HELP RECOVERING BOOT PARTITION (WINDOWS 10)

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Tesco1
Posts: 5
Joined: 23 Feb 2023, 01:27

HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#1 Post by Tesco1 »

Hello, I'm looking for some clarity on how to recover a boot drive I accidentally ran 'diskpart clean' command on.

So I accidentally ran diskpart clean on the wrong drive, in a freak accident.

I haven't touched the drive, so I know everything is still on it, but I need some clarity on how to ensure I correctly recover the drive using Testdisk. I search online, but could not find guide to recovering a windows OS drive similar to my situation.

So far these are the steps I've taken:

1. Run testdisk
2. Select create log
3. Select Intel/pc
4. select analyze (upon analyze I get: "Partition sector doesn't have the endmark 0xAA55")
5. I continue to "quick search" (it finds one *primary bootable partition) https://drive.google.com/file/d/1AThuQ5 ... share_link
6. I continue, and then choose deeper scan, and (now 6 partitions are available) https://drive.google.com/file/d/1AYPmDE ... share_link

The partition "Acer", was the name of the C: drive before the drive was deleted.

7. After checking files for each partition only one partition has my files which is the "Acer" partition

So which is correct partition to write, to restore the drive back to its working bootable state with data intact?
Attachments
testdisk.log
(32.63 KiB) Downloaded 133 times
Step 5.jpg
Step 5.jpg (282.07 KiB) Viewed 2924 times
Step 6.jpg
Step 6.jpg (405.71 KiB) Viewed 2925 times
Last edited by Tesco1 on 23 Feb 2023, 09:39, edited 4 times in total.

recuperation
Posts: 2739
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#2 Post by recuperation »

Please upload your pictures to this drive using the attachment tab. Please post your Testdisk log file as well.

Tesco1
Posts: 5
Joined: 23 Feb 2023, 01:27

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#3 Post by Tesco1 »

recuperation wrote: 23 Feb 2023, 07:36 Please upload your pictures to this drive using the attachment tab. Please post your Testdisk log file as well.
I have attached the pics, and log.

recuperation
Posts: 2739
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#4 Post by recuperation »

The existence of an "EFI System Partition" in combination with Windows 10 suggests that your machine used a GPT partition table instead of the one you selected.

I don't know what your original setup of partitions was - you should know instead.
Only looking at your second pictures suggests that your machine contained at least three partitions. It would be a bad idea to write a partition table containing just one partition.

The following link provides you with information how to search for partitions:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

You should rerun Testdisk and post the new logfile. The logfiles in GPT setups are easier to read and recognizing overlapping partitions will be much easier...

Tesco1
Posts: 5
Joined: 23 Feb 2023, 01:27

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#5 Post by Tesco1 »

Yes, the drive was originally formatted NTFS, partitioned GPT. it was a regular Windows 10 OS drive.

The original structure of the drive is as shown in the pic below. I have cloned this drive several times, so this is a picture of a smaller 250gb drive with the same partitions. Disk 1 is the smaller clone, and the 'unallocated disk' I accidentally ran 'diskpart clean' on.

There are 3 partitions that are supposed to be on this drive: EFI, ACER, and then Recovery:
disk partition.JPG
disk partition.JPG (65.7 KiB) Viewed 2830 times


So I ran Testdisk again
1. Select GPT, scan, I get this prompt:

Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.


2. I choose quick search: it finds a partition named "MS data"
2.JPG
2.JPG (48.76 KiB) Viewed 2830 times
3.JPG
3.JPG (37.7 KiB) Viewed 2830 times
3. After continuing, and choosing deeper search, the scan starts, BUT after scanning for 4-5 hours it appeared to only be 0.4% complete (2TB drive). So I cancelled and was unable to generate a new log file.

Do I need to do the deepscan in GPT mode to properly recover the correct 3 partitions? Or were the 3 correct partitions available with the intel/pc scan results?
Last edited by Tesco1 on 24 Feb 2023, 19:45, edited 2 times in total.

recuperation
Posts: 2739
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#6 Post by recuperation »

Tesco1 wrote: 24 Feb 2023, 06:12 Yes, the drive was formatted GPT.

Yo can format file systems. The drive is partitioned with GPT, there is no thing like "GPT formatting".

The original structure of the drive is as shown in the pic below. I have cloned this drive several times, so this is a picture of a smaller 250gb drive with the same partitions. Disk 1 is the smaller clone, and the 'unallocated disk' I accidentally ran 'diskpart clean' on.

There are 3 partitions that are supposed to be on this drive: EFI, ACER, and then Recovery:
disk partition.JPG



So I ran Disktest again
1. Select GPT, scan, I get this prompt:

Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.


2. I choose quick search: it finds a partition named "MS data"
2.JPG
3.JPG

3. After continuing, and choosing deeper search, the scan starts, BUT after scanning for 4-5 hours it appeared to only be 0.4% complete (2TB drive). So I cancelled and was unable to generate a new log file.

Do I need to do the deepscan in GPT mode to properly recover the correct 3 partitions? Or were the 3 correct partitions available with the intel/pc scan results?
If the smaller disk (250 GB) is broken, why are you having Testdisk examine the 2 TB disk?
Tesco1 wrote: 24 Feb 2023, 06:12 So I ran Disktest again
The software is called Testdisk.

Tesco1
Posts: 5
Joined: 23 Feb 2023, 01:27

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#7 Post by Tesco1 »

recuperation wrote: 24 Feb 2023, 07:16
If the smaller disk (250 GB) is broken, why are you having Testdisk examine the 2 TB disk?

The 2 TB drive is the drive I am trying to recover the partitions on. My whole problem is I accidentally ran the 'disk utility clean' command on the 2 TB disk.

The reason I posted the picture of the 250 gb drive is because you said:
recuperation wrote: 23 Feb 2023, 18:37
I don't know what your original setup of partitions was - you should know instead.
Only looking at your second pictures suggests that your machine contained at least three partitions. It would be a bad idea to write a partition table containing just one partition.

The 250 gb drive shows the exact partition structure that was on 2 TB drive, with the exception that the 2 TB drive's data/OS partition (Acer) is larger.

In short the 250 gb drive is a reference to the partitions that I am looking to recover on the 2TB drive. You were correct the 2 TB drive had the 3 partitions: EFI, Acer, and recovery.


I was told testdisk could restore the deleted partitions without needed to do more complex data recovery, since all I did was run 'disk utility clean'.
From what I have read, fixing the disk should be simple, but I could not find any guides or documentation that is specific to restoring the 3 partitions for a windows OS drive that had accidentally been cleaned. All of the guides I could find only address issues recovering single partitions, or data only drives.

- I have done regular data recovery in the past (scanning and copying file by file to another drive) but would like to avoid that if I can just rewrite the partition tables back to the drive.

Unfortunately I couldn't find clear instructions on how to restore all 3 partitions. And I want to avoid any mistakes using Testdisk.
Last edited by Tesco1 on 24 Feb 2023, 19:43, edited 3 times in total.

Tesco1
Posts: 5
Joined: 23 Feb 2023, 01:27

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#8 Post by Tesco1 »

recuperation wrote: 24 Feb 2023, 07:16
The software is called Testdisk.

My apologies, I was tired when I made my last post. It has been corrected.

elo001
Posts: 1
Joined: 05 May 2023, 22:48

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#9 Post by elo001 »

:arrow:

recuperation
Posts: 2739
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HELP RECOVERING BOOT PARTITION (WINDOWS 10)

#10 Post by recuperation »

elo001 wrote: 19 Jun 2023, 22:22:arrow:
I approved this posting because it is the perfect example how not to post.

Locked