Recover 3TB HDD which was overwritten with 32MB Image

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Chris02
Posts: 3
Joined: 19 Mar 2018, 15:35

Recover 3TB HDD which was overwritten with 32MB Image

#1 Post by Chris02 »

Hello,

yesterday evening I made a big misstake. I tried to clone an 32!!MB!! CF Card with Linux on it and wrote the Imagefile to my HDD (3TB). Only 2TB was used, 'coz my board doesn't support UEFI Boot.

Now my HDD is unoformated except of 32MB Linux partition. For recovery I downloaded gparted liveCD for restoring.

But I'm unsure how to recover. Should I use "testdisk" and try to restore my partition table or "photorec" to restore my files? Which is the best way?

Thanks for your advice!

Regards
Chris

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover 3TB HDD which was overwritten with 32MB Image

#2 Post by cgrenier »

Run TestDisk, PC Intel, Analyse, Quick Search, Stop, Deeper Search.
Switch the partitions to recover to *(bootable), P(rimary) or L(ogical).
On next screen, choose Write, confirm, Quit
If asked, choose BackupBS and confirm.

Chris02
Posts: 3
Joined: 19 Mar 2018, 15:35

Re: Recover 3TB HDD which was overwritten with 32MB Image

#3 Post by Chris02 »

Thanks for your answer.

I attached what I get after scan.
Why I have two or three partitions with same start (and sometime also same end adress)?

There are three partitions with start adress 100 and two of them have also same endadress.

And testdisk writes for some "NTFS found using backup sector, blocksize=4096, xxx GB / xxxGiB" and for some "NTFS blocksize = 4096, xxxGB / xxx GiB. What's the difference and how to continue?

Thanks for helping me! :) :)
Attachments
hdd.jpg
hdd.jpg (123.7 KiB) Viewed 1428 times

Chris02
Posts: 3
Joined: 19 Mar 2018, 15:35

Re: Recover 3TB HDD which was overwritten with 32MB Image

#4 Post by Chris02 »

Ok, the same partiton is listed two or more times 'coz some structures are bad, I got it.

After deep scan I select my 5 partions, bootable partion is recordnized by testdisk correctly and the other 4 I change to logical (at all five part. I can see my files and they are ok).

But I get an error:
Invalid partition structure

What Do I wrong? Log is attached
Attachments
testdisk.zip
(2.35 KiB) Downloaded 212 times

Locked