AbuItamar wrote: 09 Nov 2020, 21:24
Thank you for the further thoughts.
When trying to look at the files of that partition listed in the middle as deleted
2020-11-09 21_17_23-cgsecurity.org - Post a reply.png
and seemingly spanning the whole disk it says:
Can´t open filesystem. Filesystem seems damaged.
The other two partitions (first and third one) I can look at and they contain the files that are presently on the external HDD.
Shall I just give it a try and set the middle partition as Primary and write these changes to disk?
No. It does not become readable that way.
Or could that do more harm if it´s not the right partition?
With GPT it is less risky as the partition scheme is not interleaved with the partitions.
Which tool could I use on Windows to do a carbon copy of the whole 1TB external HDD as an image file to another drive?
Nothing comes close to ddrescue (Linux). I have no experience with such tools. A google search shows me "dd for Windows", "Win32DiskImager". I guess Acronis True Image supports the sector-by-sector mode for complete drives as well. The equivalent with Paragon Products might do this, too. None of them deals with dammaged discs in a smart way as ddrescue does.
And in case a Deep Search is better do you recommend to let that run until the end or would the lost partition already be discovered after say 10% or so?
10% or even lower would really speed up the search process and failure will be nearly guaranteed! I wonder why you all ask that "speed me up" question. This question comes quite often. Are you all staring at the screen when deep search is on its way? You don't have to monitor your computer, folks. Testdisk will do the search for you on its own. If, however, your time is so valuable you might consider a professional recovery service. You all failed to backup. Bite the bullet and wait or pay a professional a multiple of the price of one backup drive. Lost partition information is as small as the needle in the haystack. Try searching the needle. You won't shorten it unless you do not really care finding the needle.
[/quote]just trying to do my best to at least rescue some data...[/quote]
Trying to do best means letting Testdisk do its job until the end.
Or if you recommend doing the deep search across the whole drive what is a good guestimate of how long a deep search would take for that 1TB drive?
Searching for partition markers is not computationally expensive. The continuous read speed of your drive (not the burst rate!) as documented in the data sheet is your reference. That depends on drive technology (HDD, SSD) as well as on speed (5400rpm, 7200rpm, 10000rpm) as well as on the interface used (USB2.0, USB3.0, esata). If you have a similar, comparable drive, fill an empty partition that covers the whole drive with h2testw. That gives you a speed indication, especially once the reading process starts after writing. If you don't fill up the partition completely, h2testw will show you exagerated values as it doesn't get where reading and writing gets slower.
Reading the whole disk might make sector errors appear which would slow down the search process.
You might stop Testdisk here and run smartmontools to check the SMART values. Running smartmontools does not a take century to run, it's fast. Even if don't suspect it, in such a situation it is always good getting some information on the drive health. If you discover pending sectors then, you let ddrescue duplicate the drive. If you apply Testdisk on a healthy duplicate, there will be no sector read errors slowing Testdisk down.