cgsecurity.org

Hello All,

have the following situation:
Friend accidentally used his 1TB external WD to create a Win10 startup media and by doing so lost the previous partition and data by the re-formatting that was performed by the Win10 bootmedia installer. Afterwards he created a second partition to save some data to it. So basically now the partition setup looks like this:



On the first partition 4.61 GB are occupied by the installer files on the second he already wrote some 11.8 GB
Is there any chance to recover the previously existant partition and some data of it?
I am unsure as to whether it was a FAT32 or an NTFS partition.

What would be the best approach to start the recovery process?
Which partition table type is best to select when looking for the lost NTFS or FAT32 partition? "Intel" or "EFI GPT"?
Would a Deep Search help?

When doing an Analysis and Quick Search after selcting "Intel" as partition type,
after the Quick Search it tells me: "The following partition can´t be recovered".
In a later step I get these three partitions as deleted (if I understand correctly). Would it make sense to select this partition as "P"/Primary and write it to disk?



This is the log file: https://pastebin.com/rPSTykzG

Thank you for your help!

AbuItamar wrote: 05 Nov 2020, 21:58 Hello All,

have the following situation:
Friend accidentally used his 1TB external WD to create a Win10 startup media and by doing so lost the previous partition and data by the re-formatting that was performed by the Win10 bootmedia installer. Afterwards he created a second partition to save some data to it. So basically now the partition setup looks like this:



On the first partition 4.61 GB are occupied by the installer files on the second he already wrote some 11.8 GB
Is there any chance to recover the previously existant partition and some data of it?
I am unsure as to whether it was a FAT32 or an NTFS partition.

What would be the best approach to start the recovery process?
Which partition table type is best to select when looking for the lost NTFS or FAT32 partition? "Intel" or "EFI GPT"?

As there was just one partition on the drive before it does not really matter as there is sufficient space to hold even a GPT structure.

Would a Deep Search help?

Try it out.

When doing an Analysis and Quick Search after selcting "Intel" as partition type,
after the Quick Search it tells me: "The following partition can´t be recovered".
In a later step I get these three partitions as deleted (if I understand correctly). Would it make sense to select this partition as "P"/Primary and write it to disk?

It would only make sense if you checked the partition for valid content before using the "p"-key.



Please attach the picture using the attachment tab on the bottom of the page. That way the picture is kept and other people searching for information won't miss your picture.

This is the log file: https://pastebin.com/rPSTykzG

Thank you for the further thoughts.

When trying to look at the files of that partition listed in the middle as deleted
and seemingly spanning the whole disk it says:

Can´t open filesystem. Filesystem seems damaged.

The other two partitions (first and third one) I can look at and they contain the files that are presently on the external HDD.

Shall I just give it a try and set the middle partition as Primary and write these changes to disk?
Or could that do more harm if it´s not the right partition?
Which tool could I use on Windows to do a carbon copy of the whole 1TB external HDD as an image file to another drive?
And in case a Deep Search is better do you recommend to let that run until the end or would the lost partition already be discovered after say 10% or so?
Or if you recommend doing the deep search across the whole drive what is a good guestimate of how long a deep search would take for that 1TB drive?

Sorry for all the additional questions, just trying to do my best to at least rescue some data...

AbuItamar wrote: 09 Nov 2020, 21:24 Thank you for the further thoughts.

When trying to look at the files of that partition listed in the middle as deleted

2020-11-09 21_17_23-cgsecurity.org - Post a reply.png

and seemingly spanning the whole disk it says:

Can´t open filesystem. Filesystem seems damaged.

The other two partitions (first and third one) I can look at and they contain the files that are presently on the external HDD.

Shall I just give it a try and set the middle partition as Primary and write these changes to disk?

No. It does not become readable that way.

Or could that do more harm if it´s not the right partition?

With GPT it is less risky as the partition scheme is not interleaved with the partitions.

Which tool could I use on Windows to do a carbon copy of the whole 1TB external HDD as an image file to another drive?

Nothing comes close to ddrescue (Linux). I have no experience with such tools. A google search shows me "dd for Windows", "Win32DiskImager". I guess Acronis True Image supports the sector-by-sector mode for complete drives as well. The equivalent with Paragon Products might do this, too. None of them deals with dammaged discs in a smart way as ddrescue does.

And in case a Deep Search is better do you recommend to let that run until the end or would the lost partition already be discovered after say 10% or so?

10% or even lower would really speed up the search process and failure will be nearly guaranteed! I wonder why you all ask that "speed me up" question. This question comes quite often. Are you all staring at the screen when deep search is on its way? You don't have to monitor your computer, folks. Testdisk will do the search for you on its own. If, however, your time is so valuable you might consider a professional recovery service. You all failed to backup. Bite the bullet and wait or pay a professional a multiple of the price of one backup drive. Lost partition information is as small as the needle in the haystack. Try searching the needle. You won't shorten it unless you do not really care finding the needle.

[/quote]just trying to do my best to at least rescue some data...[/quote]
Trying to do best means letting Testdisk do its job until the end.

Or if you recommend doing the deep search across the whole drive what is a good guestimate of how long a deep search would take for that 1TB drive?

Searching for partition markers is not computationally expensive. The continuous read speed of your drive (not the burst rate!) as documented in the data sheet is your reference. That depends on drive technology (HDD, SSD) as well as on speed (5400rpm, 7200rpm, 10000rpm) as well as on the interface used (USB2.0, USB3.0, esata). If you have a similar, comparable drive, fill an empty partition that covers the whole drive with h2testw. That gives you a speed indication, especially once the reading process starts after writing. If you don't fill up the partition completely, h2testw will show you exagerated values as it doesn't get where reading and writing gets slower.

Reading the whole disk might make sector errors appear which would slow down the search process.
You might stop Testdisk here and run smartmontools to check the SMART values. Running smartmontools does not a take century to run, it's fast. Even if don't suspect it, in such a situation it is always good getting some information on the drive health. If you discover pending sectors then, you let ddrescue duplicate the drive. If you apply Testdisk on a healthy duplicate, there will be no sector read errors slowing Testdisk down.

Thank you recuperation for all your valuable comments and the time that you put into this thread!

Started the deep search and it´s moving slow but steady.
Now at 29% with the bellow output so far:
With these messages does that look like there are sector errors?
Shall I cancel the deep dearch and run smartmontools first?

Will probably look into doing an image of the drive with ddrescue as well before further operations.

Good night from Sauerland to Hannover

AbuItamar wrote: 10 Nov 2020, 20:35 Thank you recuperation for all your valuable comments and the time that you put into this thread!

Started the deep search and it´s moving slow but steady.

As I stated in another thread "slow" is not a quantitative term. What would you say if a police officer would try to fine you just stating that you were going too fast?

Now at 29% with the bellow output so far:

TestDisk_DeepSearch.png

With these messages does that look like there are sector errors?

No.

Shall I cancel the deep dearch and run smartmontools first?

Can't tell you because I don't know what "slow" is.

thanks for the further thoughts and advice, really appreciate it!

on the home stretch now:

So the deep search just finished and I can see the below two partision of which it says that they can´t be recovered:
And ideas of what I could do next?
I am a bit afraid to go the wrong route and lose all the deep search findings of the last couple of days now.

I looked at both of these partitions and none of them shows any of the lost files (when using the p option).
What else could I do?

"Woll", Testdisk does not succeed here. As always, you can try Photorec as well. If you are unhappy with the findings, try a commercial recovery software.