accidentally installed linux over existing win10 install Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Floydius
Posts: 3
Joined: 12 Aug 2022, 01:30

accidentally installed linux over existing win10 install

#1 Post by Floydius »

I accidentally installed linux over the top of an existing hard drive. (500GB M.2 slot SSD. WD Black SN750)

I'll start with my two questions; the rest below is details to show what I'm working with.

1) Is the partition information I have from before the incident (see below) enough for me to rebuild the partition table, and potentially recover more?
2) Any recommendations of things I haven't considered or are not obvious to me?


Thanks in advance for any help. I can't believe this tool exists.

I started with an NTFS-partitioned Windows 10 install.
I happened to retain a screenshot of how it was initially partitioned in Windows Disk Management utility prior to this whole mishap.

It had 3 partitions -- the exact text from Disk Management is below:

Code: Select all

Disk 2 Basic 465.75 GB Online
 -100 MB Healthy (EFI System Partition)
 - (C:) 465.15 GB NTFS Healthy (Boot, Page File, Crash Dump, Basic Data Partition)
 -505 MB Healthy (Recovery Partition)
After realizing what I had done, I went ahead and installed a fresh copy of windows on a second hard drive (almost identical to the first, a M.2 WD Black SN770).
During that process, I was having issues getting the new drive to boot, and I'm not sure if inadvertently made any other changes to the over-written disk during that process of trying to access the boot sector.

Once I got the new windows install up, I ran photoRec against the old drive and was able to recover some files, but not the ones I hoped for.

I then moved to Testdisk.

Quick search locates a large MS Data partition, but says it can't be recovered:

Code: Select all

Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63

The hard disk (500 GB / 465 GiB) seems too small! (< 999 GB / 930 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
      Partition               Start                 End              Size in sectors
>  MS Data              976773119   1952268403           975495285

[Continue]
     NTFS, blocksize=4096, 499 GB / 465 GiB
Selecting [Continue] Sends me to a screen which seems to show overlapping partitions:
An EFI partition, 4 Linux partitions, and a MS partition.
from the Start and End sectors, it looks like the MS partition overlaps several of the Linux partitions:

Code: Select all

Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63 
    Partition               Start        End    Size in sectors
P EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
D Linux filesys. data       999424   21000191   20000768
>D MS Data                  1277835  976773119  975495285
D Linux filesys. data     21000192   41000959   20000768
D Linux Swap              41000960   61001711   20000752
D Linux filesys. data     61001728  976771071  915769344

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
             P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB     
That overlap makes total sense to me, considering what I did.

I have tried running a deeper search on it several times (I create a new log file for each run).
Each time, it runs for a long time and then silently crashes (totally kills the command window) while I am not watching.
The log files stop at different places each time but are all very close in size.
I can post them if needed, but each deeper search log is over 10K lines.

recuperation
Posts: 2719
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: accidentally installed linux over existing win10 install

#2 Post by recuperation »

Floydius wrote: 12 Aug 2022, 04:52 I accidentally installed linux over the top of an existing hard drive. (500GB M.2 slot SSD. WD Black SN750)

I'll start with my two questions; the rest below is details to show what I'm working with.

1) Is the partition information I have from before the incident (see below) enough for me to rebuild the partition table, and potentially recover more?
No.


2) Any recommendations of things I haven't considered or are not obvious to me?

Thanks in advance for any help. I can't believe this tool exists.

I started with an NTFS-partitioned Windows 10 install.
I happened to retain a screenshot of how it was initially partitioned in Windows Disk Management utility prior to this whole mishap.

It had 3 partitions -- the exact text from Disk Management is below:

Code: Select all

Disk 2 Basic 465.75 GB Online
 -100 MB Healthy (EFI System Partition)
 - (C:) 465.15 GB NTFS Healthy (Boot, Page File, Crash Dump, Basic Data Partition)
 -505 MB Healthy (Recovery Partition)
After realizing what I had done, I went ahead and installed a fresh copy of windows on a second hard drive (almost identical to the first, a M.2 WD Black SN770).
During that process, I was having issues getting the new drive to boot, and I'm not sure if inadvertently made any other changes to the over-written disk during that process of trying to access the boot sector.

