cgsecurity.org

I'm on a Linux machine.
I have written a 8GB iso file to a 4TB HDD by using the linux dd command
dd copies bit wise from source to destination.
I used: "sudo dd bs=4M if=./div.iso of=/dev/sdb conv=fdatasync status=progress" which means that the block size on the target write was 4MB.
The 4TB hdd was made with a guid partition table under windows 7, so a NTFS file system.
When I used the 4TB hdd I saw only one partition (NTFS), but since guid makes an EFI as well it has two one Efi and one NTFS.

When trying to restore the drive the result I get from testDisk is 140+ partitions after quick scan. This is the first time using the testDisk tool but I do not understand the output other than my disk is totally broken. I have Mac HFS partitions according to it and this hdd has never been near a mac. How should I proceed, is it possible to proceed?

I attach the print out from TestDisk:

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Partition Start End Size in sectors
>D MS Data 264192 7814035455 7813771264
D Mac HFS 81996300 86785549 4789250 [ ]
D MS Data 107446120 107462503 16384 [NO NAME]
D Mac HFS 107462504 107588903 126400
D MS Data 120242256 120258639 16384 [NO NAME]
D Mac HFS 120258640 120385039 126400
D EFI System 277429192 277432071 2880 [EFI System Partition] [EFISECTOR]
D MS Data 277459711 277465884 6174
D MS Data 277465884 277472057 6174 [Boot]
D EFI System 277499744 277502623 2880 [EFI System Partition] [EFISECTOR]
D EFI System 277502624 277505503 2880 [EFI System Partition] [EFISECTOR]
D MS Data 286319219 286325392 6174
D MS Data 286325392 286331565 6174 [Boot]
D EFI System 286359608 286362487 2880 [EFI System Partition] [EFISECTOR]
D EFI System 286362488 286365367 2880 [EFI System Partition] [EFISECTOR]
D EFI System 295277004 295279883 2880 [EFI System Partition] [EFISECTOR]
D MS Data 295307523 295313696 6174
D MS Data 295313696 295319869 6174 [Boot]
D EFI System 295347556 295350435 2880 [EFI System Partition] [EFISECTOR]
D EFI System 295350436 295353315 2880 [EFI System Partition] [EFISECTOR]
D EFI System 306270584 306273463 2880 [EFI System Partition] [EFISECTOR]
D MS Data 306274403 306280576 6174
D MS Data 306280576 306286749 6174 [Boot]
D EFI System 312726040 312728919 2880 [EFI System Partition] [EFISECTOR]
D EFI System 312728920 312731799 2880 [EFI System Partition] [EFISECTOR]
D MS Data 312780551 312786724 6174
D MS Data 312786724 312792897 6174 [Boot]
D EFI System 319229400 319232279 2880 [EFI System Partition] [EFISECTOR]
D EFI System 319232280 319235159 2880 [EFI System Partition] [EFISECTOR]
D EFI System 319260088 319262967 2880 [EFI System Partition] [EFISECTOR]
D MS Data 319263907 319270080 6174
D MS Data 319270080 319276253 6174 [Boot]
D EFI System 325715544 325718423 2880 [EFI System Partition] [EFISECTOR]
D EFI System 325718424 325721303 2880 [EFI System Partition] [EFISECTOR]
D MS Data 352344939 352351112 6174
D MS Data 352351112 352357285 6174 [Boot]
D MS Data 352650143 352656316 6174
D MS Data 352656316 352662489 6174 [Boot]
