Windows 10 Setup - Deleted all existing partitions and re-created them - Next step?
Posted: 13 Jun 2020, 18:55
This is 100% my own stupid mistake. If I have to lose this data so be it. But I think there is a good chance the data is still there.
Computer is a Microsoft Surface Pro with an internal 64GB SSD (sda in the log), running Windows 10 Pro 64bit with (I think) a normal simple EFI layout. The computer is UEFI only, no BIOS emulation.
Accidentally booted from a Win10 Setup USB Drive that had an unattended XML file to automatically delete all existing partitions and set up the "default" Windows EFI partition layout. I realized this right away and cancelled the ensuing Windows install within a few seconds. The setup program said something like "No changes were made".
Unfortunately, the partition deletion/creation was made, and of course after rebooting the drive wouldn't boot.
Thinking (dumb) that it would be easier to recover from a disk with no partitions I ran diskpart from the Win10 setup drive and deleted all the newly-created partitions on the disk.
I then burned a USB drive with CAINE, which I know automatically locks all disks to prevent accidental writes. I ran testdisk from that LiveCD (which is Ubuntu).
When doing a quick Scan of sda it finds the normal Win10 EFI partitions, but the [Windows] NTFS partition only has a "Recovery" folder (empty) and a "Recovery.txt" file (also empty).
When doing a deeper search it appears to find two WinRE partitions, two [NO NAME] partitions, and at the very end, I see two [Windows] partitions, but then immediately I get the error:
"The hard disk (64GB / 59 GiB) seems too small! (> 127 GB / 118 GiB) Check the harddisk size: HD jumper settings, BIOS detection..."
and tells me that the [Windows] partition can't be recovered.
Here is the log file:
Any ideas to see if TestDisk can recover the original partitions? If not, maybe it's time to try PhotoRec to attempt to recover some files.
Thank you.
Computer is a Microsoft Surface Pro with an internal 64GB SSD (sda in the log), running Windows 10 Pro 64bit with (I think) a normal simple EFI layout. The computer is UEFI only, no BIOS emulation.
Accidentally booted from a Win10 Setup USB Drive that had an unattended XML file to automatically delete all existing partitions and set up the "default" Windows EFI partition layout. I realized this right away and cancelled the ensuing Windows install within a few seconds. The setup program said something like "No changes were made".
Unfortunately, the partition deletion/creation was made, and of course after rebooting the drive wouldn't boot.
Thinking (dumb) that it would be easier to recover from a disk with no partitions I ran diskpart from the Win10 setup drive and deleted all the newly-created partitions on the disk.
I then burned a USB drive with CAINE, which I know automatically locks all disks to prevent accidental writes. I ran testdisk from that LiveCD (which is Ubuntu).
When doing a quick Scan of sda it finds the normal Win10 EFI partitions, but the [Windows] NTFS partition only has a "Recovery" folder (empty) and a "Recovery.txt" file (also empty).
When doing a deeper search it appears to find two WinRE partitions, two [NO NAME] partitions, and at the very end, I see two [Windows] partitions, but then immediately I get the error:
"The hard disk (64GB / 59 GiB) seems too small! (> 127 GB / 118 GiB) Check the harddisk size: HD jumper settings, BIOS detection..."
and tells me that the [Windows] partition can't be recovered.
Here is the log file:
Code: Select all
Sat Jun 13 14:31:16 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.0.0-32-generic (#34~18.04.2-Ubuntu SMP Thu Oct 10 10:36:02 UTC 2019) x86_64
Compiler: GCC 7.4
ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 125045424 sectors
/dev/sda: user_max 125045424 sectors
/dev/sda: native_max 125045424 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 64 GB / 59 GiB - CHS 7783 255 63 (RO), sector size=512 - C400-MTFDDAT064MAM, S/N:0000000012470355C77B, FW:07MH
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Seagate Expansion SSD, FW:0001
Disk /dev/sdc - 30 GB / 28 GiB - CHS 29327 64 32 (RO), sector size=512 - SanDisk Ultra Fit, FW:1.00
Disk /dev/loop0 - 3928 MB / 3746 MiB - 7672488 sectors (RO), sector size=512
Partition table type (auto): Intel
Media is opened in read-only.
Disk /dev/sda - 64 GB / 59 GiB (RO) - C400-MTFDDAT064MAM
Partition table type: Intel
Analyse Disk /dev/sda - 64 GB / 59 GiB - CHS 7783 255 63 (RO)
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295
Bad sector count.
