Volume deletion and merge gone wrong

[krustylicious]

Hi there,

I have a shucked 14tb drive, which at the time i didn't realise it was exfat. Anyho i had copied over about 2gb of data by the time i had realsed and i really wanted ntfs. So i split the volume into two. The resaultant volumes were named deletion and media v2. roughly 5 nad 7tb in size.

so the drive had

efi stuff
deletion
media v2

volumes with media v2 at the end of othe drive. I decided to delete the deletion volume and and expand backwards (which really is not a good idea). The opertations were done using niubi partition editor free 8.0.2. Npe, suggested the steps where a success. but the drive was not accessible and was showing as raw.

I tried testdrive, and under disk selection, it had selected efi gpt and the current partition structure it shows as

Code: Select all

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 14 TB / 12 TiB - ST14000NE0008-2RX103
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive2 - 14 TB / 12 TiB - CHS 1702132 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=27344764927 (expected 27344764927)
hdr_lba_start=34
hdr_lba_end=27344764894
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P MS Data                   409768 27344762879 27344353112 [Basic data partition]

which i assume would be the merged volumes

But if i go into intel/pc do a search it shows the old partitions prior to it being merged via npe

Code: Select all

search_part()
Disk \\.\PhysicalDrive2 - 14 TB / 12 TiB - CHS 1702132 255 63
NTFS at 25/159/7
filesystem size           15105581825
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             25 159  7 940304 154 11 15105581825 [deletion]
     NTFS, blocksize=4096, 7734 GB / 7202 GiB
NTFS at 940304/174/31
filesystem size           12238768128
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          940304 174 31 1702132 195 15 12238768128 [Media V2]
     NTFS, blocksize=4096, 6266 GB / 5835 GiB

Results
   * HPFS - NTFS             25 159  7 940304 174 30 15105583104 [deletion]
     NTFS, blocksize=4096, 7734 GB / 7202 GiB
   P HPFS - NTFS          940304 174 31 1702132 195 15 12238768128 [Media V2]
     NTFS, blocksize=4096, 6266 GB / 5835 GiB

interface_write()
 1 * HPFS - NTFS             25 159  7 940304 174 30 15105583104 [deletion]
 2 P HPFS - NTFS          940304 174 31 1702132 195 15 12238768128 [Media V2]

so if write the data to the mbr it shows up as

Code: Select all

Analyse Disk \\.\PhysicalDrive2 - 14 TB / 12 TiB - CHS 1702132 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 25/159/7
Error: size boot_sector 15105581825 > partition 4294967295
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 15105581825 > partition 4294967295
Invalid NTFS or exFAT boot
 1 * HPFS - NTFS             25 159  7 267374 248  9 4294967295
 1 * HPFS - NTFS             25 159  7 267374 248  9 4294967295
Invalid NTFS or exFAT boot
 2 P HPFS - NTFS          267349  89  4 534698 178  6 4294967295
 2 P HPFS - NTFS          267349  89  4 534698 178  6 4294967295
Space conflict between the following two partitions
 1 * HPFS - NTFS             25 159  7 267374 248  9 4294967295
 2 P HPFS - NTFS          267349  89  4 534698 178  6 4294967295
Backup partition structure
partition_save

and windows now sees 2 2tb partitions and 8.9tb unallocated.

whats the best way to try and recover as much of the data?

Thanks very much in advance

update:
just realized the 2xtb partitions are due writing volumes >2tb to an mbr.

i'm doing a deep scan under the efi/gpt route and its picking up the two original volumes ..

would that the data could be recoverable

[recuperation]

https://superuser.com/questions/1749602 ... lume-merge