D EFI System 390499876 390563363 63488 [EFI System Partition] [ARCHISO_EFI]
D MS Data 401038648 401055031 16384 [NO NAME]
D Mac HFS 401055032 401181431 126400
D MS Data 420931808 420943327 11520
D Mac HFS 430477257 430641098 163842
D Mac HFS 892629838 1060541519 167911682
D Linux filesys. data 1837410747 1837821386 410640 [~CPB4_M-n ~]~^M->~GM-_
D MS Data 2286807903 2286814076 6174
D MS Data 2286814076 2286820249 6174 [Boot]
D EFI System 2294530040 2294630392 100353 [EFI System Partition]
D EFI System 2294632440 2294835158 202719 [EFI System Partition]
D MS Data 2559553022 2559555901 2880 [NO NAME]
D MS Data 2559576235 2559579114 2880 [NO NAME]
D Linux filesys. data 2559581352 2560557919 976568 [TEST]
D MS Data 2564085444 2564091203 5760
D MS Data 2564091436 2564097195 5760
D MS Data 2599848963 2599855136 6174
D EFI System 2599851728 2599854607 2880 [EFI System Partition] [EFISECTOR]
D MS Data 2599855136 2599861309 6174 [Boot]
D MS Data 2599855675 2599861848 6174
D MS Data 2599861848 2599868021 6174 [Boot]
D MS Data 2612399835 2612406008 6174
D MS Data 2612406008 2612412181 6174 [Boot]
D Mac HFS 2614270892 2622659501 8388610 [~?~?~?M-:D^A]
D Mac HFS 2624056724 2632445333 8388610 [~?~?~?M-:D^A]
D MS Data 2633710035 2633730773 20739 [NO NAME]
D MS Data 2635857747 2635863920 6174
D MS Data 2635863920 2635870093 6174 [Boot]
D MS Data 2640872092 2640874971 2880
D EFI System 2641010100 2641018291 8192 [EFI System Partition] [BOOT]
D MS Data 2649210035 2649212914 2880 [NO NAME]
D MS Data 2655263947 2655270120 6174
D EFI System 2655266712 2655269591 2880 [EFI System Partition] [EFISECTOR]
D MS Data 2655270120 2655276293 6174 [Boot]
D MS Data 2655270667 2655276840 6174
D MS Data 2655276840 2655283013 6174 [Boot]
D MS Data 2667197787 2667203960 6174
D MS Data 2667203960 2667210133 6174 [Boot]
D Mac HFS 2669223108 2677611717 8388610 [~?~?~?M-:D^A]
D MS Data 2678543651 2678549824 6174
D MS Data 2678549824 2678555997 6174 [Boot]
D EFI System 2680511960 2680514839 2880 [EFI System Partition] [EFISECTOR]
D MS Data 2684620731 2684641469 20739 [NO NAME]
D MS Data 2686177595 2686183768 6174
D MS Data 2686183768 2686189941 6174 [Boot]
D MS Data 2818954732 2818957611 2880 [NO NAME]
D MS Data 3307774334 3307777213 2880 [NO NAME]
D MS Data 3307797411 3307800290 2880 [NO NAME]
D Linux filesys. data 3307802496 3308779063 976568 [TEST]
D EFI System 3308789084 3308852571 63488 [EFI System Partition] [ARCHISO_EFI]
D MS Data 3310111924 3310114803 2880 [NO NAME]
D EFI System 3314495296 3314499967 4672 [EFI System Partition] [NO NAME]
D MS Data 3314507784 3314524167 16384 [NO NAME]
D Mac HFS 3314524168 3314650567 126400
D EFI System 3321582796 3321587339 4544 [EFI System Partition] [NO NAME]
D EFI System 3321672140 3321735627 63488 [EFI System Partition] [MISO_EFI]
D EFI System 3325309388 3325372875 63488 [EFI System Partition] [MISO_EFI]
D EFI System 3328149820 3328154363 4544 [EFI System Partition] [NO NAME]
D MS Data 3332028335 3332034508 6174
D MS Data 3332034508 3332040681 6174 [Boot]
D EFI System 3334424328 3334428871 4544 [EFI System Partition] [NO NAME]
