 8 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 11955 245 11 12605 33 2 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 12118 108 27 13081 179 24 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 12132 178 35 13095 249 32 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 12247 250 35 12950 42 23 11280580 [ATQBjAEgAYQBsAGUALABcAFwAbg]
P HFS 12249 234 26 12899 22 17 10428886 [Ty0JT/2vO7zOMYREeCItQwmnqnT]
P HFS 12601 87 42 13090 249 18 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 12615 157 50 13105 64 26 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 13081 179 21 14044 250 18 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 13090 249 15 13580 155 54 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
P HFS 13095 249 29 14059 65 26 15475066 [JUGVybWl0czsgQ29tcGxpYW5jZS]
P HFS 13105 64 23 13594 225 62 7865968 [gYmUgZW50aXRsZWQgdW5kZXIgQ2]
Let me know if you would like me to include any other.

There are a lot of partitions found, and originally, the drive originally had 3 NTFS partitions I believe. The majority of the NTFS partitions that were found were listed returned "Can't open filesystem. Filesystem seems damaged." when trying to browse.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Data recovery on re-partitioned drive.

#2 Post by cgrenier »

It looks like you have search partitions inside a partition.
When using TestDisk, you should select the PhysicalDrive and not a drive letter.
Choose EFI GPT or PC Intel for the partition table type.

Bridden
Posts: 2
Joined: 03 Oct 2016, 15:14

Re: Data recovery on re-partitioned drive.

#3 Post by Bridden »

That is exactly what I did. I did figure this out after posting the thread. It did seem to find the partition that I was missing.
Thanks for advising. I'll let you guys know how the recovery goes.

Locked