cgsecurity.org

I am trying to recover a partition from 1 2TB Winchester Digital hard disk. This partition has disappeared after a repartitioning to one single large partition, which includes the previous old partition. My question is whether the information of this previous partition is lost or can I recover this partition?

I have tried analysis with Testdisk and deep analysis but could not yet find the partition, possibly because I did something wrong.

Details:
Originally, the disk was a windows boot drive with a boot sector a windows/data partition of about 1.8 TB, a recovery partition and some small partitions for which I do not know its function (state 1)

I reformatted the drive to have a smaller windows partition of about 1TB and a new data partition of about 0.8 TB (state 2).

Then I reduced several partitions to improve the possibility of cloning to a smaller ssd (0.5 TB). The windows partition was now about 0.4 TB and the second data partition of about 0.3 TB and creating a lot of unallocated space (state 3).

Up to now, everything was successful, including the cloning of the hard disk.

I made a back up of the data partition of 0.3 TB on another hard disk successfully.

I then reformatted the 2TB hard disk to one single partition of about 1.8 TB (state 4). Then my back-up had a head crash and is no longer readable.

My question is whether it is possible to recover the 0.3 TB data partition in state 3. There are no other problems with the hard disk other than the repartitioning.

tak101 wrote: 06 Mar 2021, 11:27 I am trying to recover a partition from 1 2TB Winchester Digital hard disk. This partition has disappeared after a repartitioning to one single large partition, which includes the previous old partition. My question is whether the information of this previous partition is lost or can I recover this partition?

Maybe.

I have tried analysis with Testdisk and deep analysis but could not yet find the partition, possibly because I did something wrong.

I can't tell. "I have tried analysis with Testdisk" is not a satisfying description.

Details:
Originally, the disk was a windows boot drive with a boot sector a windows/data partition of about 1.8 TB, a recovery partition and some small partitions for which I do not know its function (state 1)

I reformatted the drive to have a smaller windows partition of about 1TB and a new data partition of about 0.8 TB (state 2).

There is no "reformatting to a smaller size". Here you most likely deleted important parts of your data.

Then I reduced

How?!

several partitions to improve the possibility of cloning to a smaller ssd (0.5 TB). The windows partition was now about 0.4 TB and the second data partition of about 0.3 TB and creating a lot of unallocated space (state 3).

Up to now, everything was successful, including the cloning of the hard disk.

I made a back up of the data partition of 0.3 TB on another hard disk successfully.

I then reformatted

Read above about "reformatting"

the 2TB hard disk to one single partition of about 1.8 TB (state 4). Then my back-up had a head crash

How come you know?

and is no longer readable.

My question is whether it is possible to recover the 0.3 TB data partition in state 3.

Maybe. Due to a missing description of your Testdisk operation I can't tell you more.

There are no other problems with the hard disk other than the repartitioning.

I used the wrong word. I did not reformat the hard disk but resized the partitions to a smaller size. So I do not think that data were lost in that operation.

I will produce TestDisk results later, at this moment I am recovering some of the most important files using EaseUs. But if the second data partition could be recovered, that would be much better.

testdisk log: I get some warnings: The harddisk (2000 GB / 1863 GiB) seems too small! (< 3868 GB / 3602 GiB)

I tried to change the geometry: the number of heads from 255 to 16 and the number of sectors from 63 to 18. This does not seem to help:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 16 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 18 (HD)

P MS Data 3588096 3779428351 3775840256 [NieuwVolume]
NTFS, blocksize=4096, 1933 GB / 1800 GiB

is the partition of state 4. It contains one directory with one small file. I do not expect that this has overwritten critical data.

Questions:
What do I have to do with the warning that the disk seems too small?
Should I change the geometry, or can I ignore warnings concerning the geometry?
How to go forward? Should I run Deeper Aanalysis?

tak101 wrote: 07 Mar 2021, 16:24 Questions:
What do I have to do with the warning that the disk seems too small?

Ignore them.

Should I change the geometry, or can I ignore warnings concerning the geometry?

Ignore them.

How to go forward? Should I run Deeper Aanalysis?

