Original partition recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
YuStinKiPu
Posts: 2
Joined: 26 Jan 2018, 16:21

Original partition recovery

#1 Post by YuStinKiPu »

Hello,

Having one last go at recovering my data following making silly mistake last year.

I have a 1TB Seagate external USB disk. On that disk was a combination of things - some files/ scripts etc., a load of Hyper-V disk images (various sizes) and a load of Win32DiskImager disk images - these were backup images of my raspberry pi, these were (mostly) 4GB in size. Originally there was only one 1TB partition, FAT32 or NTFS (I don't remember which). The only files I really care about recovering are the files/ scripts - the disk images are now redundant.

On the last occasion that I actively used this disk, I was using Win32DiskImager to write an image to disk. I made the mistake of picking the wrong target drive in the application, so wrote a 4GB Raspberry Pi disk image to the 1TB drive. The attached file shows the partition table from a Windows Disk management POV.

I have used a few tools in the past to scan the disk to see if I could recover any of the files from the damaged/ unallocated partition, but all I could ever see were the disk images. The disk has been sat in a drawer since, nothing has been written to the disk since the day the disk image was written to it.

So last week I thought I 'd have one more go before wiping the disk and re-purposing it. I came across TestDisk, so set an analyse scan going. The results did not look promising:

Mon Jan 22 13:19:44 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-38-generic (#42~16.04.1-Ubuntu SMP Tue Oct 10 16:30:51 UTC 2017) i686
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA support
/dev/sda: size 63078400 sectors
/dev/sda: user_max 63078400 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 32 GB / 30 GiB - CHS 3926 255 63, sector size=512 - RunCore 32G-C SSD, S/N:000900004176, FW:J090331
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 30523830 4 16, sector size=512 - Seagate FreeAgent GoFlex, FW:0148

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - Seagate FreeAgent GoFlex
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 30523830 4 16
Geometry from i386 MBR: head=4 sector=16
FAT16 at 32/0/1
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
Info: size boot_sector 204800, partition 204800
FAT1 : 4-203
FAT2 : 204-403
start_rootdir : 404
Data : 436-204799
sectors : 204800
cluster_size : 4
no_of_cluster : 51091 (2 - 51092)
fat_length 200 calculated 200
get_geometry_from_list_part_aux head=4 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=4
Current partition structure:
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
1 P FAT32 LBA 32 0 1 3231 3 16 204800
2 P Linux 3232 0 1 121471 3 16 7567360
No partition is bootable

And the end result from the search_part() function:

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 30523830 4 16
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3851 GB / 3587 GiB)
The following partitions can't be recovered:
FAT16 LBA 25113891 2 10 46523132 0 1 1370191384
FAT16 LBA 25122516 2 10 46531757 0 1 1370191384
FAT16 LBA 25122706 3 10 46531947 1 1 1370191384
FAT16 LBA 25123113 2 10 46532354 0 1 1370191384
FAT16 LBA 25123363 2 10 46532604 0 1 1370191384
FAT16 LBA 25130000 2 10 46539241 0 1 1370191384
FAT16 LBA 25182781 2 10 46592022 0 1 1370191384
FAT16 LBA 25183312 3 10 46592553 1 1 1370191384
FAT16 LBA 25184337 2 10 46593578 0 1 1370191384
FAT16 LBA 25278463 2 10 46687704 0 1 1370191384
FAT16 LBA 25279059 2 10 46688300 0 1 1370191384
FAT16 LBA 25279590 3 10 46688831 1 1 1370191384
FAT12 34549507 0 10 34551552 2 2 130905
FAT16 LBA 38144057 3 13 77548672 3 7 2521895355
FAT32 38802783 0 15 44436019 1 5 360527111
FAT32 LBA 57530241 0 14 68624274 0 16 710018115
FAT32 59321833 2 1 98922642 3 4 2534451796
FAT32 LBA 59766163 0 10 65792132 3 3 385662058
FAT32 75206955 3 16 117540974 3 13 2709377214
FAT16 <32M 85413487 1 11 102056076 1 1 1065125687

I'm assuming that all of those partitions being reported are simply representations of the disk images on the broken partition? I peeked into one and saw that it looked like one of the raspberry pi images.

Is there any hope in recovering my files or am I wasting my time?

I'd appreciate any input or advice.

Many thanks,

Jon
Attachments
Seagate.PNG
Seagate.PNG (6.79 KiB) Viewed 1443 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Original partition recovery

#2 Post by cgrenier »

After Analyse and Quick Search, use Deeper Search.
If you had a NTFS partition, it should be found via its Backup Boot sector. In this case, set this partition as P(rimary). On next screen, choose Write, confirm, Quit and restart your computer.
If you had a FAT32, recovery will be difficult, run PhotoRec, enable the expert mode in Options, start a recovery, set the blocksize to 512 bytes, use the default options otherwise.

YuStinKiPu
Posts: 2
Joined: 26 Jan 2018, 16:21

Re: Original partition recovery

#3 Post by YuStinKiPu »

Thank you. I'll give those a try.

Locked