Accidentally Deleted Partition (NTFS)

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
deanfarnaby
Posts: 7
Joined: 27 Feb 2012, 17:51

Accidentally Deleted Partition (NTFS)

#1 Post by deanfarnaby »

Hello,

I am typing on my phone so I will try to keep this short

I have a Samsung S2 1 TB USB HDD

I accidnetally pressed " Format Partition " under disk utility in ubuntu

I chose to create a new mbr and set the drive to free space, not formatting the drive , just deleting partition and boot sector. I intended to do this to another drive that I was going to use another program to format to WBFS for Nintendo Wii

I realised my mistake instantly and powered the drive down

I then booted into gparted live , just so I wasn't running a "full" OS

I ran testdisk first. Selected my drive and instantly no bootable partitions found

Went back. changed my partition selection from Intel to none , no partitions found

Changed back to Intel and quick scanned. No partitions found

Did a deep scan. No partitions found

Tried gparted. That picked nothing up so I went back to Testdisk.

This time I went to advanced. And it found what disk utility sees . 1tb "free space"

Not a lot I could do with this in this state . So I changed the type to NTFS (will not write to disk)

It now shows a 1tb NTFS partition with a bad bootsector and a bad backup

List files gave nothing but an error about corrupt or bad file tree , bad memort on this one.

I am now I'm the process of repairing the BS using the MFT or its backup

It took 22 hours to Deep Scan and this Scan MFT is gonna take a while I think

Have I done this correctly ?

Please help. If this repairs my partition I am more than.happy to make a donation
Thanks
Dean

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Accidentally Deleted Partition (NTFS)

#2 Post by cgrenier »

When you start the scan, TestDisk may ask you if the partition was created by Vista or later, answer Yes.
You may also have to modify the geometry (menu Geometry), usual values are
- 255 heads and 63 sectors
- 240 heads and 63 sectors
As you are running RebuildBS, even if it failed because the partition location isn't identical the previous one, the testdisk.log file may list possible partition starting offsets.

deanfarnaby
Posts: 7
Joined: 27 Feb 2012, 17:51

Re: Accidentally Deleted Partition (NTFS)

#3 Post by deanfarnaby »

Hello,

I always selected Yes for created under VISTA as I was unsure (Drive came formatted to NTFS).

The drive currently reads 255 heads and 63 sectors, which I believe to be correct.

I have gotten nowhere , rebuild BS scanned the MFT , took hours, and seemed to do nothing, still bad BS.

I know I shouldn't have done this, but I have created an NTFS partition in the free space, and started a new deep scan.

If this fails I will have to buy another 1TB drive and use Recuva / Get Data Back to look for file headers and see if I can get it back that way.

It's running a deep scan at the moment, and this time it knows it's a NTFS partition and hopfully it will find the old one.

Thanks

Dean

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidentally Deleted Partition (NTFS)

#4 Post by Fiona »

How does your Disk is listed in windows and your disk management console?
Is there a message, that your disk must be initialized?

deanfarnaby
Posts: 7
Joined: 27 Feb 2012, 17:51

Re: Accidentally Deleted Partition (NTFS)

#5 Post by deanfarnaby »

I've only plugged the drive into windows once since i accidentally deleted the partition.

Windows shows 1TB of unpartitioned space.

Linux also shows 1TB free space - Also on linux "SMART" is unavaliable (I cant remeber if this drive is SMART enabled)

I find it strange that testdisk finds absolutely nothing, no matter what scan I do, or what type of partition I look for.

I hear rumours that testdisk can be tempramental over usb. I have used it in the past to recover a friends usb HDD and it worked absolutely perfectly.

I've tried all scans in testdisk, never finds a partition. If i do analyse , and change the type from none to NTFS I get a corrupt file system message when I try to list the files. Also I cannot repair the BS.

I've done a full scan in GPart , that found nothing. So I booted into windows and tried partition find and mount. That once again, found nothing.

I find it very difficult to understand why nothing can pick up even the slightest trace of this partition. At the very least my MFT backup should be in place. All I did was delete the partition, and write a generic boot sector to it.

As above, I have created a NTFS partition in the free space, once again without "fomatting" (so to speak) . Now Testdisk picks up this partition, but it is not bootbale. A quick scan finds a bootable partition (same info 1tb etc) but list files shows

.
..

So it's empty.

As I said I am currently running another deep scan, I know I have now changed the partition a second time, which is probably not recommended. Will TestDisk have a better chance now it "knows what it is looking for" so to speak.