Yes, please.

I try a deeper analysis on NieuwVolume, which should include the lost partition I am looking for. There are however two of them. I get a problem with the user interface of TestDisk: when I choose the upper one I get the possibility to list the files, copy them etc. When I choose the second one, I get the possibility for Deeper Analysis. So I guess, I have to choose the second one, which is slightly bigger.

My problem with the user interface is when I select the first NieuwVolume, I can use quit to go back to the QuickSearch results. However, when I select the second one, quit does bring me back to the first selection screen, not to the analysis results and I have to run QuickSearch again.

Am I making an error here? How can I get back to the results of QuickSearch?
I can answer this question now: after more careful looking I discovered the Return button, which brings me back to the QuickSearch results.

I am now running QuickSearch again, I will choose DeeperAnalysis for the second volume. I expect it to cost considerable time, as the volume is 1.8TB.

Log file as rar file I hope you can read the rar file. It is made with a recent version of 7-Zip.

The log file contains 2 Quick Searches and one Deeper Search (ignoring the warnings in Quick Search). The Deeper Search lasted about 48 hours.

There are a lot of error messages, which I do not know how these must be handled:

• This partition ends after the disk limits. (start=3907024895, size=125822976, end=4032847870, disk end=3907029168)
  file_pread(4,1,buffer,3907029168(243201/81/1)) ReadFile Onjuiste functie. (Dutch for: Wrong function)
  file_pread(4,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument
  NTFS partition cannot be added (part_offset<part_size).
  This partition ends after the disk limits. (start=3779428883, size=3775840788, end=7555269670, disk end=3907029168)
  heads/cylinder 2 (FAT) != 255 (HD)
  sect/track 18 (FAT) != 63 (HD)
  NTFS at 268/68/1
  heads/cylinder 16 (NTFS) != 255 (HD)
  sect/track 2 (NTFS) != 63 (HD)
  recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
  check_FAT: Unusual media descriptor (0xf8!=0xf0)
  check_FAT: Unusual number of reserved sectors 6 (FAT), should be 1.
  NTFS partition cannot be added (part_offset<part_size).

The end results show several partitions that cannot be recovered.

None of the other partitions contains the files where I am looking for.

I am looking for a NTFS partition of a few 1000 MB.

Main questions:
How should I continue?
Is there any chance that the overwritten partition can still be found?

I hope you can read the rar file. It is made with a recent version of 7-Zip.

The log file contains 2 Quick Searches and one Deeper Search (ignoring the warnings in Quick Search). The Deeper Search lasted about 48 hours.

There are a lot of error messages, which I do not know how these must be handled:

• This partition ends after the disk limits. (start=3907024895, size=125822976, end=4032847870, disk end=3907029168)
  file_pread(4,1,buffer,3907029168(243201/81/1)) ReadFile Onjuiste functie. (Dutch for: Wrong function)
  file_pread(4,1,buffer,3907029169(243201/81/2)) lseek err Invalid argument
  NTFS partition cannot be added (part_offset<part_size).
  This partition ends after the disk limits. (start=3779428883, size=3775840788, end=7555269670, disk end=3907029168)
  heads/cylinder 2 (FAT) != 255 (HD)
  sect/track 18 (FAT) != 63 (HD)
  NTFS at 268/68/1
  heads/cylinder 16 (NTFS) != 255 (HD)
  sect/track 2 (NTFS) != 63 (HD)
  recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
  check_FAT: Unusual media descriptor (0xf8!=0xf0)
  check_FAT: Unusual number of reserved sectors 6 (FAT), should be 1.
  NTFS partition cannot be added (part_offset<part_size).

The end results show several partitions that cannot be recovered.

None of the other partitions contains the files where I am looking for.

I am looking for a NTFS partition of a few 1000 MB.

Main questions:
How should I continue?
Is there any chance that the overwritten partition can still be found?

I can't open the rar-file - not even with Winrar. 7-ZIP does not support writing of rar-files.
Please replace it by a zip archive.

Sorry, I should have done that immediately. Zip files are easier to handle. Thank you for the efforts.