Partition recovery after formatting HDD as Windows 10 bootable USB

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Billthebutcher
Posts: 2
Joined: 12 Jan 2018, 11:50

Partition recovery after formatting HDD as Windows 10 bootable USB

#1 Post by Billthebutcher »

Hi,
I'm trying to recover the partition of a 3 GB NTFS HDD which I inadvertently format as Windows 10 bootable USB.This disk has very important and files that I urgently need.

This is how the HDD is identified in the Disk Management:
Image

However, TestDisk does not display the unalocated partitions. The hard disk seems small.
Image

After a quick scan
Image

Image

The deep scan does not return any recoverable partitions.

Here is my log file:

Fri Jan 12 01:41:07 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000203804160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000592977920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000203804160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000592977920
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239110569984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=34359738368
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000193318912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=250057220096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD1, S/N:14090C05FA5F, FW:MU05
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500KS-00MJB0, S/N:WD-WCANKE371553, FW:02.01C03
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EAVS-32D7B1, S/N:WD-WCAU47966805, FW:01.01A01
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Seagate Expansion Desk, S/N:NA4MJKRH, FW:0737
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Seagate Expansion Desk, S/N:NA4MJKRH, FW:0737
Drive D: - 34 GB / 32 GiB - CHS 522 255 63, sector size=4096 - Seagate Expansion Desk, S/N:NA4MJKRH, FW:0737

Partition table type (auto): Intel
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - Seagate Expansion Desk
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=47 sector=36
FAT32 at 0/4/5
Info: size boot_sector 8388608, partition 8388608
FAT1 : 1024-2047
FAT2 : 2048-3071
start_rootdir : 3072 root cluster : 2
Data : 3072-8388607
sectors : 8388608
cluster_size : 8
no_of_cluster : 1048192 (2 - 1048193)
fat_length 1024 calculated 1024
Current partition structure:
1 * FAT32 LBA 0 4 5 522 46 36 8388608 [ESD-USB]

search_part()
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 45600 255 63
FAT32 at 0/4/5
FAT1 : 1024-2047
FAT2 : 2048-3071
start_rootdir : 3072 root cluster : 2
Data : 3072-8388607
sectors : 8388608
cluster_size : 8
no_of_cluster : 1048192 (2 - 1048193)
fat_length 1024 calculated 1024

FAT32 at 0/4/5
FAT: cluster=2(0x2), pos=3328
FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

recover_EXT2: s_block_group_nr=0/40, s_mnt_count=14/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 1310720
Last mount time: Wed Jan 25 08:51:41 2017
Linux 19640 127 8 19722 22 12 1310720
ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB
BAD_RS LBA=732760066 9972647
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 45612 52 11 59426 192 33 221930753
This partition ends after the disk limits. (start=732760066, size=221930753, end=954690818, disk end=732566645)
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 45600 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 3910 GB / 3641 GiB)
The following partition can't be recovered:
FAT16 <32M 45612 52 11 59426 192 33 221930753

Results
* FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
P Linux 19640 127 8 19722 22 12 1310720
ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB


dir_partition inode=2
P Linux 19640 127 8 19722 22 12 1310720
ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=0
* FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
FAT: cluster=2(0x2), pos=3328
Directory /
3 -rwxr-xr-x 0 0 128 30-Sep-2017 16:06 AUTORUN.INF
4 drwxr-xr-x 0 0 0 9-Jan-2018 18:18 BOOT
6 drwxr-xr-x 0 0 0 9-Jan-2018 18:18 System Volume Information
579 -rwxr-xr-x 0 0 397752 30-Sep-2017 16:06 BOOTMGR
592 -rwxr-xr-x 0 0 1236376 30-Sep-2017 16:06 BOOTMGR.EFI
630 drwxr-xr-x 0 0 0 9-Jan-2018 18:18 EFI
1295 -rwxr-xr-x 0 0 80696 30-Sep-2017 16:06 SETUP.EXE
1298 drwxr-xr-x 0 0 0 9-Jan-2018 18:18 SOURCES
116941 drwxr-xr-x 0 0 0 9-Jan-2018 18:19 SUPPORT
116976 drwxr-xr-x 0 0 0 9-Jan-2018 18:26 $RECYCLE.BIN

interface_write()
1 * FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
2 P Linux 19640 127 8 19722 22 12 1310720
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - Seagate Expansion Desk
Partition table type: Intel

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=47 sector=36
FAT32 at 0/4/5
Info: size boot_sector 8388608, partition 8388608
FAT1 : 1024-2047
FAT2 : 2048-3071
start_rootdir : 3072 root cluster : 2
Data : 3072-8388607
sectors : 8388608
cluster_size : 8
no_of_cluster : 1048192 (2 - 1048193)
fat_length 1024 calculated 1024
Current partition structure:
1 * FAT32 LBA 0 4 5 522 46 36 8388608 [ESD-USB]

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 45600 255 63
FAT32 at 0/4/5
FAT1 : 1024-2047
FAT2 : 2048-3071
start_rootdir : 3072 root cluster : 2
Data : 3072-8388607
sectors : 8388608
cluster_size : 8
no_of_cluster : 1048192 (2 - 1048193)
fat_length 1024 calculated 1024

FAT32 at 0/4/5
FAT: cluster=2(0x2), pos=3328
FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB
file_pread(7,1,buffer,732566783(45600/44/12)) lseek err Invalid argument
Search for partition aborted

Results
* FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
FAT32, blocksize=32768, 34 GB / 32 GiB

interface_write()
1 * FAT32 0 4 5 522 46 36 8388608 [EFI System Partition] [ESD-USB]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Can you help me please?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partition recovery after formatting HDD as Windows 10 bootable USB

#2 Post by cgrenier »

After Analyse and Quick Search, use Deeper Search.
If your partition is found, set it to P(rimary) and on next screen, choose Write, confirm, BackupBS, confirm, Quit and restart your computer

Billthebutcher
Posts: 2
Joined: 12 Jan 2018, 11:50

Re: Partition recovery after formatting HDD as Windows 10 bootable USB

#3 Post by Billthebutcher »

Hi cgrenier,
Thanks for your help. I've done Deeper Search already. It does not return any recoverable partitions besides the 32 GB FAT 32.
Can you help me further?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partition recovery after formatting HDD as Windows 10 bootable USB

#4 Post by cgrenier »

Select EFI GPT instead of PC Intel after selecting the disk. If it still doesn't find your partitions, use PhotoRec to recover your data, it will not recover the original filenames unfortunately.

Locked