Once I got the new windows install up, I ran photoRec against the old drive and was able to recover some files, but not the ones I hoped for.

I then moved to Testdisk.

Quick search locates a large MS Data partition, but says it can't be recovered:

Code: Select all

Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63

The hard disk (500 GB / 465 GiB) seems too small! (< 999 GB / 930 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
      Partition               Start                 End              Size in sectors
>  MS Data              976773119   1952268403           975495285

[Continue]
     NTFS, blocksize=4096, 499 GB / 465 GiB
Selecting [Continue] Sends me to a screen which seems to show overlapping partitions:
An EFI partition, 4 Linux partitions, and a MS partition.
from the Start and End sectors, it looks like the MS partition overlaps several of the Linux partitions:

Code: Select all

Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63 
    Partition               Start        End    Size in sectors
P EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
D Linux filesys. data       999424   21000191   20000768
>D MS Data                  1277835  976773119  975495285
D Linux filesys. data     21000192   41000959   20000768
D Linux Swap              41000960   61001711   20000752
D Linux filesys. data     61001728  976771071  915769344

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
             P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB     
That overlap makes total sense to me, considering what I did.

I have tried running a deeper search on it several times (I create a new log file for each run).
Each time, it runs for a long time and then silently crashes (totally kills the command window) while I am not watching.
The log files stop at different places each time but are all very close in size.
I can post them if needed, but each deeper search log is over 10K lines.
Have you tried to access the MS Data partition using the p-key ("list files")?
Please provide your Testdisk log file. If it is too long to be attached to a posting you can cut the end and post the beginning.

Floydius
Posts: 3
Joined: 12 Aug 2022, 01:30

Re: accidentally installed linux over existing win10 install

#3 Post by Floydius »

No.
Thanks for saving me from that wild goose chase.
Have you tried to access the MS Data partition using the p-key ("list files")?
Yes.
Short answer is, the EFI and tiny MS data partitions listed files (all system files)
the larger ones returned "No file found, filesystem may be damaged."

Also, I managed to get deeper search to complete.

First, it listed a bunch of partitions under "The following partitions can't be recovered"
(55 linux partitions, 2 MS Data partitions).

Then after [Continue], it listed way more partitions.

(2 EFI System, 5 MS Data, 1000+ linux filesys)

I ran list files on all the EFI and MS data partitions with the same results as before, except on the larger MS Data partitions the message changed to:
"Can't open filesystem. Filesystem seems damaged."
Please provide your Testdisk log file. If it is too long to be attached to a posting you can cut the end and post the beginning.
I have posted what I can here. the original after deeper search was >15K lines. Removed a bunch of the linux filesys lines, but can upload the original somewhere if needed.
Thanks again!

Code: Select all

Fri Aug 12 09:42:33 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=499986202624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=499985154048
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDS500G3X0C-00SJG0, S/N:E823_8FA6_BF53_0001_001B_448B_460A_5946., FW:102000WD
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WD_BLACK SN770 500GB, S/N:E823_8FA6_BF53_0001_001B_448B_4B7D_3747., FW:731030WD

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - WDS500G3X0C-00SJG0
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                   239616  976773119  976533504

search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
FAT32 at 0/32/33
FAT1 : 32-1004
FAT2 : 1005-1977
start_rootdir : 1978 root cluster : 2
Data : 1978-997369
sectors : 997376
cluster_size : 8
no_of_cluster : 124424 (2 - 124425)
fat_length 973 calculated 973
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=4026
     EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB

recover_EXT2: s_block_group_nr=0/76, s_mnt_count=11/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2500096
recover_EXT2: part_size 20000768
Filesystem created: Sun Aug  7 16:42:36 2022
Last mount time:    Sun Aug  7 19:14:35 2022
     Linux filesys. data       999424   21000191   20000768
     ext4 blocksize=4096 Large_file Sparse_SB, 10240 MB / 9766 MiB

