cgsecurity.org

Hey everyone,

A couple days ago my external hdd failed, showing me the "You need to format the drive to access it". This is a HDD I borrowed from my dad, containing multiple partitions (from what I remember, it looked like it was an old HDD used in another computer, as the drive contained a Program Files folder among other characteristic data found on a Windows installation). I tried to use PhotoRec to recover the data, but this 'only' recovered 120 GB of the total 450 GB (total disk size is 500GB). Now I tried u use TestDisk, but I am having a hard time getting things to work.

The first thing I tried was to use the Analyse function, followed by the Deeper Analyse function. These did not let me access the data yet unfortunately. After looking further, I saw some guides recommend going to the advanced option. Here I was prompted with the RebuildBS and BackupBS. I added some screenshots here: https://imgur.com/a/de1ht7P. I also have the .log of the Analyse results, I'll add it here: https://pastebin.com/hKW6ktgw. I Tried to use the RebuildBS option, which also did not work and now I am hesitant to use the BackupBS option (the Y/N confirmation scares me for some reason, it gives me the feeling that it might do something I do not want to happen...).

So I was wondering if the BackupBS option is what I want to use to re-obtain my data back, or if there is a different option that might help me. Thanks for helping!

Tibarn0wned wrote: 03 Jan 2021, 16:30 The first thing I tried was to use the Analyse function, followed by the Deeper Analyse function. These did not let me access the data yet unfortunately.

What about the partitions labeled [SYSTEM], [Windows] and [HP-Recovery] in deep search?
What did you do exactly?

I did not look at the smaller partitions found with deep search, as I thought I would find the files I needed on the larger partition. Additionally, I was not able to return to the screen where I could select looking at partitions again, I probably selected the wrong option (I think it was "quit" but I am not sure if other options were available).

I took the following steps:
- Analysis
- quick scan, where nothing was found
- deeper scan, where I looked at the largest of the four partitions as that was where I expected my files to be. Here it said that it was unable to find the files if I remember correctly.

After this I kept looking, and tried using the advanced option at the first menu

Tibarn0wned wrote: 04 Jan 2021, 19:57 ...
I looked at the largest of the four partitions as that was where I expected my files to be. Here it said that it was unable to find the files if I remember correctly.

After this I kept looking, and tried using the advanced option at the first menu

What do you mean by looking?

By looking I meant looking for ways to recover the data using testdisk, I'm new to this program so I do not completely know how the program works, so I tried to look for people with similar problems and looked at what they did to recover their data to see if their way would work for me as well.

You have to examine the found partitions checking for valid content using the "p"-key (list files) for each partition. This way you learn if you need to include them in the new partition table to be written.

I tried doing this, however all but one partition said that it was unable to list items. The one partition that had some files only had files named MSIxxxxx.tmp, which were not the files I was looking for. Is there anything else I can do?

Tibarn0wned wrote: 09 Jan 2021, 13:59 I tried doing this, however all but one partition said that it was unable to list items. The one partition that had some files only had files named MSIxxxxx.tmp, which were not the files I was looking for. Is there anything else I can do?

Using Photodisk is the next step. Alternatively using other third party software.