Help needed to recover files by TestDisk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
cpighin
Posts: 7
Joined: 01 Nov 2016, 18:00

Help needed to recover files by TestDisk

#1 Post by cpighin »

Hi!

Background
I have a new ASUS PC with Windows 8.1 and 1 HD of 1TB, on which I installed Ubuntu 16.04.1 in dual boot mode, with the intention of using the DATA partition to store files generated by both systems.

My problem.
Some days ago, I turned on Windows from Ubuntu and I found that all files in the partition had been erased except those created by Windows.
Before groping the recovery of files I tried to copy the contents of the partition on other support, by DD commands. During the first attempt to copy I made a mistake: I set as destination for copy the DATA partition itself. After a few seconds I realized the error and I stopped the process, hoping not to have done much damage. Then I successfully copied the DATA partition on other external media.
In summary, the DATA partition suffered two incidents: the intervention of Windows data deletion (I do not have the certainty, but I can not find other explanation) and the writing of a small part of the partition by DD.
So with difficulties given by my inexperience, I started making attempts to partition recovery, firstly with TestDisk, then with QPhotoRec (I have written in this topicviewtopic.php?f=5&t=6624, then I went back to try using TestDisk 7.0-1.
A few days ago GParted reported following strucure of the disk
Image
This morning I started TestDisk and I got the following screen after performing Quick Search(Partition DATA should be the one with the right arrow)

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
 D FAT32                    0  32 33    12 223 19     204800 [SYSTEM]
 D HPFS - NTFS             12 223 20   127 155 28    1843200
 D HPFS - NTFS            143 236 30 26606 103 57  425119744
 D Linux Swap           26606 103 58 28136  49  9   24576000
 D Linux                28136  49 10 33298 245 35   82939904
>D HPFS - NTFS          33299  55 37 119641 178 25 1387091968
 D HPFS - NTFS          119641 210 58 121601  57 56   31477760

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS, blocksize=4096, 710 GB / 661 GiB
I modified the characteristic of the highlighted partition, from D (Deleted) to P (Primary), then I pressed ENTER.
TestDisk answered "No partition found or selected for recovery". Then I started the Deep Search, lasting about 3 hours, and I got:

