NTFS Partition reformated to HFS+

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
giovi
Posts: 3
Joined: 18 Sep 2021, 13:55

NTFS Partition reformated to HFS+

#1 Post by giovi »

I have a 1TB HDD with 3 partitions. The first partition was formatted to NTFS. Accidentally I hit format on the wrong partition so I ended up formatting this NTFS partition to HFS+ on a Mac. I bought a SSD and made a copy with 'dd' of the whole drive to an image file.

I tried photorec and a couple of other file recovery programs and was able to restore a lot of data but without folder structure and proper filenames. DiskDrill for example yielded not much better results in terms of structure than photorec. I am looking to recovery a bunch of old photos I had organised in folders by date, so the structure is rather important.

When I run testdisk on the whole drive image it does find 3 partitions. The first is discovered as HFS. I created an image in test disk of the first partition to work with it and not my copy of the original drive. However when I run test disk on the image it doesnt find a partition table "None" So it says i cannot write to the disk.

I would appreciate some direction on how to approach my problem. Is it even possible to restore the NTFS partition so I can access the drives data via the explorer or mounting it in linux? Like I said I really need the folder structure.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS Partition reformated to HFS+

#2 Post by recuperation »

giovi wrote: 18 Sep 2021, 14:22 I have a 1TB HDD with 3 partitions. The first partition was formatted to NTFS. Accidentally I hit format on the wrong partition so I ended up formatting this NTFS partition to HFS+ on a Mac. I bought a SSD and made a copy with 'dd' of the whole drive to an image file.

I tried photorec and a couple of other file recovery programs and was able to restore a lot of data but without folder structure and proper filenames. DiskDrill for example yielded not much better results in terms of structure than photorec. I am looking to recovery a bunch of old photos I had organised in folders by date, so the structure is rather important.

When I run testdisk on the whole drive image it does find 3 partitions. The first is discovered as HFS. I created an image in test disk of the first partition to work with it and not my copy of the original drive. However when I run test disk on the image it doesnt find a partition table "None" So it says i cannot write to the disk.
Both partition table schemes, the old MBR-style and the GPT one require at least free space in front the first partition. You extracted the first partition. Your extracted file starts directly with the boot sector and is lacking at least free space in front of the boot sector. Obviously there is no space to write the partition table because its at least located in front of the first partition.

I would appreciate some direction on how to approach my problem. Is it even possible to restore the NTFS partition so I can access the drives data via the explorer or mounting it in linux?
Recovery software typically recovers data at a target location which is different from the source location. Testdisk contains some functions which do repair the source without needing an extraction target.
Like I said I really need the folder structure.
I am not familiar with HFS+ on Mac. If that HFS+ formating failure has caused the MFT or parts of it to be overwritten you can loose directory information as well as information about file names and the location of the data on the disk.

As you obviously have no backup you are bound to try out any recovery software available. Once overwritten there is no way to get your file and folder names back.

Based on your description you successfully erased that information unfortunately.
If your level of despair is sufficient you could learn how NTFS works and the internals of your preferred file format (JPEG)? as well and try to recover your logically broken partition manually hoping to find remains of metadata information.

giovi
Posts: 3
Joined: 18 Sep 2021, 13:55

Re: NTFS Partition reformated to HFS+

#3 Post by giovi »

Thank you for your reply. I have to admit that I did not fully understand your answer. But I just found a program which seems to work like a charm. If I may, I could post the name of the product. It seems to successfully recover filenames and folders.

But for educational purposes: Is it possible to "overwrite" the HFS partition information for the first partition to be NTFS again? Obviously a lot of the directory information is still on the disk.

I have an image of the whole disk as well as an image of the first partition.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS Partition reformated to HFS+

#4 Post by recuperation »

giovi wrote: 18 Sep 2021, 19:07 Thank you for your reply. I have to admit that I did not fully understand your answer. But I just found a program which seems to work like a charm. If I may, I could post the name of the product. It seems to successfully recover filenames and folders.
You are free to describe your experience. This is not a vendor forum with hidden interests because the Testdisk package is free. But unfortunately nobody tells about his experiences with other recovery software.

But for educational purposes: Is it possible to "overwrite" the HFS partition information for the first partition to be NTFS again? Obviously a lot of the directory information is still on the disk.

I have an image of the whole disk as well as an image of the first partition.
Please consult an other forum on how to erase data.

giovi
Posts: 3
Joined: 18 Sep 2021, 13:55

Re: NTFS Partition reformated to HFS+

#5 Post by giovi »

GetDataBackPro was the program. Works like a charm.

I dont want to erase the data but to restore the NTFS partition. I dont need it anymore but I am nevertheless curious.

The partition is not lost which most of the tutorials are about but like I said reformated to HFS+

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS Partition reformated to HFS+

#6 Post by recuperation »

giovi wrote: 18 Sep 2021, 19:07 But for educational purposes: Is it possible to "overwrite" the HFS partition information for the first partition to be NTFS again?
Sorry, I did not understand the sentence above.
giovi wrote: 18 Sep 2021, 19:23 I dont want to erase the data but to restore the NTFS partition.
Restoring - as far as I understand it - is putting back existing information at a location.

What you mean is that you want to repair the partly overwritten partition to make it usable again.
Here is a recipe for you:

1. Learn HFS+ to determine where the NTFS partition had been overwritten.
2. Learn NTFS
3. Reverse engineer chkdsk
4. Get yourself a hex editor or a software that is able to decipher NTFS structures
5. Learn a programming language in order to mass-manipulate your partition

Your job is done when the partitions reappears under Windows and chkdsk does not find anything.
The fact that you had to ask the question rather suggests that you won't succeed because it's a difficult and lengthy task and those who succeed would simply tackle this job autonomously without even raising the question before.

Good luck!

Locked