Recover lost NTFS partition (partly overwritten)

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
flow666
Posts: 2
Joined: 12 Oct 2017, 06:21

Recover lost NTFS partition (partly overwritten)

#1 Post by flow666 »

Hello everyone,

I'm currently in the process of recovering a lost NTFS partition on a disk of a friend. She tried to create a backup of her computer but for some reason the backup application created a 32GB FAT32 partition on her external harddrive and wrote the image (~4GB) into it. So the original 1000GB NTFS partition is gone now.

I started the recovery process by creating a raw copy of her harddisk on an empty one (original disk 1000GB, copied disk 2000GB), just to make sure I won't make things worse on the original. Then I performed a quick search with testdisk on it. This somehow found the original partition, however, testdisk stated "The harddisk (2000GB / 1863GB) seems too small! (<2000GB / 1863GB)" and "The following partition can't be recovered" where it lists the NTFS partition i'm looking for.
From what I researched on the net, I assume that this is because the new FAT32 partition is using some space the NTFS partition would need? Or is it because the copied disk is larger?
I also did a deeper search because I thought this would lead to success but it also just found the partition and told me it would not be possible to recover it.

Would it help to delete the FAT32 partition? Could that enable testdisk to recover the NTFS partition?
Is there something I could do here or do I have to fall back to file based recovery strategies? The FAT32 partition or the data on it does not matter, it can be deleted if necessary. I also know that some data on the NTFS partition is probably gone for good since it has been overwritten by the backup file.

This is the result of both the quick- and the deep search:
IMG_20171011_224331.jpg
IMG_20171011_224331.jpg (99.66 KiB) Viewed 2298 times
This is the testdisk logfile:
testdisk.zip
(1.8 KiB) Downloaded 294 times
Thanks in advance for the help,

Florian

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover lost NTFS partition (partly overwritten)

#2 Post by cgrenier »

As the data have been overwritten, you can use PhotoRec, enable the expert mode in Options, start a recovery on [Whole Disk], force a blocksize of 512 bytes, use the default options otherwise.
Recovered files will not have their original filenames, you will have to sort the recovered files as described in https://www.cgsecurity.org/testdisk.pdf

flow666
Posts: 2
Joined: 12 Oct 2017, 06:21

Re: Recover lost NTFS partition (partly overwritten)

#3 Post by flow666 »

Thank you!

I feared that there would be no solution to get the structure and the file names back.
However, recovering the files with PhotoRec worked out as intended. My friend is happy and I will assist her in ordering and sorting the recovered files now.

Thanks again for the help and your fantastic pieces of software.
Much appreciated.

Florian

Locked