recover_EXT2: s_block_group_nr=0/76, s_mnt_count=12/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2500096
recover_EXT2: part_size 20000768
Filesystem created: Sun Aug  7 16:42:37 2022
Last mount time:    Sun Aug  7 19:14:35 2022
     Linux filesys. data     21000192   41000959   20000768
     ext4 blocksize=4096 Large_file Sparse_SB, 10240 MB / 9766 MiB
     Linux Swap              41000960   61001711   20000752
     SWAP2 version 1, pagesize=4096, 10240 MB / 9765 MiB

recover_EXT2: s_block_group_nr=0/3493, s_mnt_count=11/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 114471168
recover_EXT2: part_size 915769344
Filesystem created: Sun Aug  7 16:42:37 2022
Last mount time:    Sun Aug  7 19:14:35 2022
     Linux filesys. data     61001728  976771071  915769344
     ext4 blocksize=4096 Large_file Sparse_SB, 468 GB / 436 GiB
file_win32_pread(528,11,buffer,976773162(60801/80/58)) read err: read after end of file
file_win32_pread(528,8,buffer,976773165(60801/80/61)) read err: read after end of file
NTFS at 60801/80/15
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1277835  976773119  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
NTFS at 60801/80/15
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                976773119 1952268403  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
This partition ends after the disk limits. (start=976773119, size=975495285, end=1952268403, disk end=976773168)
file_win32_pread(528,14,buffer,976773156(60801/80/52)) read err: read after end of file
file_win32_pread(528,14,buffer,976773157(60801/80/53)) read err: read after end of file
file_win32_pread(528,14,buffer,976773158(60801/80/54)) read err: read after end of file
file_win32_pread(528,14,buffer,976773159(60801/80/55)) read err: read after end of file
file_win32_pread(528,14,buffer,976773160(60801/80/56)) read err: read after end of file
file_win32_pread(528,14,buffer,976773162(60801/80/58)) read err: read after end of file
file_win32_pread(528,14,buffer,976773164(60801/80/60)) read err: read after end of file
file_win32_pread(528,14,buffer,976773166(60801/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (500 GB / 465 GiB) seems too small! (< 999 GB / 930 GiB)
The following partition can't be recovered:
     MS Data                976773119 1952268403  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB

Results
   P EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
     Linux filesys. data       999424   21000191   20000768
     ext4 blocksize=4096 Large_file Sparse_SB, 10240 MB / 9766 MiB
     MS Data                  1277835  976773119  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
     Linux filesys. data     21000192   41000959   20000768
     ext4 blocksize=4096 Large_file Sparse_SB, 10240 MB / 9766 MiB
     Linux Swap              41000960   61001711   20000752
     SWAP2 version 1, pagesize=4096, 10240 MB / 9765 MiB
     Linux filesys. data     61001728  976771071  915769344
     ext4 blocksize=4096 Large_file Sparse_SB, 468 GB / 436 GiB

interface_write()
 1 P EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]