Code: Select all

Warning: the current number of heads per cylinder is 255
but the correct value may be 8.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
Continuing i got a very long list as follow:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
>* FAT32                    0  32 33    12 223 19     204800 [SYSTEM]
 P HPFS - NTFS             12 223 20   127 155 28    1843200
 D HPFS - NTFS            143 236 30 26606 103 57  425119744
 D HPFS - NTFS            143 236 30 48784  54 38  781406208
 D HPFS - NTFS          26606 103 57 53068 226 21  425119744
 D Linux Swap           26606 103 58 28136  49  9   24576000
 D HPFS - NTFS          26606 103 58 28136  49  9   24576000
 D Linux                28136  49 10 33298 245 35   82939904
 D HPFS - NTFS          28199 238  8 33299  55 36   81920000
 D Linux                30503 169  3 35666 110 28   82939904
 D Linux                30505  16 40 35667 213  2   82939904
 D Linux                30513  89 41 35676  31  3   82939904
 D Linux                30513 154 42 35676  96  4   82939904
 D Linux                30514 127 14 35677  68 39   82939904
 D Linux                30515 164 50 35678 106 12   82939904
 D Linux                30516 104 53 35679  46 15   82939904
 D Linux                30518  82 29 35681  23 54   82939904
 D HPFS - NTFS          33299  55 37 119641 178 25 1387091968
 D Linux                48315 117 59 48562   3 17    3960832
 D HPFS - NTFS          48784  54 39 119641 210 57 1138327552
 D FAT16 LBA            53100  30 51 53107  66 15     114688 [boot]
 D Linux                53957 241 45 54204 127  3    3960832
 D Linux                53997 119 11 54244   4 32    3960832
 D Linux                58788 224 61 59035 110 19    3960832
 D Linux                58794 190 21 59041  75 42    3960832
 D Linux                63338 215 46 63585 101  4    3960832
 D Linux                67845 151 19 68092  36 40    3960832
 D Linux                67865 252 36 68112 137 57    3960832
 D Linux                70909  62  2 71742  21 23   13379584 [root]
 D Linux                75837 178 54 76313 248 31    7651328
 D Linux                75843 111 45 76319 181 22    7651328
 D Linux                80804   5 34 81156 194 62    5666816 [root]
 D Linux                81952  32  1 82304 221 29    5666816 [root]
 D Linux                85836 226 23 86189 160 51    5666816 [root]
 D Linux                85837  36 24 86189 225 52    5666816 [root]
 D Linux                85851   9 47 86203 199 12    5666816 [root]
 D Linux                85851  74 48 86204   9 13    5666816 [root]
 D Linux                85855  29 63 86207 219 28    5666816 [root]
 D Linux                88297   1  1 88649 254 63    5670882 [root]
 D Linux                88297   9 33 88649 198 61    5666816 [root]
 D Linux                88298  79 38 88651  14  3    5666816 [root]
 D Linux                88299  52 10 88651 241 38    5666816 [root]
 D Linux                88309 167 51 88662 102 16    5666816 [root]
 D Linux                88310  42 53 88662 232 18    5666816 [root]
 D Linux                88310  75 22 88663   9 50    5666816 [root]
 D Linux                88324  48 45 88676 238 10    5666816 [root]
 D Linux                88324 113 46 88677  48 11    5666816 [root]
 D Linux                88325 183 51 88678 118 16    5666816 [root]
 D Linux                88337 114 34 88690  48 62    5666816 [root]
 D Linux                88338  87  6 88691  21 34    5666816 [root]
 D Linux                88355  75 41 88708  10  6    5666816 [root]
 D Linux                88356  48 13 88708 237 41    5666816 [root]
 D Linux                88356 113 14 88709  47 42    5666816 [root]
 D Linux                88359  30 56 88711 220 21    5666816 [root]
 D Linux                90071 149 63 90904 109 21   13379584 [root]
 D Linux                90072  90  3 90905  49 24   13379584 [root]
 D Linux                91982 236 31 92335 170 59    5666816 [root]
 D Linux                92466 151 38 93299 110 59   13379584 [root]
 D Linux                92467  91 41 93300  50 62   13379584 [root]
 D Linux                92937  98 26 93290  32 54    5666816 [root]
 D Linux                92939  11  1 93291 200 29    5666816 [root]
 D Linux                92939 238 36 93292 173  1    5666816 [root]
 D Linux                93411 222 60 93764 157 25    5666816 [root]
 D Linux                93412  97 62 93765  32 27    5666816 [root]
 D Linux                93415 210 44 93768 145  9    5666816 [root]
 D Linux                93417 253 21 93770 187 49    5666816 [root]
 D Linux                93420 236  1 93773 170 29    5666816 [root]
 D Linux                93421  13 33 93773 202 61    5666816 [root]
 D Linux                93421  46  2 93773 235 30    5666816 [root]
 D Linux                93423 218 44 93776 153  9    5666816 [root]
 D Linux                93424  28 45 93776 218 10    5666816 [root]
 D Linux                93424 191 16 93777 125 44    5666816 [root]
 D Linux                93425  33 49 93777 223 14    5666816 [root]
 D Linux                93425 163 51 93778  98 16    5666816 [root]
 D Linux                93702 136  3 94178 205 43    7651328
 D Linux                93702 201  4 94179  15 44    7651328
 D Linux                93702 233 36 94179  48 13    7651328
 D Linux                93703  76  6 94179 145 46    7651328
 D Linux                93703 238 40 94180  53 17    7651328
 D Linux                93704 146 11 94180 215 51    7651328
 D Linux                93704 243 44 94181  58 21    7651328
 D Linux                93707 128 54 94183 198 31    7651328
 D Linux                94186 116 11 94662 185 51    7651328
 D Linux                94186 181 12 94662 250 52    7651328
 D Linux                94186 213 44 94663  28 21    7651328
 D Linux                94187  56 14 94663 125 54    7651328
 D Linux                94187 218 48 94664  33 25    7651328
 D Linux                94188 126 19 94664 195 59    7651328
 D Linux                94188 223 52 94665  38 29    7651328
 D Linux                94191 108 62 94667 178 39    7651328
 D Linux                94673   1  1 95149 254 63    7662942
 D Linux                94673 176 32 95149 246  9    7651328
 D Linux                94674 116 35 95150 186 12    7651328
 D Linux                94674 214  5 95151  28 45    7651328
 D Linux                94677  99 15 95153 168 55    7651328
 D Linux                95154 173 60 95630 243 37    7651328
 D Linux                95158  31 42 95634 101 19    7651328
 D Linux                95652  62 27 96128 132  4    7651328
 D Linux                96140  62 51 96616 132 28    7651328
 D Linux                99529  58 50 99775 199  8    3960832
 D Linux                101472   0  1 101718 254 63    3968055
 D Linux                101949 219 31 102426  34  8    7651328
 D Linux                102436  84 49 102912 154 26    7651328
 D Linux                103249 235 27 103726  50  4    7651328
 D Linux                103250  45 28 103726 115  5    7651328
 D Linux                103252 185 38 103729   0 15    7651328
 D Linux                103254   0 43 103730  70 20    7651328
 D Linux                103257 145 57 103733 215 34    7651328
 D Linux                103269  11 39 103745  81 16    7651328
 D Linux                105646 214 41 106123  29 18    7651328
 D Linux                105647 122 12 106123 191 52    7651328
 D Linux                105648 224 49 106125  39 26    7651328
 D Linux                105649  99 51 106125 169 28    7651328
 D Linux                105649 132 20 106125 201 60    7651328
 D Linux                105650   7 22 106126  76 62    7651328
 D Linux                105652 147 32 106128 217  9    7651328
 D Linux                105653  22 34 106129  92 11    7651328
 D Linux                108032 138 11 108508 207 51    7651328
 D Linux                108045 106 30 108521 176  7    7651328
 D Linux                108058 237 20 108535  51 60    7651328
 D Linux                108072 243 12 108549  57 52    7651328
 D Linux                108082 163 50 108558 233 27    7651328
 D Linux                110237  22 58 110483 163 16    3960832
 D Linux                112579  81 15 112825 221 36    3960832
 D Linux                112586  84 11 112832 224 32    3960832
 D Linux                114863 170 60 115110  56 18    3960832
 D Linux                117152 155 60 117399  41 18    3960832
 D Linux                117166 226 53 117413 112 11    3960832
 P HPFS - NTFS          119641 210 58 121601  57 56   31477760

