cgsecurity.org

Hi all,

I used Testdisk to recover a partition after one drive became unreadable. It worked - in part.

However, many files are missing as it seems to have recovered a 2TB partition, leaving the remaining 746GB as 'Unallocated'.

Could someone please guide me on the steps required to recover that key missing 746GB?

Thank you

Did you run the deep search function?

Please keep the GPT setting because the MBR setting does not allow for drives over 2TB when using a drive with emulated 512 byte sectors.
Once there is a choice of partitions to be made you would need to select the one that spans the whole disk.

Thanks for the reply. Running Deep Search now.

Using GPT, the screenshots below are what I currently get. Which one looks like the complete 3TB partition?

Also wondering about that 'seems too small!' error ....

Well, you should be able to guess that yourself.
You have two choices, a smaller one and a bigger one. The size in sectors is printed on the screen.
With a sector size of 512 Bytes you can calculate the partition size in bytes simply by multiplying the number of sectors of both partitions with the sector size.

Use the "p"-key to list files if you can see the expected content within.

Obviously I expect it to be the bigger one, the second partition.

That is the strange thing - when I select the larger partition, I -can- see the missing directories. BUT many files are missing and are reported as being '0' bytes .... it seems roughly 1/3 of the files are missing (which would make sense if the partition was only showing as 2TB + 1TB unallocated.

In other words, it seems that the disk has somehow partitioned into two, even though it was originally a single 3TB GPT volume.

Is it likely those missing files are gone for good?

This is the error message I see when attempting to preview the files on the second / larger partition:

Correction!

the largest partition is the one labeled [WD22], the one with the biggest number of sectors!!!

Sorry - yes, I know WD22 is the largest and that is the accessible partition which allows me to preview the files using 'p'.

However, as mentioned it seems roughly one third of the files are gone / are 0 bytes in size.

Do you think I have lost them permanently, or could there be a way to recover that missing 746GB ?

Thank you

sandyman wrote: 25 Aug 2020, 22:47 Do you think I have lost them permanently,

I can't tell.

or could there be a way to recover that missing 746GB ?

Try Photorec if you can stand loosing file name and order structure.
Otherwise try out any commercial software.