cgsecurity.org

Hi, I recently bought a 8TB WDC drive which I backed crucial data too in Centos 7. I booted into Windows 10 and accidently formatted two partitions (each 2TB) by ya know... pressing enter when the format prompt came. I needed help using testdisk as this is my first time. I need to get my data from a formatted partition using this program. It is very important and can't be lost. PLEASE HELP
testdisk.log:


Tue Jan 5 21:54:40 2021
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 3.10.0-1160.11.1.el7.x86_64 (#1 SMP Fri Dec 18 16:34:56 UTC 2020) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 5.9
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size 500118192 sectors
/dev/sda: user_max 500118192 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 976773168 sectors
/dev/sdb: user_max 976773168 sectors
/dev/sdb: native_max 976773168 sectors
/dev/sdc: LBA, LBA48, DCO support
/dev/sdc: size 3907029168 sectors
/dev/sdc: user_max 3907029168 sectors
/dev/sdc: dco 3907029168 sectors
/dev/sdj: LBA, HPA, LBA48, DCO support
/dev/sdj: size 15628053168 sectors
/dev/sdj: user_max 15628053168 sectors
/dev/sdj: native_max 15628053168 sectors
/dev/sdk: LBA, HPA, LBA48, DCO support
/dev/sdk: size 15628053168 sectors
/dev/sdk: user_max 15628053168 sectors
/dev/sdk: native_max 15628053168 sectors
/dev/mapper/centos-home: LBA, HPA, LBA48, DCO support
/dev/mapper/centos-home: size 853680128 sectors
/dev/mapper/centos-home: user_max 976773168 sectors
/dev/mapper/centos-home: native_max 976773168 sectors
/dev/mapper/centos-root: LBA, HPA, LBA48, DCO support
/dev/mapper/centos-root: size 104857600 sectors
/dev/mapper/centos-root: user_max 976773168 sectors
/dev/mapper/centos-root: native_max 976773168 sectors
/dev/mapper/centos-swap: LBA, HPA, LBA48, DCO support
/dev/mapper/centos-swap: size 16121856 sectors
/dev/mapper/centos-swap: user_max 976773168 sectors
/dev/mapper/centos-swap: native_max 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
/dev/dm-0: LBA, HPA, LBA48, DCO support
/dev/dm-0: size 104857600 sectors
/dev/dm-0: user_max 976773168 sectors
/dev/dm-0: native_max 976773168 sectors
/dev/dm-1: LBA, HPA, LBA48, DCO support
/dev/dm-1: size 16121856 sectors
/dev/dm-1: user_max 976773168 sectors
/dev/dm-1: native_max 976773168 sectors
/dev/dm-2: LBA, HPA, LBA48, DCO support
/dev/dm-2: size 853680128 sectors
/dev/dm-2: user_max 976773168 sectors
/dev/dm-2: native_max 976773168 sectors
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - MTFDDAK256MAY-1AH1ZABHA, S/N:14140C149BB9, FW:M504
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - MB2000GCWLT, S/N:P6J1X0NT, FW:HPG3
Disk /dev/sdj - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - DW CDW08FEXA6-K8BN0N, S/N:GV8JG3GA, FW:180.A018
Disk /dev/sdk - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - DW CDW08FEXA6-K8BN0N, S/N:GV8J84G6, FW:180.A018
Disk /dev/mapper/centos-home - 437 GB / 407 GiB - 853680128 sectors, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A
Disk /dev/mapper/centos-root - 53 GB / 50 GiB - 104857600 sectors, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A
Disk /dev/mapper/centos-swap - 8254 MB / 7872 MiB - 16121856 sectors, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A
Disk /dev/dm-0 - 53 GB / 50 GiB - 104857600 sectors, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A
Disk /dev/dm-1 - 8254 MB / 7872 MiB - 16121856 sectors, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A
Disk /dev/dm-2 - 437 GB / 407 GiB - 853680128 sectors, sector size=512 - TOSHIBA MK5076GSX, S/N:Y268F6HWS, FW:GS001A