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
FAT32, blocksize=1024, 104 MB / 100 MiB
I scroll the list until the one that I considered to be the DATA partition (the 15th from the top) since the last line of the screen reported the notation:

Code: Select all

NTFS, blocksize = 4096, 710 GB / 661 GiB
I pressed P getting the list of well-known Windows files, I went back to the previous page, and I changed the characteristic of the partition from D (Deleted) to P (Primary), then I hold key P to see the list of file and I got exactly the same list as before, I went back to the previous page and pressed ENTER and here is the resulting screen:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63

     Partition                  Start        End    Size in sectors

 1 * FAT32                    0  32 33    12 223 19     204800 [SYSTEM]
 2 P HPFS - NTFS             12 223 20   127 155 28    1843200
 3 P HPFS - NTFS          33299  55 37 119641 178 25 1387091968
 4 P HPFS - NTFS          119641 210 58 121601  57 56   31477760


>[  Quit  ]  [ Write  ]
                              Return to main menu
Now, since I am not expert I would like help before doing next risky steps.

My first question is: Standing data provided by TestDisk, do you think that my Partition DATA is recoverable or I have to consider my files as lost ?

Furthermore: If I would continue the TestDisk activity by allowing the Write process, would I run the risk to damage also other partitions?

Claudio :)

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Help needed to recover files by TestDisk

#2 Post by cgrenier »

Try TestDisk, Advanced, Undelete on your partition. Maybe you will be able to copy your lost files.

cpighin
Posts: 7
Joined: 01 Nov 2016, 18:00

Re: Help needed to recover files by TestDisk

#3 Post by cpighin »

Thanks :)

Unfortunately choosing option Advanced I got

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63

     Partition                  Start        End    Size in sectors
> 1 P EFI GPT                  0   0  2 121601  80 63 1953525167


 [  Type  ] >[Image Creation]  [  Quit  ]
                                Create an image
where is not a possibility to select my partition :( I see only options: Type,Image Creation, Quit.

Am I doing something wrong?

Claudio :)

cpighin
Posts: 7
Joined: 01 Nov 2016, 18:00

Re: Help needed to recover files by TestDisk

#4 Post by cpighin »

Addition to previous message

I run TestDisk 7.1WIP and I got the same result reported above.

Claudio :)

Locked