cgsecurity.org

Hi!

I had accidentally overwritten my partition table and quick format. When I use TestDisk to perform a deep scan it finds all sorts of partitions but not the one with my data. It seems both old deleted partition and new partition start at same sector 2048 so I am not sure if that confuses DestDisk. If I list deleted files by pressing p TestDisk does not show them. Also if I go to advanced -> undelete it does not show them. When I try some other programs such as DMDE or DiskGenius they also initially don't show the files but when I make them scan for deleted files they show all files with their original names and paths. This makes me think that TestDisk stops at first MFT file it finds (which is what was created after quick format) and then lists files based on that? If so is it possible to instruct TestDisk to scan deeper for MFT files? If I understand correctly NTFS file system has multiple copies of MFT files and that is why some other programs are able to list them after some scanning. It would really great if I could somehow get TestDisk to recover these files because it's open source. I also tried fix MFT according to this tutorial https://www.cgsecurity.org/wiki/Advance ... MFT_Repair by trying Backup BS option but it did not help.

Afgfrg wrote: 02 Jul 2023, 09:06 Hi!

I had accidentally overwritten my partition table and quick format. When I use TestDisk to perform a deep scan it finds all sorts of partitions but not the one with my data. It seems both old deleted partition and new partition start at same sector 2048 so I am not sure if that confuses DestDisk.

For issues with DestDisk, please contact the DestDisk support. This forum only supports the TestDisk package.

If I list deleted files by pressing p TestDisk does not show them.

Also if I go to advanced -> undelete it does not show them. When I try some other programs such as DMDE or DiskGenius they also initially don't show the files but when I make them scan for deleted files they show all files with their original names and paths. This makes me think that TestDisk stops at first MFT file it finds (which is what was created after quick format) and then lists files based on that?

Yes.

If so is it possible to instruct TestDisk to scan deeper for MFT files?

No.

If I understand correctly NTFS file system has multiple copies of MFT files

No, that is wrong. The so-called MFT mirror contains only some entries of the whole MFT.

and that is why some other programs are able to list them after some scanning.

No. Testdisk is using information from the MFT Mirror.

It would really great if I could somehow get TestDisk to recover these files because it's open source.

As it is open source you can implement those new features. That is possible because it is open source. You are talking about "open source" but you really mean "free". "Open source" does not automatically mean "free".

I also tried fix MFT according to this tutorial https://www.cgsecurity.org/wiki/Advance ... MFT_Repair by trying Backup BS option but it did not help.

There was no need to run that function because your quick format operation created a brand-new partition where boot sector and and backup boot sector were already identical.

Unfortunately there are no resources to extend Testdisk the way you want it to be - as powerful as some commercial software that will analyse the complete remains of a former file system or disk.

Thank you for your response!

For issues with DestDisk, please contact the DestDisk support. This forum only supports the TestDisk package.

Sorry for confusion I really meant TestDisk. It was typo in my post. But as I already understood in my case I can't get TestDisk to do that anyways.

If in my case MFT repair would not help, do you happen to what could help? Are there any keywords that I could google?

Try out other (commercial) recovery products. Your posting title suggest you already found some that are working.