What todo when the partitions show up with "D" Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Need2know
Posts: 5
Joined: 29 Sep 2022, 00:05

What todo when the partitions show up with "D"

#1 Post by Need2know »

Hello
My disk is a Toshiba MD04ACA400
  • On a 4TB disk formatted GPT with 4 partition, today, it has come up not recognized by the system.
  • It is a non-raid data-only disk drive
  • Each partition is 1TB
  • The formats for the partitions vary; namely NTFS, ext4
  • It is not recognized by any OS
  • In GParted is shows the complete drive as Unallocated; thus it does NOT show any partitions present on the disk
  • there have been no attempts at writing/changing anything on the drive
  • Gparted's Menu (Device>Attempt Data Rescue) running overnight does not find any partitions on the disk
  • Running Testdisk v7.1 shows a "D" in front its 4 entries while also showing their extents
  • It does NOT show filesystem types for any of the 4 entries
What is recommended to proceed to recovery? Are there some steps somewhere as I am unable find what to do via Google/Youtube searches.

Decided to give analyze a try on the 1st partition that has the "D" flag in its column 1. According to my rough calculations, it will 9 more hours before its completion. Did I do the right thing?

Thanks, in advance, for any leadership.

EDIT: - Found this CGsecurity info, BUT, I am a confused by what is said for recovery of partitions with "D". I AM LOST.
(See posts below)
Last edited by Need2know on 29 Sep 2022, 23:16, edited 1 time in total.

Need2know
Posts: 5
Joined: 29 Sep 2022, 00:05

Re: What todo when the partitions show up with "D"

#2 Post by Need2know »

The progress overnight for Testdisk is shown as follows:
Testdisk.jpg
Testdisk.jpg (72.75 KiB) Viewed 2444 times
Then later this:
Testdisk2.jpg
Testdisk2.jpg (112.83 KiB) Viewed 2444 times

Need2know
Posts: 5
Joined: 29 Sep 2022, 00:05

Re: What todo when the partitions show up with "D"

#3 Post by Need2know »

It completed: But I am lost to know what are the next steps to recovery of the drive with its original 4 partitions.

I am keeping the Testdisk screen open hoping for some recommendation of my next step(s).
Testdisk3.jpg
Testdisk3.jpg (149.05 KiB) Viewed 2443 times
Everything comes up "D". What does that prefix on each line mean?

Thanks in advance for ANY guidance

Need2know
Posts: 5
Joined: 29 Sep 2022, 00:05

Re: What todo when the partitions show up with "D"

#4 Post by Need2know »

P.S. I am not sure of why SG2D is showing up on this drive as I have NOT knowingly ran that ISO file on this system. And I certainly have never knowingly made an attempt to write its ISO to this drive...ever. That/those labels showing on this drive is suspect to me.

Could my running Linux system been used to hack this drive? Or ??? why this problem surfaced...much less what I must do to recover it or its data.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: What todo when the partitions show up with "D"

#5 Post by recuperation »

Did you buy your drive "naked" or did it come built into an enclosure?
Need2know wrote: 29 Sep 2022, 23:23 P.S. I am not sure of why SG2D is showing up on this drive as I have NOT knowingly ran that ISO file on this system. And I certainly have never knowingly made an attempt to write its ISO to this drive...ever. That/those labels showing on this drive is suspect to me.

Could my running Linux system been used to hack this drive? Or ??? why this problem surfaced...much less what I must do to recover it or its data.
Sounds like a defense in front of a court. :D
Of course your LInux system could have been hacked.
Please accept point 17 on the list below:
viewtopic.php?p=34916#p34916

Need2know
Posts: 5
Joined: 29 Sep 2022, 00:05

Re: What todo when the partitions show up with "D"

#6 Post by Need2know »

Thanks @recuperation for your comment to my rhetorical question.

But could you or anyone suggest what I should do at the screen that I present. What is it telling me that could be done for data recovery/

I have read this section in the Testdisk manual: But I am at a lost as something in its language is foreign to me even though I am English speaking. It uses the word "let" on several occasions which is contributing to my lack of understanding the sentences meaning. I recognize that guessing wrongly could prove disastrous.

For example what does this mean???
...if you let them listed as deleted...
and what does this mean
..Let this partition...
I have not moved from the screen, shown above, as I am hoping for a suggestion to action such as go back and ??? or hit this key and ???

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: What todo when the partitions show up with "D"

#7 Post by recuperation »

Need2know wrote: 01 Oct 2022, 00:27 Thanks @recuperation for your comment to my rhetorical question.

But could you or anyone suggest what I should do at the screen that I present. What is it telling me that could be done for data recovery/

I have read this section in the Testdisk manual: But I am at a lost as something in its language is foreign to me even though I am English speaking. It uses the word "let" on several occasions which is contributing to my lack of understanding the sentences meaning. I recognize that guessing wrongly could prove disastrous.

For example what does this mean???
...if you let them listed as deleted...
and what does this mean
..Let this partition...
I have not moved from the screen, shown above, as I am hoping for a suggestion to action such as go back and ??? or hit this key and ???
I found "let" twice and it means "leave unchanged".

Locked