Recovering partition.

[SyncroScales]

Hi,

testdisk-7.1WIP

I have a hard-disk that was formatted or lost it's partition. I looked for the partition and found what seems to be the NTFS partition and the smaller partition in-front of it, maybe for boot. The choice I have after selecting the NTFS partition is

Code: Select all

Write partition table, confirm? <Y/N>.

Will this write onto the hard-disk? Or is the next option where I can put it? I wanted to put it onto an external hdd. Maybe use photorec_win and qphotorec_win?

I don't want to write over the hard-disk I need to data recover. Just in case I need to perform further analysis/scans/etc.

Hard-disk being scanned is 500GB, the external hard-disk is 1TB (empty).

Not sure which version of Windows the damaged hard-disk was formatted from and used for. Was apparently not re-formatted.

Hard-disk is recognized in Disk Management and Device Manager. No I/O errors or lags, crashing, etc. Hard-disk seems to be fine, with no partition visible.

[recuperation]

Hi,

testdisk-7.1WIP

I have a hard-disk that was formatted or lost it's partition. I looked for the partition and found what seems to be the NTFS partition and the smaller partition in-front of it, maybe for boot. The choice I have after selecting the NTFS partition is

Code: Select all

Write partition table, confirm? <Y/N>.

Will this write onto the hard-disk?

Yes, this is a repair function.

Or is the next option where I can put it? I wanted to put it onto an external hdd.

A partition table is specific for a specific drive. There is no use in writing the partition table elsewhere.

Maybe use photorec_win and qphotorec_win?

As you loose file metadata information you should do this if writing the partition table fails.

I don't want to write over the hard-disk I need to data recover. Just in case I need to perform further analysis/scans/etc.

Duplicate your hard drive using ddrescue as described in the manual. When having a copy of your broken drive you don't have to worry about write operations.

[SyncroScales]

Thanks for the reply.

So I repaired the drive. There was only one * bootable and P - Primary partition. I wrote the partition table. I restarted the computer. In Computer I see two drive letters that have 100MB (NTFS) and 565MB (NTFS). But the data section in the middle is not there. The file system and disk seem to be Windows 7 or 8.x.

In Windows - Disk Management shows the disk with 3 partitions. 1. System Reserved (Drive letter), 100MB (NTFS), Healthy (Active, Primary Partition), 2. 465.11 GB, Unallocated and 3. (Drive letter), 565 MB (NTFS), Healthy (Primary Partition).

In testdisk - there are only 2 partitions. I think the partition on the end is the back-up for the first partition.

I was in this tutorial https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step - I checked NTFS Boot sector recovery, and for both partitions, they are OK.

Boot Sector
Status: OK
Back Up Boot Sector
Status: OK
Sectors Are Identical

In:
[Advanced]
I tried to [Repair MFT], MFT and MFT mirror match perfectly.
File Undelete - No deleted Files Found.

[Rebuild BS] - I don't think I need to do this?

I am using QPhotoRec right now. I really don't want to re-format and then attempt commercial software to find the folder structure and files. Do I have to do that?

[recuperation]

I am using QPhotoRec right now. I really don't want to re-format and then attempt commercial software to find the folder structure and files. Do I have to do that?

Formating means deleting information. You only do this if you give up your data and want to use your partition/drive again. You rather sound that you want to rescue your data, though. => NO FORMATING!
When being unhappy with the result of QPhotoRec try out commercial recovery software.