search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
FAT32 at 0/32/33
FAT1 : 32-1004
FAT2 : 1005-1977
start_rootdir : 1978 root cluster : 2
Data : 1978-997369
sectors : 997376
cluster_size : 8
no_of_cluster : 124424 (2 - 124425)
fat_length 973 calculated 973
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=4026
     EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
FAT32 at 0/32/39
FAT1 : 32-1004
FAT2 : 1005-1977
start_rootdir : 1978 root cluster : 2
Data : 1978-997369
sectors : 997376
cluster_size : 8
no_of_cluster : 124424 (2 - 124425)
fat_length 973 calculated 973
FAT differs, FAT sectors=960-973/973
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/32/39
FAT: cluster=2(0x2), pos=4026
     EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
FAT32 at 0/32/39
FAT1 : 32-1004
FAT2 : 1005-1977
start_rootdir : 1978 root cluster : 2
Data : 1978-997369
sectors : 997376
cluster_size : 8
no_of_cluster : 124424 (2 - 124425)
fat_length 973 calculated 973
FAT differs, FAT sectors=960-973/973
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/32/39
FAT: cluster=2(0x2), pos=4032
FAT: cluster=771(0x303), pos=10184
FAT: cluster=1540(0x604), pos=16336
FAT: cluster=2309(0x905), pos=22488
FAT: cluster=3078(0xc06), pos=28640
FAT: cluster=3847(0xf07), pos=34792
FAT: cluster=4616(0x1208), pos=40944
FAT: cluster=5385(0x1509), pos=47096
FAT: cluster=6154(0x180a), pos=53248
     MS Data                     2054     999429     997376 [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
NTFS at 14/233/28
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=122683392, part_size=499453585920, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 14/233/28
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   239616  975734900  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
FAT12 at 24/197/14
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-2
FAT2 : 3-4
start_rootdir : 5
Data : 37-1404
sectors : 1408
cluster_size : 4
no_of_cluster : 342 (2 - 343)
fat_length 2 calculated 2
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 24/197/14
     MS Data                   397984     399391       1408
     FAT12, blocksize=2048, 720 KB / 704 KiB

recover_EXT2: s_block_group_nr=0/76, s_mnt_count=11/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2500096
recover_EXT2: part_size 20000768
Filesystem created: Sun Aug  7 16:42:36 2022
Last mount time:    Sun Aug  7 19:14:35 2022
     Linux filesys. data       999424   21000191   20000768
     ext4 blocksize=4096 Large_file Sparse_SB, 10240 MB / 9766 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/76, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2500096
recover_EXT2: part_size 20000768
Filesystem created: Sun Aug  7 16:42:36 2022
     Linux filesys. data       999422   21000189   20000768
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 10240 MB / 9766 MiB


//**REMOVED ABOUT 10k LINES OF THESE RECOVER_EXT2 SECTIONS**//

block_group_nr 3125

recover_EXT2: "e2fsck -b 102400000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3125/3493, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 114471168
recover_EXT2: part_size 915769344
Filesystem created: Sun Aug  7 16:42:37 2022
     Linux filesys. data     61001728  976771071  915769344
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 468 GB / 436 GiB
NTFS at 60736/175/36
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   239616  975734900  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
NTFS at 60736/175/36
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                975734900 1951230184  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
This partition ends after the disk limits. (start=975734900, size=975495285, end=1951230184, disk end=976773168)
file_win32_pread(528,11,buffer,976773158(60801/80/54)) read err: read after end of file
file_win32_pread(528,11,buffer,976773160(60801/80/56)) read err: read after end of file
file_win32_pread(528,11,buffer,976773166(60801/80/62)) read err: read after end of file
file_win32_pread(528,8,buffer,976773161(60801/80/57)) read err: read after end of file
file_win32_pread(528,3,buffer,976773167(60801/80/63)) read err: read after end of file
file_win32_pread(528,8,buffer,976773165(60801/80/61)) read err: read after end of file
NTFS at 60801/80/15
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1277835  976773119  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
NTFS at 60801/80/15
filesystem size           975495285
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                976773119 1952268403  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
This partition ends after the disk limits. (start=976773119, size=975495285, end=1952268403, disk end=976773168)
file_win32_pread(528,14,buffer,976773156(60801/80/52)) read err: read after end of file
file_win32_pread(528,14,buffer,976773157(60801/80/53)) read err: read after end of file
file_win32_pread(528,14,buffer,976773158(60801/80/54)) read err: read after end of file
file_win32_pread(528,14,buffer,976773159(60801/80/55)) read err: read after end of file
file_win32_pread(528,14,buffer,976773160(60801/80/56)) read err: read after end of file
file_win32_pread(528,14,buffer,976773162(60801/80/58)) read err: read after end of file
file_win32_pread(528,14,buffer,976773164(60801/80/60)) read err: read after end of file
file_win32_pread(528,14,buffer,976773166(60801/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (500 GB / 465 GiB) seems too small! (< 999 GB / 930 GiB)
The following partitions can't be recovered:
     Linux filesys. data    518443024 1434212367  915769344
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 468 GB / 436 GiB
//**Removed a bunch of these Linux filesys lines**//
     Linux filesys. data    518495808 1434265151  915769344
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 468 GB / 436 GiB
     MS Data                975734900 1951230184  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
     MS Data                976773119 1952268403  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB

