Recovering partition.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
SyncroScales
Posts: 20
Joined: 09 Nov 2016, 23:10

Recovering partition.

#1 Post by SyncroScales »

Hi,

testdisk-7.1WIP

I have a hard-disk that was formatted or lost it's partition. I looked for the partition and found what seems to be the NTFS partition and the smaller partition in-front of it, maybe for boot. The choice I have after selecting the NTFS partition is

Code: Select all

Write partition table, confirm? <Y/N>.
Will this write onto the hard-disk? Or is the next option where I can put it? I wanted to put it onto an external hdd. Maybe use photorec_win and qphotorec_win?

I don't want to write over the hard-disk I need to data recover. Just in case I need to perform further analysis/scans/etc.

Hard-disk being scanned is 500GB, the external hard-disk is 1TB (empty).

Not sure which version of Windows the damaged hard-disk was formatted from and used for. Was apparently not re-formatted.

Hard-disk is recognized in Disk Management and Device Manager. No I/O errors or lags, crashing, etc. Hard-disk seems to be fine, with no partition visible.

recuperation
Posts: 1783
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering partition.

#2 Post by recuperation »

SyncroScales wrote: 13 Jan 2022, 03:10 Hi,

testdisk-7.1WIP

I have a hard-disk that was formatted or lost it's partition. I looked for the partition and found what seems to be the NTFS partition and the smaller partition in-front of it, maybe for boot. The choice I have after selecting the NTFS partition is

Code: Select all

Write partition table, confirm? <Y/N>.
Will this write onto the hard-disk?
Yes, this is a repair function.

Or is the next option where I can put it? I wanted to put it onto an external hdd.
A partition table is specific for a specific drive. There is no use in writing the partition table elsewhere.

Maybe use photorec_win and qphotorec_win?
As you loose file metadata information you should do this if writing the partition table fails.

I don't want to write over the hard-disk I need to data recover. Just in case I need to perform further analysis/scans/etc.
Duplicate your hard drive using ddrescue as described in the manual. When having a copy of your broken drive you don't have to worry about write operations.

SyncroScales
Posts: 20
Joined: 09 Nov 2016, 23:10

Re: Recovering partition.

#3 Post by SyncroScales »

Thanks for the reply.

So I repaired the drive. There was only one * bootable and P - Primary partition. I wrote the partition table. I restarted the computer. In Computer I see two drive letters that have 100MB (NTFS) and 565MB (NTFS). But the data section in the middle is not there. The file system and disk seem to be Windows 7 or 8.x.

In Windows - Disk Management shows the disk with 3 partitions. 1. System Reserved (Drive letter), 100MB (NTFS), Healthy (Active, Primary Partition), 2. 465.11 GB, Unallocated and 3. (Drive letter), 565 MB (NTFS), Healthy (Primary Partition).

In testdisk - there are only 2 partitions. I think the partition on the end is the back-up for the first partition.

I was in this tutorial https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step - I checked NTFS Boot sector recovery, and for both partitions, they are OK.

Boot Sector
Status: OK
Back Up Boot Sector
Status: OK
Sectors Are Identical

In:
[Advanced]
I tried to [Repair MFT], MFT and MFT mirror match perfectly.
File Undelete - No deleted Files Found.

[Rebuild BS] - I don't think I need to do this?

I am using QPhotoRec right now. I really don't want to re-format and then attempt commercial software to find the folder structure and files. Do I have to do that?

recuperation
Posts: 1783
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering partition.

#4 Post by recuperation »

SyncroScales wrote: 13 Jan 2022, 12:29 I am using QPhotoRec right now. I really don't want to re-format and then attempt commercial software to find the folder structure and files. Do I have to do that?
Formating means deleting information. You only do this if you give up your data and want to use your partition/drive again. You rather sound that you want to rescue your data, though. => NO FORMATING!
When being unhappy with the result of QPhotoRec try out commercial recovery software.

Post Reply