Partition accidentally removed; don't know how to proceed

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
FlyingNimbus
Posts: 2
Joined: 02 Mar 2020, 15:30

Partition accidentally removed; don't know how to proceed

#1 Post by FlyingNimbus »

So I was trying to remove the partitions of one disk with diskpart and I unfortunately picked the wrong one. The partition I removed (I applied the "clean" command in the disk) was the only one (not counting system reserved) in a non-bootable 6 TB disk.
Besides being a big disk the partition had maybe hundreds of thousands of files (many galleries and whatnot). So everything seems to take long. Back when I made the partition I used all the space I had available in the disk. Anyway, when I noticed the drive missing I opened Windows 10's Disk Management, it wanted me to create a partition in the disk but I cancelled it. I rebooted the machine; it was taking too long to turn on, like 30 minutes already showing nothing, so I turned it off.

After the second reboot it went into Windows, I opened Disk Management. It shows this:
Image


That's wrong, there was no 2000 GB partition and no 3500 GB of unallocated space, it was all a single partition of 6 TB (or 5589.03 GB). I didn't assign a letter to this new GPT partition fearing data loss, so decided to finally use TestDisk instead. I went to the disk with the missing partition, chose EFI GPT table type, selected the Data partition and then selected List like here:
Image


If I'm not wrong those 11 billion something sectors are equivalent to 6 TB data (at 512 bytes per sector it makes more than 6,000 billion bytes, that's equivalent to a disk advertised as 6 TB). It took like 4 hours to process but the folders are there, fortunately. Went back, then went to Analyse, and it showed me something like this:
Image


I chose quick search; sometime between an hour and 3 later it started to show "Analyse cylinder 1/n: 00%". I write "n" because I don't have the number. It stayed there for a few hours. Then it moved to 1/n. Half an hour later it moved to a very high number with 99% (in total it had been like 7 or 8 hours already). Unfortunately I couldn't go further because where I live power goes off often enough, even for a few minutes, and it happened right then. So all the time was lost.
I rebooted the machine. It was taking forever. I said to myself "maybe Windows is doing something, I'll wait". In fact after many, many hours something that gave me hope showed up: it was trying to rebuild the missing drive. This was happening before the login screen, while Windows was charging. So since I've been sick the whole weekend nevertheless and fever was still up I said "I'll go to sleep more and wait". Like three hours later it was working; it was analyzing or repairing or checking or something (I don't remember the exact words) and it had processed around 2,500 out of 1,487,200 items (I don't remember if it was sectors or what). It took like 5 seconds for each item. ETA was 999:00:00 or something like that. In fact I did the calculation an at 5 seconds each it would take like 85 days to process almost a million and a half of them. Not only I can't have my PC unavailable so long, but it's impossible to spend 3 months without power interruptions.
Thinking that it might speed up if I gave it some time, I went to sleep again and came back a few hours later to see what happened. It was at 5,000. So I assumed the speed was somewhat stable, and since at that pace it's impossible for me to wait I turned it off, rebooted it, and this time it went to the login screen without trying to fix it again.

So now I'm back into TestDisk. I checked EFI GPT again, selected the partition, selected List, the files are still there. I launched the Quick Search again, I expect it to be many hours. The weird thing is that the partition appears as Primary and not as Deleted, that's what strikes me as weird. I know that if it shows as D I'm supposed to recover it, but what am I supposed to do right now? Should I proceed with the Quick Search? And once that's done, how do I proceed to recover the 6 TB partition? It was almost full, I think there were only 50 GB remaining more or less; Window's disk management still shows a partition of 2000 GB and 3500 unallocated GB, even though that's wrong. Test Disk still shows a primary partition spanning from near the beginning of the disk to what seems to be the last sector, but unless things change when the Quick Search is done it doesn't show it as deleted. So how do I proceed? Here is the last log.

Code: Select all

Mon Mar  2 05:52:45 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6001175126016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6001175126016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479457181696
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2000381018112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=2000381018112
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EZRX-00D8PB0, S/N:WD-WCC4M0160407, FW:80.00A80
Disk /dev/sdb - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SA400S37480G, S/N:50026B76830241AD, FW:SBFK61K1
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EURS-63S48Y0, S/N:WD-WCAZAC004517, FW:51.0AB51
Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - WDC WD60EZRZ-22GZ5B1, S/N:WD-WX31D396HVC7, FW:80.00A80

