Risk of data loss involved with TestDisk?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Risk of data loss involved with TestDisk?

#1 Post by recuperation »

This is an answer to a Testdisk-related question that was posted in a photorec-forum.
baumgrenze wrote: 29 Mar 2019, 00:35 Thank you for your reply. In it you say:
"you are in the wrong forum.
You selected a German user name."


Things are not always what they seem. German is my second language; American English is primary. My father came from Schwabenland, arriving in early September 1929. Mom's family arrived from Europe between 1830 and 1865. Their roots were as Swiss Anabaptists (Mennonite/Amish) so even she and her family spoke only 'German' at home until she started school. Since I was born in 1940 at the start of WWII, I could not learn German as a small child. It was used by the adults as a 'code language' when they did not want us to understand. For many years when I was still young and spry I spent free time in the High Sierra Nevada of California, often above timberline, hence the sobriquet of 'Baumgrenze' and a sketch of Mt. Brewer (I made beer in the 1980's) as an avatar.
Very interesting history!
What I wanted to say is that even a supposed German native speaker can easily find the right forum to put his question into. 8-)

In your reply you say:
"Your log file is a protocol of a scan of your disk environment. Your "F:"-partition is broken.
By the way, there is no 2TB installed in your system. You pretended that in your inital posting."
I was not precise. You wrote 2GB. So this is not about a USB-stick but about a harddrive.

When I ran PhotoRec I did manage to recover 35,190 files, a major victory. In another post, Christophe suggested also running TestDisk to see if I could recover the files with their names and dates. That would be a great help in sorting through the

What you say suggests that I should try partition recovery using TestDisk. It that a difficult process?
I would say no but I am rather technically oriented and can't speak for others.
What are the data loss risks involved?
That could involve overwriting data that might be helpful for a recovery specialist.
Photorec might show false positives hits. Repairing the partition table involves write operations. When repairing a MBR-style partitioning scheme based on false positives write operations could be executed within an existing partition. Although the nested MBR-style partitioning scheme only involves approx. one sector for each partition that is something to avoid.

The general recipe on data loss is to make a copy of the drive in question to ensure physical readability of each sector.
If the drive in question makes strange noises stop the drive and pay 4-digit bucks for a professional service.
Next step is to copy the copy. The second copy is your fear-free playing field for recovery and repair attempts.
I bought a copy of Macrium Reflect at the suggestion of users on sevenforums.com but I've never been confident that I actually created a reliable image file. If I want to image a whole 2TB disk so that I capture the 'lost information' that PhotoRec shows is there, I'd need yet another new 2TB drive to restore it to so I could see if it was the same as the one I've been working on, wouldn't I?
Yes, of course. You would then run a file-based comparison on the source and the place where you restored your data from your backup archive. An alternative to file-based comparison is to compare checksum data but which has to be calculated out of file data anyway.
Regarding drive sizes, the linked image shows

https://imgur.com/a/LcIOPXq

why I said 2 TB drives. It also suggests that at least this partition creation tool (Mini Tool Partition Wizard) thinks the drive is fine. The most comprehensive hard drive checker I know, HWiNFO64, also shows no problems.
For quick information looking at SMART parameters is essential. The lack of bad SMART information does not necessarily mean that the drive is physically good.
Everything else like third party software, even an extensive SMART check is simply snake oil.
The only verification is reading out every sector with a tool like ddrescue that maintains a log file.
If you read out every sector anyway for control purposes you can create a copy simultaneously without consuming additional "recovery time".

User avatar
baumgrenze
Posts: 11
Joined: 10 Feb 2019, 22:45

Re: Risk of data loss involved with TestDisk?

#2 Post by baumgrenze »

Thank you, recuperation, for your insights,

Given how and when my data loss occurred, I am convinced that I fell victim to this problem:

Windows 10 corrupting removable hard dr ... Community

Does the log from TestDisk that I posted on the Photorec forum support this hypothesis? Please see entry #5 (3/28/19 - 09:37.)

viewtopic.php?f=7&t=8417

I remain interested in seeing if TestDisk will allow me to recover files with their original paths.

Does the log file support a project like this?

thanks
baumgrenze

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Risk of data loss involved with TestDisk?

#3 Post by recuperation »

Hello baumgrenze,

the reason why a harddisk is logically broken generally does not provide additional information when operating with testdisk and photorec.
Your link is broken.
baumgrenze wrote: 30 Mar 2019, 01:50 I remain interested in seeing if TestDisk will allow me to recover files with their original paths.
Does the log file support a project like this?
No. Recovering files with their original paths requires the user trying out manually within testdisk.

User avatar
baumgrenze
Posts: 11
Joined: 10 Feb 2019, 22:45

Re: Risk of data loss involved with TestDisk?

#4 Post by baumgrenze »

Thank you, recuperation, for persisting,

I will try to phrase things more clearly.

You wrote:

"Your link is broken."

I intended to include 2 links. Somehow the first one got corrupted. I trust you mean the first one. It should read:

https://answers.microsoft.com/en-us/win ... 53654ffb42

I am asking all the experts I encounter on computer forumsif this incompatibility of Windows 10 and Windows 7 is known to corrupt disks in a multi-disk system by changing their partition structure. Am I the first person to ask this question on these forums?

I asked:

I remain interested in seeing if TestDisk will allow me to recover files with their original paths.
Does the log file support a project like this?

With the second sentence, the question, I intended to ask is there evidence in the log file that this might work if I went about the task in the right way? I can repost the log file here in a separate reply if it would be useful.

Did you understand my question in that way when you replied:

"No. Recovering files with their original paths requires the user trying out manually within testdisk.
Re: Risk of data loss involved with TestDisk?"

What are the search terms I should use that will lead me to the proper instructions to "try out manually within testdisk" to recover manually the files Photorec showed me are still on the disk? Is a detailed answer available on the cgsecurity.org website.

thanks
baumgrenze

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Risk of data loss involved with TestDisk?

#5 Post by recuperation »

baumgrenze wrote: 31 Mar 2019, 00:21 Thank you, recuperation, for persisting,

I will try to phrase things more clearly.

You wrote:

"Your link is broken."

I intended to include 2 links. Somehow the first one got corrupted. I trust you mean the first one. It should read:

https://answers.microsoft.com/en-us/win ... 53654ffb42

I am asking all the experts I encounter on computer forumsif this incompatibility of Windows 10 and Windows 7 is known to corrupt disks in a multi-disk system by changing their partition structure. Am I the first person to ask this question on these forums?
Your question suggests that you did not understand what you did wrong. Do not dual-boot into another OS when the previous OS is in a dormant state.
You can switch the OS when the previously running one is completely shut down.
I asked:

I remain interested in seeing if TestDisk will allow me to recover files with their original paths.
Does the log file support a project like this?

With the second sentence, the question, I intended to ask is there evidence in the log file that this might work if I went about the task in the right way? I can repost the log file here in a separate reply if it would be useful.

Did you understand my question in that way when you replied:

"No. Recovering files with their original paths requires the user trying out manually within testdisk.
Re: Risk of data loss involved with TestDisk?"
Yes, of course.
What are the search terms I should use that will lead me to the proper instructions to "try out manually within testdisk" to recover manually the files Photorec showed me are still on the disk? Is a detailed answer available on the cgsecurity.org website.
Read the documentation:
https://www.cgsecurity.org/wiki/TestDisk

Locked