If there is anything else I can try? My stepdad has the exact same HDD (exactly the same disk, vendor, caddy). Is there a way I can copy his BS over to my drive (I know either testdisk of sfdisk can do this), and then re-build the MFT with checkdisk or testdisk? Will this work?

Or should I give up on the "easy" method, and use a file based recovery tool? Will PhotoRec recover 700gb of Music\Video\Photos\Isos\Databases (.mdb)?

I don't this I will be able to borrow my stepdads drive any time soon. So I will have to recover the data to multiple mediums. Is this pheasble in PhotoRec? Basically I have a 500gb usb hdd, an 80gig usb hdd and about 150gb free on my laptop hdd. So I have enough room, but I would have to recover the files in stages. Video to the 500gb, music to the 150gb laptop, anything else to the 80gb hdd (Not really in this manner, just split the data accross the 3 drives) is this possible? or do I have to export everything in one go? Or will I have to go through three seperate scans to do each export? If so will this reduce my chances of getting "good" data on the second and third scan (I know PhotoRec only access the drive in "Read Only" so theoretically shouldn't cause a problem.

Essay - Apologies

-Dean

deanfarnaby
Posts: 7
Joined: 27 Feb 2012, 17:51

Re: Accidentally Deleted Partition (NTFS)

#6 Post by deanfarnaby »

P.S

In windows, The disk does not show up at all under my computer (So no "Disk is not formatted message) .

It only shows up in Disk Management , as 1tb unallocated space - with the solid black line beneath.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidentally Deleted Partition (NTFS)

#7 Post by Fiona »

2.5 inch hdd normally have a geometry of 240 Heads per Cylinder.
Especially to portable devices like Laptops, Notebooks etc..
But USB doesn't even take care of and uses often 255 Heads per Cylinder.
To exclude any problem about geometry, repeat your diagnose and use 240 heads.
Start Testdisk.
Confirm to create a log, select your harddrive and proceed until you see the menu Analyse.
Don't confirm at Analyse but Geometry.
Highlight Heads and hit Enter.
Change the value to 240.
Don't change anything else.
Mark Ok and confirm with enter to leave the menu.
Go to Analyse.
Repeat your diagnose.
If you see your partitions, mark them and press p to list your files.
To go back to the previous display hit q for Quit.

This is only a diagnose.
It doesn't change anything until you will confirm it at Write.

deanfarnaby
Posts: 7
Joined: 27 Feb 2012, 17:51

Re: Accidentally Deleted Partition (NTFS)

#8 Post by deanfarnaby »

Shows how little I know, Presumptions always let me down.

I will try to see if I can find out if this is correct first, but as you said it does not right anything back, I will give it a whirl all the same.

many thanks for the help. I literally have all my media on there, I've been collecting this stuff since I was about 14. All the video files I have the original DVD's / BR discs. I usualy rip or download them so I keep the disc in perfect condidtion. Some of them are still sealed. The mp3's are a different matter. I can't even remeber where I got most of them, mix of purchases, cd rips and the occasional download

deanfarnaby
Posts: 7
Joined: 27 Feb 2012, 17:51

Re: Accidentally Deleted Partition (NTFS)

#9 Post by deanfarnaby »

2.5 inch hdd normally have a geometry of 240 Heads per Cylinder.
Especially to portable devices like Laptops, Notebooks etc..
But USB doesn't even take care of and uses often 255 Heads per Cylinder.
Just to clarify here, Are you saying my drive is most likely a 240 HpC. and the USB controller / OS has been "lazy" and set it to 255 ?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidentally Deleted Partition (NTFS)

#10 Post by Fiona »

It's easily another try to get your data.

3.5inch harddrives usually have 16 heads per Cylinder.
But controller from motherboard converts it to 255 Head.

2.5 inch harddrives normally have 15 Heads per Cylinder.
Controller on Portable devices like Note- and Netbooks, Laptops etc.. convert it often to 240 Heads per cylinder.

Today, you almost don't find that info on your harddrive anymore, but only LBA (Logical Block Addressing).

The USB-protocol is different.
It converts mostly to 255 Heads per Cylinder.

Your harddrive has 2.5 inch;
http://www.aria.co.uk/Products/Componen ... ctId=41554

Until yet, you didn't find anything.
That's why I've suggested to have another try with 240 Heads per Cylinder.
But at least it's worth another try.

Also the comment from cgrenier;
As you are running RebuildBS, even if it failed because the partition location isn't identical the previous one, the testdisk.log file may list possible partition starting offsets.
Otherwise, you should test datarecovery software like PhotoRec

Fiona

Locked