cgsecurity.org

Relating to my earlier post i've had testdisk analyze the disk where i accidentally reformatted one partition.
In Windows i had 4 partitions:
A: HPTOOLS - 150MB
C: WIN7 - 512GB
D: WIN10 - 404GB
R: RECOVERY - 14GB

I accidentally reformatted C while trying to reinstall win7 but quit that process immediately.
The linux liveCD im currently using finds the new C, mounts it, and can access a system volume information folder in it, but doesnt display A:
/dev/sda1 512GB
/dev/sda2 14GB
/dev/sda3 404GB


TestDisk however shows..... something very different for the disk in question:
NTFS - NTFS - 14GB Primary Bootable, green(R: most likely)
Linux - ext3 - 20MB Primary, green(?)
Linux - ext3 - 20MB Primary, green (?)
Linux - ext4 - 30GB Logical, green (??????)
Linux - ext3 - 16GB Logical, green (???????)
Linux - ext4 - 30GB No characteristic, gray (?????????)
NTFS - NTFS - 404GB No characteristic, gray (D: most likely)

The first numbers for the location.... whatever they might be, Sector, Cylinder, etc i guess, there's not much documentation for this version of the GUI .... don't overlap and seem to correlate to the size of the partition. There are two significant gaps between partitions
1. starts at 0 1 1 and ends at 1847 254 63
2. starts at 34827 88 14
4. ends at 42090 162 56
5. starts at 61770 110 37
Neither of these however look as big as the gap for the 7. 404GB partition starting at 68737 0 1 and ending at 121600 254 63

The easiest explanation for this would be that instead of the actual C partition which has been reformatted and is now accessible but empty the utility somehow finds nonsense linux partitions in its place? Maybe from emulators i had installed?

The question here is what the numbers in the UI refer to.
And the colors.
And the "Recover" thing in the i fo for the linux partitions.
This is sortof a sidetrack to my actual thread but does this mean that the partition i actually want to recover is in that big empty space filled with garbage linux partitions?

Testdisk logfile?
screenshots?

As explained in my earlier post i'm running things from a live CD thing.
No logs.
https://drive.google.com/file/d/17TbNy6 ... p=drivesdk
Here's a screenshot acquired with much effort.

NobodyImportant wrote: 28 Apr 2020, 13:33 As explained in my earlier post i'm running things from a live CD thing.
No logs.

Not true.
The live linux versions on DVD or USB redirect write operations into RAM. Those versions emulate a drive.
RAM content is lost when turning the machine off. You can use a USB stick to backup those logs.

NobodyImportant wrote: 27 Apr 2020, 15:21 The easiest explanation for this would be that instead of the actual C partition which has been reformatted and is now accessible but empty the utility somehow finds nonsense linux partitions in its place? Maybe from emulators i had installed?

I think this is highly probable. Ten years ago I was deleting the wrong drive and used testdisk. There only should have been two partitions. Instead there were many. Years later it came to my mind that they were probably resulting from Testdisk finding the boot sectors of VMWare drive images.


Do not link to a google page, when you can embed your image using the [img] tag. You just have to copy the direct link to your image out of your google drive.

What you see is a summary of your MBR style partition scheme.
CHS stands for cylinder, head and sector. When an extended partition is involved, the addresses might refer to the beginning of the extended partitions and not to the beginning of the disk.

I literally have no idea how to embed that image and yours appears broken for me now.
Imgur is broken for me and i think you can only temporarily embed images from google drive... which is what those hashes at the end of the direcr link are.

Also chs how and where?
The three numbers?
I thought about that but that would mean that it first writes all sectors of a partition and then all heads at the same cylinder and only then does it switch to the next cylinder.... as the first number is continuous.

Also it can't be reading the MBR because in the place of those linux drives i have a functional but empty c drive now and those lost linux drives of emulators i had were only found with the analyze function of testdisk.

Also what do the colors mean?