Results
     EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
     MS Data                     2054     999429     997376 [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
     MS Data                   239616  975734900  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
     MS Data                   397984     399391       1408
     FAT12, blocksize=2048, 720 KB / 704 KiB
     Linux filesys. data       999422   21000189   20000768
     ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 10240 MB / 9766 MiB
     Linux filesys. data       999424   21000191   20000768
     ext4 blocksize=4096 Large_file Sparse_SB, 10240 MB / 9766 MiB
     MS Data                  1277835  976773119  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
     Linux filesys. data      9650200   29650967   20000768
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 10240 MB / 9766 MiB
//**Removed a bunch of these Linux filesys lines**//
      Linux filesys. data     61001728  976771071  915769344
     ext4 blocksize=4096 Large_file Sparse_SB, 468 GB / 436 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.


dir_partition inode=0
     EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
FAT: cluster=2(0x2), pos=4026
Directory /
       3 drwxr-xr-x     0      0         0  7-Aug-2022 21:47 EFI

dir_partition inode=3
     EFI System                  2048     999423     997376 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
FAT: cluster=3(0x3), pos=4034
Directory /EFI
       3 drwxr-xr-x     0      0         0  7-Aug-2022 21:47 .
       0 drwxr-xr-x     0      0         0  7-Aug-2022 21:47 ..
       4 drwxr-xr-x     0      0         0  7-Aug-2022 21:47 steamos
      35 drwxr-xr-x     0      0         0  7-Aug-2022 21:47 BOOT
      66 drwxr-xr-x     0      0         0  8-Aug-2022 00:05 Microsoft
FAT: cluster=2(0x2), pos=4026
Directory /
       3 drwxr-xr-x     0      0         0  7-Aug-2022 21:47 EFI


dir_partition inode=0
     MS Data                     2054     999429     997376 [NO NAME]
     FAT32, blocksize=4096, 510 MB / 487 MiB
FAT: cluster=2(0x2), pos=4032
FAT: cluster=771(0x303), pos=10184
FAT: cluster=1540(0x604), pos=16336
FAT: cluster=2309(0x905), pos=22488
FAT: cluster=3078(0xc06), pos=28640
FAT: cluster=3847(0xf07), pos=34792
FAT: cluster=4616(0x1208), pos=40944
FAT: cluster=5385(0x1509), pos=47096
FAT: cluster=6154(0x180a), pos=53248
Directory /


dir_partition inode=5
     MS Data                   239616  975734900  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 .
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 ..
      21 dr-xr-xr-x     0      0         0  8-Aug-2022 18:20 System Volume Information
      17 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 found.000
      25 -r--r--r--     0      0       112  8-Aug-2022 18:18 bootTel.dat

dir_partition inode=21
     MS Data                   239616  975734900  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /System Volume Information
      21 dr-xr-xr-x     0      0         0  8-Aug-2022 18:20 .
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 ..
      22 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 Chkdsk
      41 -r--r--r--     0      0        76  8-Aug-2022 18:18 IndexerVolumeGuid
      42 -r--r--r--     0      0        12  8-Aug-2022 18:20 WPSettings.dat
      40 -r--r--r--     0      0     20480  8-Aug-2022 18:18 tracking.log

