cgsecurity.org

Hello

I got an external drive (around 250G) where a friend accidently installed Windows 10 installation image. The partition of this installation image is around 32G so I bet there's a good chance the remaining data is not lost.

I created an image with ddrescue to have a save space (and because it's way faster reading from an SSD).

So I'm loading the image with testdisk backup.img and select Intel/PC partition, because it was a NTFS / FAT partition before (not sure about that, because my friend can't say for sure).

The quick search reveals this:

Disk backup.img - 250 GB / 232 GiB - CHS 30402 255 63
Partition Start End Size in sectors
>* HPFS - NTFS 0 1 1 30400 254 63 488392002

"List files" returns:

Can't open filesystem. Filesystem seems damaged.

So I'm proceeding to deeper search and eventually get this result:

The following partition can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 30400 254 63 60801 253 62 488392002

I'm trying to list the files for this partition and get:

Can't open filesystem. Filesystem seems damaged.

What else can I do?


tia

Disk backup.img - 250 GB / 232 GiB - CHS 30402 255 63
Partition Start End Size in sectors
>P HPFS - NTFS 0 1 1 30400 254 63 488392002
D FAT32 LBA 0 65 2 4177 150 5 67108864 [EFI System Partition] [ESD-USB]

You are now left with Photorec or any commercial recovery software.

Thank you, alread recovered with Photorec, but I was hoping to get a complete filesystem back, for the sake of clarity.

If you overwrite 32GB of 250GB assuming the 250GB drive was completely filled with data you will never get a complete file system back.

Think of your drive as a crashed plane. Look on the internet how planes look like that have been partly assembled from crashed parts.

That is your drive. You want each part unharmed and the passengers all up and living.
You expect too much.