D EFI System 3336381592 3336386135 4544 [EFI System Partition] [NO NAME]
D Mac HFS 3572856765 3614836426 41979662
D EFI System 3631077788 3631085347 7560 [EFI System Partition] [NO NAME]
D EFI System 3631089432 3631096991 7560 [EFI System Partition] [NO NAME]
D MS Data 3642079401 3893733544 251654144
D EFI System 3643159220 3643163955 4736 [EFI System Partition] [NO NAME]
D MS Data 3889457235 3889477973 20739 [NO NAME]
D MS Data 3893733544 4145387687 251654144
D MS Data 4211097689 4462751832 251654144
D Linux filesys. data 4310389185 4310409968 20784
D Linux filesys. data 4310410110 4327165901 16755792
D MS Data 4361914499 4361917378 2880 [NO NAME]
D MS Data 4363735488 4363738367 2880 [NO NAME]
D EFI System 4365758824 4365761703 2880 [EFI System Partition] [EFISECTOR]
D MS Data 4365762547 4365768720 6174
D MS Data 4365768720 4365774893 6174 [Boot]
D EFI System 4365807596 4365810475 2880 [EFI System Partition] [EFISECTOR]
D EFI System 4365810476 4365813355 2880 [EFI System Partition] [EFISECTOR]
D MS Data 4367707374 4367710253 2880 [NO NAME]
D MS Data 4371464574 4371467453 2880 [NO NAME]
D MS Data 4372644734 4372647613 2880 [NO NAME]
D MS Data 4386294088 4386295975 1888 [TEST]
D MS Data 4387814747 4387817626 2880 [NO NAME]
D MS Data 4387832715 4387835594 2880 [NO NAME]
D MS Data 4389391269 4389394148 2880 [NO NAME]
D MS Data 4389402898 4389405777 2880 [NO NAME]
D MS Data 4390676967 4405906523 15229557 [NO NAME]
D EFI System 4412498508 4412504011 5504 [EFI System Partition] [NO NAME]
D EFI System 4416202884 4416203523 640 [EFI System Partition] [NO NAME]
D MS Data 4441629800 4456878631 15248832 [NO NAME]
D MS Data 4462751832 4714405975 251654144
D EFI System 4917015564 4917023499 7936 [EFI System Partition] [NO NAME]
D EFI System 5080624776 5080627655 2880 [EFI System Partition] [EFISECTOR]
D MS Data 5080628499 5080634672 6174
D MS Data 5080634672 5080640845 6174 [Boot]
D EFI System 5080673548 5080676427 2880 [EFI System Partition] [EFISECTOR]
D EFI System 5080676428 5080679307 2880 [EFI System Partition] [EFISECTOR]
D EFI System 5082472912 5082477647 4736 [EFI System Partition] [NO NAME]
D EFI System 5100569996 5100701067 131072 [EFI System Partition] [ARCHISO_EFI]
D EFI System 5160356656 5160361583 4928 [EFI System Partition] [NO NAME]
D EFI System 5167759224 5167763895 4672 [EFI System Partition] [NO NAME]
D EFI System 5167828552 5167833479 4928 [EFI System Partition] [NO NAME]
D EFI System 5171935988 5171941491 5504 [EFI System Partition] [NO NAME]
D EFI System 5174624572 5174625211 640 [EFI System Partition] [NO NAME]
D EFI System 5174840728 5174845463 4736 [EFI System Partition] [NO NAME]
D EFI System 5177952696 5177958583 5888 [EFI System Partition] [NO NAME]
D EFI System 5182560344 5182566007 5664 [EFI System Partition] [NO NAME]
D MS Data 5182583787 5182586666 2880 [NO NAME]
D EFI System 5183887860 5183893523 5664 [EFI System Partition] [NO NAME]
D MS Data 5184016507 5184019386 2880 [NO NAME]
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS found using backup sector, blocksize=4096, 4000 GB / 3725 GiB