dir_partition inode=22
     MS Data                   239616  975734900  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /System Volume Information/Chkdsk
      22 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 .
      21 dr-xr-xr-x     0      0         0  8-Aug-2022 18:20 ..
      23 -r--r--r--     0      0   4160512  8-Aug-2022 18:18 Chkdsk20220808231833.log
Directory /System Volume Information
      21 dr-xr-xr-x     0      0         0  8-Aug-2022 18:20 .
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 ..
      22 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 Chkdsk
      41 -r--r--r--     0      0        76  8-Aug-2022 18:18 IndexerVolumeGuid
      42 -r--r--r--     0      0        12  8-Aug-2022 18:20 WPSettings.dat
      40 -r--r--r--     0      0     20480  8-Aug-2022 18:18 tracking.log
Directory /
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 .
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 ..
      21 dr-xr-xr-x     0      0         0  8-Aug-2022 18:20 System Volume Information
      17 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 found.000
      25 -r--r--r--     0      0       112  8-Aug-2022 18:18 bootTel.dat

dir_partition inode=17
     MS Data                   239616  975734900  975495285
     NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /found.000
      17 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 .
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 ..
Directory /
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 .
       5 dr-xr-xr-x     0      0         0  9-Aug-2022 02:48 ..
      21 dr-xr-xr-x     0      0         0  8-Aug-2022 18:20 System Volume Information
      17 dr-xr-xr-x     0      0         0  8-Aug-2022 18:18 found.000
      25 -r--r--r--     0      0       112  8-Aug-2022 18:18 bootTel.dat

     MS Data                  1277835  976773119  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
     MS Data                 21267312   21270191       2880
     FAT12, blocksize=512, 1474 KB / 1440 KiB
Directory /
       3 -rwxr-xr-x     0      0     45341  3-Sep-2006 00:10 kernel.sys
      92 -rwxr-xr-x     0      0     66945  3-Sep-2006 00:11 command.com
     223 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 driver
     322 -rwxr-xr-x     0      0      1768  3-Sep-2006 00:11 fdconfig.sys
     326 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 freedos

dir_partition inode=326
     MS Data                 21267312   21270191       2880
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT: cluster=326(0x146), pos=21267669
FAT: cluster=358(0x166), pos=21267701
Directory /freedos
     326 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 .
       0 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 ..
     327 -rwxr-xr-x     0      0      2977  3-Sep-2006 00:11 append.exe
     333 -rwxr-xr-x     0      0      4149  3-Sep-2006 00:11 choice.exe
     342 -rwxr-xr-x     0      0      3759  3-Sep-2006 00:11 localize.com
     350 -rwxr-xr-x     0      0      1530  3-Sep-2006 00:11 oscheck.com
     353 -rwxr-xr-x     0      0       510  3-Sep-2006 00:11 hdd.bat
     354 -rwxr-xr-x     0      0       504  3-Sep-2006 00:11 getargs.com
     355 -rwxr-xr-x     0      0      1456  3-Sep-2006 00:11 iniadd.com
     359 -rwxr-xr-x     0      0      1024  3-Sep-2006 00:11 xmssize.com
     361 -rwxr-xr-x     0      0      3018  3-Sep-2006 00:11 fdauto.bat
     367 -rwxr-xr-x     0      0     11459  3-Sep-2006 00:11 sys.com
Directory /
       3 -rwxr-xr-x     0      0     45341  3-Sep-2006 00:10 kernel.sys
      92 -rwxr-xr-x     0      0     66945  3-Sep-2006 00:11 command.com
     223 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 driver
     322 -rwxr-xr-x     0      0      1768  3-Sep-2006 00:11 fdconfig.sys
     326 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 freedos

