Accidentally deleted partition

Message

hades · #1 Post by **hades** » 20 Nov 2021, 23:09

Hi, I just want to ask you for help. I have accidentally deleted partition from my 1TB drive. I have used testdisk for recovery, but I don't know how to recover. Here is the log:

Code: Select all


Sat Nov 20 18:57:48 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511433506816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=120031543296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=64020611072
Hard disk list
Disk \\.\PhysicalDrive0 - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - KINGSTON SNVP325S264GB, S/N:301S100PT72Z, FW:AGYA0201
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 850 EVO 120GB, S/N:S21UNXAG919850E, FW:EMT01B6Q
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EZRZ-00Z5HB0, S/N:WD-WCC4M3XTEHVZ, FW:80.00A80
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1001FALS-75J7B0, S/N:WD-WMATV1873547, FW:05.00K05
Disk \\.\PhysicalDrive4 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - ADATA SX8200PNP, S/N:2J1720070543        _00000001., FW:R0906I

Partition table type defaults to Intel
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - WDC WD1001FALS-75J7B0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 637/137/13
filesystem size           1953515520
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            637 137 13 122238  65  3 1953515520 [Data]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=10242048, size=1953515520, end=1963757567, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/235, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7700736
recover_EXT2: part_size 61605888
Filesystem created: Sat Feb 11 19:57:49 2017
Last mount time:    Thu Feb 11 17:28:01 2016
     Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1005 GB / 936 GiB)
The following partition can't be recovered:
     HPFS - NTFS            637 137 13 122238  65  3 1953515520 [Data]
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   * Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

interface_write()
 1 * Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]


dir_partition inode=2
   * Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 2133571354.
Directory /

interface_write()
 1 * Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

I am running Windows 10 and I don!t know why there is a Linux partition. Only thing, that was weird, was that there were two partitions, but "dynamic" partitions. Once I accidetally deleted the second one (1TB is size), also the smaller one has been gone.

#2 Post by **recuperation** » 21 Nov 2021, 10:25

hades wrote: ↑20 Nov 2021, 23:09 I am running Windows 10 and I don!t know why there is a Linux partition.

Has there been an image file for a Raspberry Pi on your drive?

Here is a recipe:

Start Testdisk
Select Drive
Select Partition type
Select Analyse, Quick Search
Check the found partitions for valid content using the "p"-key ("list files")
If that fails, press Enter to Continue
Select Deeper Search
Check the found partitions for valid content using the "p"-key ("list files")

You have a choice:

Alternative A:
Being inside valide partitions you can select files and folders and copy them to a presumably healthy location.
This alternative is risk free if you choose another drive than the broken one.

Alternative B:
You can write a partition table hoping to be able to reach the content again using your regular operating system.
If your drive is using the MBR partition table scheme and you have more than one partition, Testdisk will need to write partition table information not only at the beginning of your drive but between your partitions as well.
There is a risk of loss of losing one sector per partition if Testdisk fails to identify the end of a partition correctly. In such a case partition table information will be written right into a partition.

hades · #3 Post by **hades** » 21 Nov 2021, 17:56

Hi, yes, one of the files on the drive was backup of RaspberryPi SD card.
I have already tried to look for files on that drive, but I got that error it cannot be recovered. So alternative A is not possible.
Can you help me with the alternative B? So far I know I have created only one partition on the drive. But when I accidentally deleted it, in Windows Disk Manager there were two partitions, on dynamic drive (I don't know if this is a problem or not).
I will also attach log from Deeper search:

Code: Select all


Sat Nov 20 23:14:00 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511433506816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=120031543296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=64020611072
Hard disk list
Disk \\.\PhysicalDrive0 - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - KINGSTON SNVP325S264GB, S/N:301S100PT72Z, FW:AGYA0201
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 850 EVO 120GB, S/N:S21UNXAG919850E, FW:EMT01B6Q
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EZRZ-00Z5HB0, S/N:WD-WCC4M3XTEHVZ, FW:80.00A80
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1001FALS-75J7B0, S/N:WD-WMATV1873547, FW:05.00K05
Disk \\.\PhysicalDrive4 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - ADATA SX8200PNP, S/N:2J1720070543        _00000001., FW:R0906I