No partition is bootable
search_part()
Disk /dev/sda - 64 GB / 59 GiB - CHS 7783 255 63 (RO)
NTFS at 0/32/33
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
NTFS, blocksize=4096, 524 MB / 500 MiB
FAT32 at 63/221/31
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
FAT32 at 63/221/31
FAT: cluster=2(0x2), pos=1034240
FAT32 63 221 31 76 157 17 204800 [SYSTEM]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 78/167/26
filesystem size 123781120
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS, blocksize=4096, 63 GB / 59 GiB
Results
* HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
NTFS, blocksize=4096, 524 MB / 500 MiB
P FAT32 63 221 31 76 157 17 204800 [SYSTEM]
FAT32, blocksize=1024, 104 MB / 100 MiB
P HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS, blocksize=4096, 63 GB / 59 GiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1024000 linear /dev/sda 2048" | dmsetup create test0
echo "0 204800 linear /dev/sda 1026048" | dmsetup create test1
echo "0 123781120 linear /dev/sda 1263616" | dmsetup create test2
ntfs_device_testdisk_io_ioctl() unimplemented
dir_partition inode=5
P HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS, blocksize=4096, 63 GB / 59 GiB
Directory /
5 dr-xr-xr-x 0 0 0 13-Jun-2020 19:31 .
5 dr-xr-xr-x 0 0 0 13-Jun-2020 19:31 ..
36 dr-xr-xr-x 0 0 0 13-Jun-2020 19:31 Recovery
41 -r--r--r-- 0 0 0 13-Jun-2020 19:31 Recovery.txt
interface_write()
1 * HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
2 P FAT32 63 221 31 76 157 17 204800 [SYSTEM]
3 P HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
search_part()
Disk /dev/sda - 64 GB / 59 GiB - CHS 7783 255 63 (RO)
NTFS at 0/32/33
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/30
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
FAT32 at 63/221/31
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
FAT32 at 63/221/31
FAT: cluster=2(0x2), pos=1034240
FAT32 63 221 31 76 157 17 204800 [SYSTEM]
FAT32, blocksize=1024, 104 MB / 100 MiB
FAT32 at 63/221/37
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
FAT differs, FAT sectors=752-768/769
set_FAT_info: name from BS used
FAT32 at 63/221/37
FAT: cluster=2(0x2), pos=1034240
FAT32 63 221 31 76 157 17 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 78/167/26
filesystem size 123781120
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS, blocksize=4096, 63 GB / 59 GiB
NTFS at 7783/172/5
filesystem size 123781120
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS found using backup sector, blocksize=4096, 63 GB / 59 GiB
NTFS at 7783/172/5
filesystem size 123781120
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 7783 172 5 15488 176 47 123781120
NTFS, blocksize=4096, 63 GB / 59 GiB
This partition ends after the disk limits. (start=125044735, size=123781120, end=248825854, disk end=125045424)
Disk /dev/sda - 64 GB / 59 GiB - CHS 7783 255 63 (RO)
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (64 GB / 59 GiB) seems too small! (< 127 GB / 118 GiB)
The following partition can't be recovered:
HPFS - NTFS 7783 172 5 15488 176 47 123781120
NTFS, blocksize=4096, 63 GB / 59 GiB
Results
* HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
NTFS, blocksize=4096, 524 MB / 500 MiB
P FAT32 63 221 31 76 157 17 204800 [SYSTEM]
FAT32, blocksize=1024, 104 MB / 100 MiB
P HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS, blocksize=4096, 63 GB / 59 GiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1024000 linear /dev/sda 2048" | dmsetup create test0
echo "0 204800 linear /dev/sda 1026048" | dmsetup create test1
echo "0 123781120 linear /dev/sda 1263616" | dmsetup create test2
ntfs_device_testdisk_io_ioctl() unimplemented
dir_partition inode=5
P HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
NTFS, blocksize=4096, 63 GB / 59 GiB
Directory /
5 dr-xr-xr-x 0 0 0 13-Jun-2020 19:31 .
5 dr-xr-xr-x 0 0 0 13-Jun-2020 19:31 ..
36 dr-xr-xr-x 0 0 0 13-Jun-2020 19:31 Recovery
41 -r--r--r-- 0 0 0 13-Jun-2020 19:31 Recovery.txt
interface_write()
1 * HPFS - NTFS 0 32 33 63 221 30 1024000 [WinRE]
2 P FAT32 63 221 31 76 157 17 204800 [SYSTEM]
3 P HPFS - NTFS 78 167 26 7783 172 5 123781120 [Windows]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Thank you.