viewtopic.php?p=33087#p33087 Point 1

Is it ok now?

As you kept the previous partition structure a secret you will now have to look into each of those 140+ partitions using the p-key ("list files") to see if a partition contains content that you expect.

What do you mean by "As you kept the previous partition structure a secret" ?
Is there more information you or TestDisk need to better recuperate the hdd?

If you know your former partitioning layout you easily spot partitions in this list that are not worth looking at.

If you had just one partition any proposal with 2880 sectors length does not seem convincing given you have a total sector count of roughly
cylinder * heads * sectors.

[...
I used: "sudo dd bs=4M if=./div.iso of=/dev/sdb conv=fdatasync status=progress" which means that the block size on the target write was 4MB.
The 4TB hdd was made with a guid partition table under windows 7, so a NTFS file system.
When I used the 4TB hdd I saw only one partition (NTFS), but since guid makes an EFI as well it has two one Efi and one NTFS.
...]

Did I misread what you wrote?
I lost the time relation in your statement above.
If that should mean that you just created one big partition on your drive before overwriting it you should not necessarily look into each little partition proposal from Testdisk but look at those partitions with the huge sector number count, p.e. like the very first one - using the p-key to check the content inside for valid files and folders that you recognize.

Ok. So I will try to shead som light...
I formatted the HDD some 5 years ago running windows 7.
I think windows 7 puts a EFI partition of about 100MB in the beginning of the HDD.
The drive was formatted as one whole partition of approximately 3,7TB or 4TB depending on definition of TB.
now a couple of days ago I accidentally wrote a image of 8GB to the disk.
According to some linux users more experienced than me the dd command would have put the 8GB in the beginning of the disk, destroying the EFI partition.

New question:
Is there a way to not move the files to a new hdd but to rebuild the old one with the files in it?
Why I ask is because I do not have the storage to move all the files I had to somewhere else.

hajonnes wrote: 09 Mar 2021, 22:43 Ok. So I will try to shead som light...
I formatted the HDD some 5 years ago running windows 7.
I think windows 7 puts a EFI partition of about 100MB in the beginning of the HDD.
The drive was formatted as one whole partition of approximately 3,7TB or 4TB depending on definition of TB.
now a couple of days ago I accidentally wrote a image of 8GB to the disk.
According to some linux users more experienced than me the dd command would have put the 8GB in the beginning of the disk, destroying the EFI partition.

If you wrote a complete image with a length of 8GB, the image not only destroyed your EFI partition but the beginning of your big 3,7TB partition as well.

New question:
Is there a way to not move the files to a new hdd but to rebuild the old one with the files in it?
Why I ask is because I do not have the storage to move all the files I had to somewhere else.

There is no practical way. There is no recovery software I am aware of that repairs a broken drive except for the light repairs that Testdisk does.

I did not find any files in any of the big partitions.
TestDisk reports of the file systems to be broken.
I was thinking about changing the geometry of the disk in testDisk's settings in accordance with the label on the hdd.
The label says:
LBA: 7814037168 sectors
CHS: 16383/16/63.
nothing about sector size.

So if I use the CHS from the label and 512 bytes sector size I get a hdd of 7,87GB,
but if I use LBA and 512 bytes sectors I get the correct 4TB hdd.
So how should I define the geometry with CHS, should I increase the sector size even if LBA is using a sector size of 512 bytes?

The previous questions are of interest but perhaps a better question; how should I proceed if I want to recuperate some files from the hdd?

The easiest way to determine the sector size is to look into the spec sheet that you can find on the manufacturer web page.
But as some people do not buy naked drives but external ones it seems that there are sometimes converters within the USB3.0 interface that turn the "512e" into 4096 bytes so that even older operating systems would be able to address more than 2TB.

In case of a "naked" drive that is directly connected within a computer simply divide the storage size by the number of sectors as outlined above in "LBA: ...".
The CHS adressing scheme is outdated and applies only to legacy operating systems that rely on it to boot. It affects the quick search in Testdisk but deeper search does not seem to be affected.

To proceed you can either use Photorec or any commercial recovery software.