cgsecurity.org

Originally I have a non-empty 4TB HDD with partitions, and something happened (because of Windows Recovery Tools) that now it is partitioned as : I have ran testdisk and I found that my last 1TB partition, it was listing the correct files. Then testdisk was showing 3 partitions to write : 32MB, 2TB (current partition), 1TB (my lost partition).
After confirming to write my partition table and restarted. But I found that from gparted that my 1TB partition was placed next after the 2TB one : while it supposedly placed on relatively last position of the whole disk (1 TB is remaining of 1.5+1.5TB as before). Running testdisk again resulting me found only 32MB, 2TB and raw again, and I'm putting on hold to search partitions again.

What should I do? Should I delete my 1TB partition and do partition search again? How to get back my 1TB partition that was relatively on the end?

While my priority is to find my last 1TB and get it backed up, I plan to recover the former partition (1.5TB-1.5TB) after that. Does it possible to return it back to my original partition, which is :
Or at least recovering the files from it. Thank you

I would rerun Tesdisk including deep search. When finding the 1TB partition I would have Testdisk copy its content immediately to another drive. If Testdisk does not find more information you could continue with Photorec or use some commercial recovery software.

Yes, I found my 1TB partition again after running deep search again. Now I am listing the files and attempting to copy the files. It is still running right now, but it have many failed copies. Does it possibly copying all hidden files too? if so, how to skip it? (rather than copying it manually for each of folder tree)?

I don't know. You have to do post processing on your own afterwards.

Is there any way to create image of my correct 1TB partition? As I mentioned, I have it written the partition table after running first search, but it was misplaced so it won't list the correct file listing (displayed as bad/error) just like when I searching again and got correct list / found my files. I have tried writing it again, but it results same.

itoniaxi wrote: ↑05 Mar 2021, 10:26 Is there any way to create image of my correct 1TB partition? As I mentioned, I have it written the partition table after running first search, but it was misplaced

There is no such thing as a "misplacement" as you are supposed to check the validity of the content using the "p"-key ("list files). And even when you can see your file and directory structures there is no guarantee that the data is as expected. Use Testdisk to export the content and check the exports later. Anyway, I have difficulties in understanding exactly how your problems arise. Go and document the case - from two sentences of yours I can hardly judge any wrongdoing on your side.

so it won't list the correct file listing (displayed as bad/error) just like when I searching again and got correct list / found my files. I have tried writing it again, but it results same.

the thing is, now I have recovered most files (but not completely, as you said) on my 1TB partition.

the problem was, I could not get correct partition table rewrite on EFI/GPT. After retries, it was either the partition was not found or it was but failed to rewrite the partition table found.
It was detected by testdisk as EFI/GPT, possibly since the hdd was an external hdd (NTFS, GPT) before it got formatted as windows recovery drive (NTFS, MBR).

After I tried Intel partition type, partition that I wanted was back : Thank you for keeping up with me. I decided that I have done with my last 1TB.

Next thing I want to do is recover files from the first 3TB. testdisk could not find the partitions back like it was : the question is, should I straight using photorec? could I delete and join first 1.5+1.5TB partition first, then do recovery on that?

Did you extract your drive from an external housing?

recuperation wrote: ↑21 Sep 2021, 11:35 Did you extract your drive from an external housing?

yes, I thought it would be faster on SATA than USB. or was I not supposed to do that?

No. There might be interface electronics that changes the sector size.