I had a secondary data disk (8TB external USB) GPT with 2 partitions. First one it was small and I do not know if it was for recovery or EFI or system. Second one it was a large NTFS partition taking out the rest of the disk with all the data I want to recover.
By mistake:
1.- I deleted both partitions
2.- I create a new one taking out the whole disk space.
3.- I formated it as FAT32, which resulted in a 2TB partition at the beginning (the maximum size of a FAT32 partition) and 5.28TB (the rest) of unallocated space at the end
The disk is healthy and I I haven't modify any data on that disk after that.
I want to recover the NTFS partition
Using Testdrive I first chose searching for "EFI GPT" partitions:
Code: Select all
TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63
Current partition structure:
Partition Start End Size in sectors
1 P MS Data 2048 4294943632 4294941585 [Basic data partition] [NO NAME]
While analysing cylinder shows this:
Code: Select all
Analyse cylinder 972801/972800: 99%
MS Data 2048 4294943632 4294941585 [NO NAME]
MS Data 264192 15628052479 15627788288 [Seagate Backup Plus Drive
MS Data 15628052479 31255840766 15627788288
Code: Select all
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63
The hard disk (8001 GB / 7452 GiB) seems too small! (< 16 TB / 14 TiB)
Check the hard disk size: HD jumper settings, BIOS detection...
The following partition can't be recovered:
Partition Start End Size in sectors
> MS Data 15628052479 31255840766 15627788288
Code: Select all
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63
Partition Start End Size in sectors
>D MS Data 2048 4294943632 4294941585 [NO NAME]
D MS Data 264192 15628052479 15627788288 [Seagate Backup Plus Drive]
Code: Select all
Can't open filesystem. Filesystem seems damaged.
Reading the log file (below) it mentions about the NTFS partition ends after the disk limits. My guess is that Testdisk missread the disk size as 2Tb (the FAT32 partition instead 8TB. Should I repartition the disk again choosing other filesystem but FAT32 able to take up the whole 8TB disk? (You know fat32 only can reach 2TB), and then run Testdisk again? Or repartitioning and reformatting twice could turn out to be irreparable?
Code: Select all
Fri Jun 2 00:43:29 2023
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=8001563221504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=478797242368
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=199914160128
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500104200192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=499446177792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=500104200704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=2199010091520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1000201224192
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - CT500MX500SSD1, S/N:1849E1DC5FBE, FW:M3CR023
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS725050A7E630, S/N:130503TF0500Y90A2AGL, FW:GH2OA420
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AADS-00S9B0, S/N:WD-WCAV9W057291, FW:01.00A01
Disk \\.\PhysicalDrive3 - 200 GB / 186 GiB - CHS 24321 255 63, sector size=512 - ST3200820AS, S/N:5QE0XNVS, FW:3.AAD
Disk \\.\PhysicalDrive4 - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SM2280S3G2480G, S/N:50026B725C084FFD, FW:SAFM01.R
Disk \\.\PhysicalDrive5 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - JMicron Tech, S/N:000000778899, FW:1201
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - Seagate Backup+ Hub BK, S/N:NA9RCN5K, FW:D781
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - Seagate Backup+ Hub BK
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15628053166 (expected 15628053166)
hdr_lba_start=34
hdr_lba_end=15628053133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 2048 4294943632 4294941585 [Basic data partition] [NO NAME]
search_part()
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63
FAT32 at 0/32/33
FAT1 : 2048-264191
FAT2 : 264192-526335
start_rootdir : 526336 root cluster : 2
Data : 526336-4294941567
sectors : 4294941585
cluster_size : 128
no_of_cluster : 33550119 (2 - 33550120)
fat_length 262144 calculated 262111
set_FAT_info: name from BS used
FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=528384
MS Data 2048 4294943632 4294941585 [NO NAME]
FAT32, blocksize=65536, 2199 GB / 2047 GiB
NTFS at 972801/70/5
filesystem size 15627788288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 15628052479 15627788288 [Seagate Backup Plus Drive]
NTFS found using backup sector, blocksize=4096, 8001 GB / 7451 GiB
NTFS at 972801/70/5
filesystem size 15627788288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 15628052479 31255840766 15627788288
NTFS, blocksize=4096, 8001 GB / 7451 GiB
This partition ends after the disk limits. (start=15628052479, size=15627788288, end=31255840766, disk end=15628053167)
file_win32_pread(600,3,buffer,15628052495(972801/70/21)) read err: read after end of file
file_win32_pread(600,3,buffer,15628052542(972801/71/5)) read err: read after end of file
file_win32_pread(600,8,buffer,15628052558(972801/71/21)) read err: read after end of file
file_win32_pread(600,11,buffer,15628052605(972801/72/5)) read err: read after end of file
file_win32_pread(600,1,buffer,15628052498(972801/70/24)) read err: read after end of file
file_win32_pread(600,1,buffer,15628052545(972801/71/8)) read err: read after end of file
file_win32_pread(600,1,buffer,15628052566(972801/71/29)) read err: read after end of file
file_win32_pread(600,1,buffer,15628052616(972801/72/16)) read err: read after end of file
file_win32_pread(600,1,buffer,15628052538(972801/71/1)) read err: read after end of file
file_win32_pread(600,1,buffer,15628052539(972801/71/2)) read err: read after end of file
file_win32_pread(600,14,buffer,15628052540(972801/71/3)) read err: read after end of file
file_win32_pread(600,3,buffer,15628052554(972801/71/17)) read err: read after end of file
file_win32_pread(600,3,buffer,15628052601(972801/72/1)) read err: read after end of file
file_win32_pread(600,8,buffer,15628052617(972801/72/17)) read err: read after end of file
file_win32_pread(600,11,buffer,15628052664(972801/73/1)) read err: read after end of file
file_win32_pread(600,2,buffer,15628052557(972801/71/20)) read err: read after end of file
file_win32_pread(600,3,buffer,15628052559(972801/71/22)) read err: read after end of file
file_win32_pread(600,3,buffer,15628052606(972801/72/6)) read err: read after end of file
file_win32_pread(600,5,buffer,15628052625(972801/72/25)) read err: read after end of file
file_win32_pread(600,5,buffer,15628052675(972801/73/12)) read err: read after end of file
file_win32_pread(600,13,buffer,15628052604(972801/72/4)) read err: read after end of file
file_win32_pread(600,8,buffer,15628052680(972801/73/17)) read err: read after end of file
file_win32_pread(600,11,buffer,15628052727(972801/74/1)) read err: read after end of file
Search for partition aborted
Disk \\.\PhysicalDrive6 - 8001 GB / 7452 GiB - CHS 972801 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (8001 GB / 7452 GiB) seems too small! (< 16 TB / 14 TiB)
The following partition can't be recovered:
MS Data 15628052479 31255840766 15627788288
NTFS, blocksize=4096, 8001 GB / 7451 GiB
Results
MS Data 2048 4294943632 4294941585 [NO NAME]
FAT32, blocksize=65536, 2199 GB / 2047 GiB
MS Data 264192 15628052479 15627788288 [Seagate Backup Plus Drive]
NTFS found using backup sector, blocksize=4096, 8001 GB / 7451 GiB
Failed to startup volume: Invalid argument.
file_win32_pread(600,1,buffer,15628052479(972801/70/5)) read err: read after end of file
MS Data 264192 15628052479 15627788288 [Seagate Backup Plus Drive]
NTFS found using backup sector, blocksize=4096, 8001 GB / 7451 GiB
Can't open filesystem. Filesystem seems damaged.
SIGHUP detected! PhotoRec has been killed.
Thanks