Partition table type (auto): EFI GPT
Disk /dev/sdd - 6001 GB / 5589 GiB - WDC WD60EZRZ-22GZ5B1
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721045167 (expected 11721045167)
hdr_lba_start=34
hdr_lba_end=11721045134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 2 P MS Data                    32768 11721041919 11721009152 [Basic data partition]
     NTFS, blocksize=4096, 6001 GB / 5589 GiB
file_pread(7,248,buffer,32800(2/10/41)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5967328(371/114/32)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5968568(371/134/12)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5969200(371/144/14)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5969304(371/145/55)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5970336(371/162/16)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5971192(371/175/53)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5973168(371/207/13)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5973688(371/215/29)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5975168(371/238/60)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5975240(371/240/6)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5976000(371/252/10)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5977400(372/19/24)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5978256(372/32/61)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5978600(372/38/27)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5979456(372/52/1)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5980344(372/66/7)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,5980656(372/71/4)) ReadFile The request could not be performed because of an I/O device error.
... 400 lines with File_pread (n,n,buffer,n(n/n/n)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6301800(392/68/37)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6302400(392/78/7)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6302424(392/78/31)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6304256(392/107/36)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6305528(392/127/48)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6305712(392/130/43)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6305944(392/134/23)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6307104(392/152/49)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6307288(392/155/44)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6309296(392/187/36)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6310536(392/207/16)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6311504(392/222/39)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6311896(392/228/53)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6312272(392/234/51)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6316552(393/47/47)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6316864(393/52/44)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6317672(393/65/33)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6318096(393/72/16)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6320184(393/105/25)) ReadFile The request could not be performed because of an I/O device error.
File_pread(7,16,buffer,6323360(393/155/51)) ReadFile The request could not be performed because of an I/O device error.

NTFS Volume is dirty.


dir_partition inode=5
 2 P MS Data                    32768 11721041919 11721009152 [Basic data partition]
     NTFS, blocksize=4096, 6001 GB / 5589 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 28-Feb-2020 05:19 .
       5 dr-xr-xr-x     0      0         0 28-Feb-2020 05:19 ..
   19526 dr-xr-xr-x     0      0         0 18-Feb-2020 10:33 $RECYCLE.BIN
   11196 dr-xr-xr-x     0      0         0 23-Feb-2020 10:28 MOVED
  516742 dr-xr-xr-x     0      0         0 23-Feb-2020 10:36 Private
      36 dr-xr-xr-x     0      0         0 13-Nov-2019 06:04 System Volume Information

Analyse Disk /dev/sdd - 6001 GB / 5589 GiB - CHS 729601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721045167 (expected 11721045167)
hdr_lba_start=34
hdr_lba_end=11721045134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 2 P MS Data                    32768 11721041919 11721009152 [Basic data partition]

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partition accidentally removed; don't know how to proceed

#2 Post by cgrenier »

There are a lot of disk error. You should clone the disk to a new empty disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, remove the original disk and try to recover your data from the clone.
Good luck

FlyingNimbus
Posts: 2
Joined: 02 Mar 2020, 15:30

Re: Partition accidentally removed; don't know how to proceed

#3 Post by FlyingNimbus »

Thanks a lot for your answer!
It's weird, the disk is only a few months old and never gave me any problem. The reason the partition was lost was my own stupidity, not a failure with it.
I was able to finally recover it after that last quick search that took many, many hours; it finally showed the partition as D (Deleted) so I could change it to P (Primary). This all happened before I saw your reply.
Everything seems to be there without problems. And even despite a few I/O errors in the TestDisk scan the funny thing is that right now I scanned the partition in Windows (chkdsk S: /f /r /x) and there's no error to be found.

Code: Select all

Chkdsk was executed in read/write mode.  

Checking file system on S:
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
  1487104 file records processed.                                                         File verification completed.
  2399 large file records processed.                                      0 bad file records processed.                                      
Stage 2: Examining file name linkage ...
  3783 reparse records processed.                                         1564312 index entries processed.                                                        Index verification completed.
  0 unindexed files scanned.                                           0 unindexed files recovered to lost and found.                       3783 reparse records processed.                                       
Stage 3: Examining security descriptors ...
Security descriptor verification completed.
  38605 data files processed.                                            CHKDSK is verifying Usn Journal...
  1214662640 USN bytes processed.                                                            Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  1487088 files processed.                                                                File data verification completed.

Stage 5: Looking for bad, free clusters ...
  3457811 free clusters processed.                                                        Free space verification is complete.

Windows has scanned the file system and found no problems.
No further action is required.

   5723148 MB total disk space.
   5706382 MB in 1357520 files.
    419148 KB in 38606 indexes.
         0 KB in bad sectors.
   2918911 KB in use by the system.
     65536 KB occupied by the log file.
  13831244 KB available on disk.

      4096 bytes in each allocation unit.
1465126143 total allocation units on disk.
   3457811 allocation units available on disk.
Should I still replace the disk nevertheless? There doesn't seem to be bad sectors and the 6 TB disk isn't exactly cheap.
Thanks a lot!

Locked