cgsecurity.org

Hi,

I was being and idiot and accidentally installed Win 11 on the wrong HDD and I'm now trying to recover the lost data. I actually managed to clean install Win11 twice before realizing the blunder. So I'm wondering is there anything that can be done? Testdisk is finding a partition but says it cannot be recovered. Any help would be appreciated.
Here is the log file



Sat Sep 10 13:02:55 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249302089728
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=90177536000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=909919649792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1999641772032
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 850 EVO 250GB, S/N:S2R6NX0H804597L, FW:EMT02B6Q
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SJ, S/N:S246J9GZ300395, FW:1AJ10001
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HUA721010KLA330, S/N:GTE000PBGHDPZE, FW:GKAOA9N1
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM008-2FR102, S/N:WFL43Y46, FW:0001

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - ST2000DM008-2FR102
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CHS 243201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=3907029167 (expected 3907029167)
hdr_lba_start=34
hdr_lba_end=3907029134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 206848 239615 32768 [Microsoft reserved partition]
Current partition structure:
1 P EFI System 2048 206847 204800 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 206848 239615 32768 [Microsoft reserved partition]
2 P MS Reserved 206848 239615 32768 [Microsoft reserved partition]
3 P MS Data 239616 3905789951 3905550336 [Basic data partition] [To Recover]
4 P Windows Recovery Env 3905789952 3907026943 1236992

search_part()
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CHS 243201 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
EFI System 2048 206847 204800 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 14/233/28
filesystem size 3905550336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=122683392, part_size=1999641772032, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 14/233/28
filesystem size 3905550336
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 239616 3905789951 3905550336 [To Recover]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
NTFS at 243124/45/58
filesystem size 1236992
sectors_per_cluster 8
mft_lcn 51541
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 3904552961 3905789952 1236992
NTFS found using backup sector, blocksize=4096, 633 MB / 604 MiB
NTFS at 243124/45/58
filesystem size 1236992
sectors_per_cluster 8
mft_lcn 51541
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 3905789952 3907026943 1236992
NTFS, blocksize=4096, 633 MB / 604 MiB
NTFS at 243201/78/13
filesystem size 3906789376
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 239616 3907028991 3906789376 [To Recover]
NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
NTFS at 243201/78/13
filesystem size 3906789376
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 3907028991 7813818366 3906789376
NTFS, blocksize=4096, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=3907028991, size=3906789376, end=7813818366, disk end=3907029168)
file_win32_pread(632,11,buffer,3907029164(243201/80/60)) read err: read after end of file
file_win32_pread(632,8,buffer,3907029163(243201/80/59)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029156(243201/80/52)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029157(243201/80/53)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029158(243201/80/54)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029159(243201/80/55)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029160(243201/80/56)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029162(243201/80/58)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029164(243201/80/60)) read err: read after end of file
file_win32_pread(632,14,buffer,3907029166(243201/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3725 GiB)
The following partition can't be recovered:
MS Data 3907028991 7813818366 3906789376
NTFS, blocksize=4096, 2000 GB / 1862 GiB

Results
P EFI System 2048 206847 204800 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
MS Data 239616 3905789951 3905550336 [To Recover]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
MS Data 239616 3907028991 3906789376 [To Recover]
NTFS found using backup sector, blocksize=4096, 2000 GB / 1862 GiB
MS Data 3904552961 3905789952 1236992
NTFS found using backup sector, blocksize=4096, 633 MB / 604 MiB
MS Data 3905789952 3907026943 1236992
NTFS, blocksize=4096, 633 MB / 604 MiB

Try out Photorec or any commercial recovery software.

Thanks. I tried it and searched for mainly psd and aep files but sadly could only find few of those. Not sure if it's weird or not but those files were found in the first 30 seconds and after that nothing in the remaining 90 minutes or so.