dir_partition inode=223
     MS Data                 21267312   21270191       2880
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT: cluster=223(0xdf), pos=21267566
FAT: cluster=301(0x12d), pos=21267644
Directory /driver
     223 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 .
       0 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 ..
     224 -rwxr-xr-x     0      0      4595  3-Sep-2006 00:11 cdrcache.sys
     233 -rwxr-xr-x     0      0      2535  3-Sep-2006 00:11 xdma.sys
     238 -rwxr-xr-x     0      0      3745  3-Sep-2006 00:11 xcdrom.sys
     246 -rwxr-xr-x     0      0      3069  3-Sep-2006 00:11 devload.com
     252 -rwxr-xr-x     0      0      2423  3-Sep-2006 00:11 shsucdhd.exe
     257 -rwxr-xr-x     0      0      5612  3-Sep-2006 00:11 shsucdx.com
     268 -rwxr-xr-x     0      0     16799  3-Sep-2006 00:11 emm386.exe
     302 -rwxr-xr-x     0      0      8058  3-Sep-2006 00:11 himem.exe
     318 -rwxr-xr-x     0      0      1577  3-Sep-2006 00:11 eltorito.sys
Directory /
       3 -rwxr-xr-x     0      0     45341  3-Sep-2006 00:10 kernel.sys
      92 -rwxr-xr-x     0      0     66945  3-Sep-2006 00:11 command.com
     223 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 driver
     322 -rwxr-xr-x     0      0      1768  3-Sep-2006 00:11 fdconfig.sys
     326 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 freedos


dir_partition inode=0
     EFI System              25465432   25473791       8360 [EFI System Partition] [OCS-EFI]
     FAT12, blocksize=2048, 4280 KB / 4180 KiB
Directory /
       3 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 EFI

dir_partition inode=3
     EFI System              25465432   25473791       8360 [EFI System Partition] [OCS-EFI]
     FAT12, blocksize=2048, 4280 KB / 4180 KiB
FAT: cluster=3(0x3), pos=25465488
Directory /EFI
       3 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 .
       0 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 ..
       4 drwxr-xr-x     0      0         0  5-Aug-2015 08:09 BOOT

dir_partition inode=4
     EFI System              25465432   25473791       8360 [EFI System Partition] [OCS-EFI]
     FAT12, blocksize=2048, 4280 KB / 4180 KiB
FAT: cluster=4(0x4), pos=25465492
Directory /EFI/BOOT
       4 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 .
       3 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 ..
       5 -rwxr-xr-x     0      0    705024  5-Aug-2015 08:09 BOOTIA32.EFI
     350 -rwxr-xr-x     0      0   1046016  5-Aug-2015 08:09 BOOTX64.EFI
     861 -rwxr-xr-x     0      0   2400500 14-Jun-2015 19:15 UNICODE.PF2
FAT: cluster=3(0x3), pos=25465488
Directory /EFI
       3 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 .
       0 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 ..
       4 drwxr-xr-x     0      0         0  5-Aug-2015 08:09 BOOT
Directory /
       3 drwxr-xr-x     0      0         0  5-Aug-2015 08:12 EFI


dir_partition inode=0
     MS Data                 21267312   21270191       2880
     FAT12, blocksize=512, 1474 KB / 1440 KiB
Directory /
       3 -rwxr-xr-x     0      0     45341  3-Sep-2006 00:10 kernel.sys
      92 -rwxr-xr-x     0      0     66945  3-Sep-2006 00:11 command.com
     223 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 driver
     322 -rwxr-xr-x     0      0      1768  3-Sep-2006 00:11 fdconfig.sys
     326 drwxr-xr-x     0      0         0  3-Sep-2006 00:11 freedos


dir_partition inode=2
     Linux filesys. data      9911704   29912471   20000768
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 10240 MB / 9766 MiB
ext2fs_dir_iterate failed with error 2133571354.
Directory /

     MS Data                  1277835  976773119  975495285
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.

recuperation
Posts: 2719
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: accidentally installed linux over existing win10 install

#4 Post by recuperation »

In the current situation your are only left with the chance of using some other software that will evaluate the remains of NTFS meta data as your NTFS file system is too damaged for Testdisk to read it and Photorec did not find the files you were looking for.

Floydius
Posts: 3
Joined: 12 Aug 2022, 01:30

Re: accidentally installed linux over existing win10 install

#5 Post by Floydius »

Understood; thank you for taking the time to point me in the right direction.

Locked