Partition table type defaults to Intel
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - WDC WD1001FALS-75J7B0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 637/104/43
filesystem size           1953515520
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=5242879488, part_size=1000199946240, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 637/137/12
filesystem size           10240000
sectors_per_cluster       8
mft_lcn                   262144
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33   637 137 12   10240000
     NTFS found using backup sector, blocksize=4096, 5242 MB / 5000 MiB
NTFS at 637/137/13
filesystem size           1953515520
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            637 137 13 122238  65  3 1953515520 [Data]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=10242048, size=1953515520, end=1963757567, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/235, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7700736
recover_EXT2: part_size 61605888
Filesystem created: Sat Feb 11 19:57:49 2017
Last mount time:    Thu Feb 11 17:28:01 2016
     Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/235, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7700736
recover_EXT2: part_size 61605888
Filesystem created: Sat Feb 11 19:57:49 2017
Last mount time:    Thu Feb 11 17:28:01 2016
     Linux                112774  93 24 116609  39 38   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/235, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7700736
recover_EXT2: part_size 61605888
Filesystem created: Sat Feb 11 19:57:49 2017
Last mount time:    Thu Feb 11 17:28:01 2016
     Linux                112774 223 26 116609 169 40   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/235, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7700736
recover_EXT2: part_size 61605888
Filesystem created: Sat Feb 11 19:57:49 2017
Last mount time:    Thu Feb 11 17:28:01 2016
     Linux                112775 163 29 116610 109 43   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/235, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7700736
recover_EXT2: part_size 61605888
Filesystem created: Sat Feb 11 19:57:49 2017
Last mount time:    Thu Feb 11 17:28:01 2016
     Linux                112780  26 15 116614 227 29   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
NTFS at 121601/25/24
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1005 GB / 936 GiB)
The following partition can't be recovered:
     HPFS - NTFS            637 137 13 122238  65  3 1953515520 [Data]
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
     HPFS - NTFS              0  32 33   637 137 12   10240000
     NTFS found using backup sector, blocksize=4096, 5242 MB / 5000 MiB
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
     Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
     Linux                112774  93 24 116609  39 38   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
     Linux                112774 223 26 116609 169 40   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
     Linux                112775 163 29 116610 109 43   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
     Linux                112780  26 15 116614 227 29   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

     HPFS - NTFS              0  32 33   637 137 12   10240000
     NTFS found using backup sector, blocksize=4096, 5242 MB / 5000 MiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=2
     Linux                112770   8  7 116604 209 21   61605888 [PI_ROOT]
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 2133571354.
Directory /
Not an exFAT boot sector.

     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

#4 Post by **recuperation** » 21 Nov 2021, 18:58

I just discovered that you wrote that you deleted one partition with a size of 1 TB from a drive with a size of 1 TB.
How should the space for the other partition come from when one partition already reserved 1 TB of space?

As for the influence of your "dynamic" partition setup I am lacking the experience.

If alternative A fails B won't work either. Use Photorec or some commercial software.

hades · #5 Post by **hades** » 21 Nov 2021, 19:36

So I have started Photorec and it discovered two partitions on the drive. I will try to use it for the recovery. Thank you

hades · #6 Post by **hades** » 21 Nov 2021, 21:01

Well, those two partitions in Photorec weren't two partitions, but two options (ext2/3/4 or Other). So it is still posible, that there is only one partition on my drive.
I am now running Photorec recovery of files, but I know, that some files, which are very important for me (FITS files) will not be recovered. I will try some commercial solutions, if they will be able to restore whole partition. Do you have any recommendation?

#7 Post by **recuperation** » 21 Nov 2021, 22:20

hades wrote: ↑21 Nov 2021, 21:01 Well, those two partitions in Photorec weren't two partitions, but two options (ext2/3/4 or Other).

That does not answer my question about your initial descrption.
If a is size of partition a
and b is size of partition b
and 1TB is the total of the disk
and 1 partition assuming it was b was 1 TB big, the following applies:

a + b <= 1 TB
and b = 1TB

=> a <= 0 TB

There could not be a second partition.
And that is based on your inital statement and is not related to Photorec anyhow.

So it is still posible, that there is only one partition on my drive.

This contradicts what you initially stated.

I am now running Photorec recovery of files, but I know, that some files, which are very important for me (FITS files) will not be recovered. I will try some commercial solutions, if they will be able to restore whole partition. Do you have any recommendation?

FITS files are supported by Photorec. if they have not been overwritten and if they are not defragmented they can be recovered.
https://www.cgsecurity.org/wiki/File_Fo ... y_PhotoRec

(FITS files) will not be recovered.

How come you know?

I have no recommendation.

hades · #8 Post by **hades** » 21 Nov 2021, 22:51

Maybe I have provided missleading information. So far I know, I have created only one partition on the drive, but it is long ago. I don't know, why the partition (or whole disk) was dynamic. What I rememeber, when I accidentally deleted the partition was, that there were visually TWO partions visible in the Windows Disk Manager. Both of them have yellow color (which should indicate "dynamic"). First partition was small, like 5GB, second one was the remaining space, but I cannot tell you now if it was 995GB or 1000GB.
I am running EaseUS Partition Master fuction partition recovery right now. It doesn't found any partition yet (57% progress). But this tool has found the files on drive, including their directory structure and correct names. So this could be the way, how to recover content of the drive. But I would like to do it easier and faster way: recover partition information, so it will not be needed to copy all disk content (which is almost full 1TB of data) to another drive and then back.

#9 Post by **recuperation** » 22 Nov 2021, 00:10

I am not aware of recovery software that repairs logically broken drives but I don't have an overview about the abilities of today's recovery software anyway.
Everybody wants that type of software but there might be a reason why software companies don't go this way.

hades · #10 Post by **hades** » 22 Nov 2021, 07:23

I understand. I let the EaseUS tool run overnight and it wasn't able to find the lost partition. It found only two RaspberryPI partitions backups. So I will need to go the longest way. Anyway thank you for all the support.

cgsecurity.org

Accidentally deleted partition

Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition

Re: Accidentally deleted partition