Is there a way for testdisk to focus on a sector?

[ppmm]

Hi,

OK, after deeper search, I identified the ext4 partition I want to recover. It stills has the files I need.
The problem is deepter search shows some MS partitions as deleted (while analysis didn't) and it "founds" a good number of partitions that don't exist resulting in overlapping and broken partition table.
Here's the log : https://drive.google.com/file/d/1EMjLsF ... sp=sharing

Is there a way to tell testdisk to stop searching and simply undelete a partition starting at 888'901'632 and being 83'302'392 long, and load the previous partition table to write all this up?

EDIT: Would it be safe to add it directly into the backup.log to load?

Code: Select all

#1588241307 Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
 1 : start=     2048, size=   589824, Id=00, P
 2 : start=   591872, size=   157696, Id=00, P
 3 : start=   749568, size=517193728, Id=00, P
 5 : start=517943296, size=368639999, Id=00, P
 7 : start=886583296, size=  1026048, Id=00, P
 4 : start=887609344, size=  1290240, Id=00, P
 6 : start=972204032, size=  4569086, Id=00, P

+

Code: Select all

8 : start=888901632, size=  83302392, Id=00, P

Gparted:

Screenshot from 2020-04-30 13-40-26.png (74.5 KiB) Viewed 900 times

EDIT2: Looks like it's possible but it splits some partitions in 2 and find overlapping partitions:

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
     Partition               Start        End    Size in sectors
 P EFI System                  2048     264191     262144 [EFI System Partition] [NO NAME]
 P Unknown                     2048     591871     589824
>P Linux filesys. data       264192     421887     157696
 D MS Data                   421888  888573944  888152057
 P Unknown                   591872     749567     157696
 P Unknown                   749568  517943295  517193728
 P Unknown                517943296  886583294  368639999
 P Unknown                886583296  887609343    1026048
 P Unknown                887609344  888899583    1290240
 D MS Data                887609344  888899583    1290240
 D MS Data                888899583  890189822    1290240
 D Linux filesys. data    888901630  972204021   83302392
 P Unknown                888901632  972204023   83302392
 P Linux Swap             972204024  972204039         16
 P Unknown                972204032  976773117    4569086

resulting in bad structure

After re-entering types from gparted, I get a working structure (not applied yet, waiting for your reply):

Code: Select all

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
     Partition               Start        End    Size in sectors
 P EFI System                  2048     264191     262144 [EFI System Partition] [NO NAME]
 D Unknown                     2048     591871     589824
 P EFI System                264192     421887     157696
 D MS Data                   421888  888573944  888152057
 P Linux filesys. data       591872     749567     157696
 P MS Data                   749568  517943295  517193728
 P Linux filesys. data    517943296  886583294  368639999
 P EFI System             886583296  887609343    1026048
 P Windows Recovery Env   887609344  888899583    1290240
 P Linux filesys. data    888901632  972204023   83302392
 P Linux Swap             972204032  976773103    4569072
>D Unknown                972204032  976773117    4569086

I guess I'll use gparted for the flags?

If I messed up with exact format, can I change it back afterwards?

[ppmm]

I applied and now I get some weird partitions:

Screenshot from 2020-04-30 14-40-43.png (68.84 KiB) Viewed 882 times

I'll try to boot though.
How could I get back the previous partition table for boot?