Partition table type (auto): Intel
Disk /dev/sdk - 8001 GB / 7452 GiB - DW CDW08FEXA6-K8BN0N
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15628053167 (expected 15628053167)
hdr_lba_start=34
hdr_lba_end=15628053134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=15628053167
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=15628053134
hdr_lba_table=15628053135
hdr_entries=128
hdr_entsz=128
Trying alternate GPT

Analyse Disk /dev/sdk - 8001 GB / 7452 GiB - CHS 972801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15628053167 (expected 15628053167)
hdr_lba_start=34
hdr_lba_end=15628053134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=15628053167
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=15628053134
hdr_lba_table=15628053135
hdr_entries=128
hdr_entsz=128
Trying alternate GPT
Current partition structure:
Trying alternate GPT

search_part()
Disk /dev/sdk - 8001 GB / 7452 GiB - CHS 972801 255 63

recover_EXT2: s_block_group_nr=0/28366, s_mnt_count=14/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 929506304
recover_EXT2: part_size 7436050432
Filesystem created: Thu Dec 24 14:26:06 2020
Last mount time: Tue Jan 5 14:50:53 2021
Linux filesys. data 2048 7436052479 7436050432 [d2p3]
ext4 blocksize=4096 Large_file Sparse_SB, 3807 GB / 3545 GiB
NTFS at 462872/219/4
filesystem size 4096000000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 3340052481 7436052480 4096000000
NTFS found using backup sector, blocksize=4096, 2097 GB / 1953 GiB
NTFS at 462872/219/4
filesystem size 4096000000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 7436052480 11532052479 4096000000
NTFS, blocksize=4096, 2097 GB / 1953 GiB
NTFS at 717837/17/5
filesystem size 4096000000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 7436052481 11532052480 4096000000
NTFS found using backup sector, blocksize=4096, 2097 GB / 1953 GiB
NTFS at 717837/17/5
filesystem size 4096000000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 11532052480 15628052479 4096000000
NTFS, blocksize=4096, 2097 GB / 1953 GiB

Results
Linux filesys. data 2048 7436052479 7436050432 [d2p3]
ext4 blocksize=4096 Large_file Sparse_SB, 3807 GB / 3545 GiB
MS Data 3340052481 7436052480 4096000000
NTFS found using backup sector, blocksize=4096, 2097 GB / 1953 GiB
MS Data 7436052480 11532052479 4096000000
NTFS, blocksize=4096, 2097 GB / 1953 GiB
MS Data 7436052481 11532052480 4096000000
NTFS found using backup sector, blocksize=4096, 2097 GB / 1953 GiB
MS Data 11532052480 15628052479 4096000000
NTFS, blocksize=4096, 2097 GB / 1953 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 7436050432 linear /dev/sdk 2048" | dmsetup create test0
echo "0 4096000000 linear /dev/sdk 3340052481" | dmsetup create test1
echo "0 4096000000 linear /dev/sdk 7436052480" | dmsetup create test2
echo "0 4096000000 linear /dev/sdk 7436052481" | dmsetup create test3
echo "0 4096000000 linear /dev/sdk 11532052480" | dmsetup create test4

ServerGuy12 wrote: 06 Jan 2021, 07:19 Hi, I recently bought a 8TB WDC drive which I backed crucial data too in Centos 7. I booted into Windows 10 and accidently formatted two partitions (each 2TB) by ya know... pressing enter when the format prompt came. I needed help using testdisk as this is my first time. I need to get my data from a formatted partition using this program. It is very important and can't be lost. PLEASE HELP

Strangely, if your data is a backup there is still the original source data available.

It is very important and can't be lost.

For such highly important data I would recommend you contacting a professional recovery service.

Otherwise, as your "data is very important and can't be lost" you should duplicate your drive as described in the manual:

https://www.cgsecurity.org/testdisk.pdf

Otherwise read
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

A precise case description is required for your very important data.
As the log file only shows the current status of your drive you should describe how the drive had been before in terms of partitions and file systems.

1. I have already deleted the original data.
2. I have recovered the data. It just took 3 days to complete.
3. Is there a way to have testdisk scan a partition only instead of the entire disk.

ServerGuy12 wrote: 03 Feb 2021, 08:46 3. Is there a way to have testdisk scan a partition only instead of the entire disk.

No, there is no reason to search a partition within another partition.