cgsecurity.org

Hello,

-I had perfectly functioning 5TB My Passport, filled about 3TB.
-I was looking to make a clone of other disk which failed (2TB), using DDRescue, running on Ubuntu on pendrive. I stupidly believed it would make an "image", and store on the free 2TB that was left. Instead it started overwriting it.
-I quickly stopped the process upon realizing my error
-At that point i couldn't access files on UBUNTU, and on Windows i now get
"D:\ is not accessible.
The volume does not contain a recognized file system.
Please make sure that all required file system drivers are loaded and that the volume is not corrupted."
or "You need to format the disk in drive D: before you can use it."
-Test Disk / EFI GPT / Analyse gives:
"
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Data 2048 9767473151 9767471104 [My Passport]
1 P MS Data 2048 9767473151 9767471104 [My Passport]
"
-Quick search instantly jumps to 40% each time - and then it goes slowly.
-I think I previously run Quick Search till the end - when it found 3 partitions: 1 suggesting the original one, 2nd suggesting the DDRescue copy of my corrupted disk, and 3rd some Linux business "D Linux filesys. data"
-in either case, if i abort quick search at that 40% - i get following results:
Results
MS Data 2048 9767473151 9767471104
NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
MS Data 34816 3907028991 3906994176 [Data]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
(more info below)
-So my first question is - doesn't this suggest that the first partition (5GB) is my original one - and the second (2GB) is the one i started overwriting with?
-unfortunately i can't list files:
"Can't open filesystem. Filesystem seems damaged.
NTFS filesystem needs to be repaired."
-here I though RebuildingBS made sense, rather than continue DeepSearching for more partitions. Pardon my ignorance, my 2n'd question is : was this the right assumption?
-unfortunately RebuildBS is inaccessible at all, i.e. Advanced - where option "boot" should be found - unfortunately doesn't list such option. Only Type or Image Creation (or Quit)
-Finally: I ddRescued this very disk - but when running TestDisk on it - I don't instantly find partition i suspect being my lost one, which is behaviour i also can't explain.

Thanks, Jan

Please post your Testdisk log file and post the command that created desaster.

Thank you for replying.

1. Command
I believe command was the following one or very similar to this one:
sudo ddrescue -d -f /dev/sdd /dev/sdc
(ddrescue was giving me errors in my previous attemps, and in my frustration, and after misguidance from ChatGPT, i run it in FORCE mode, that i'm confident I did)

2). extra information
-The other partition, with which i overwrote the original disk, the 2TB one, it does list some files, presumably the few that copied before i terminated the process.

3. Testdisk log
I attach log. I apologize for not having done it previously.
The log i attach is from running Quick Search to 40%, aborting, finding 2 partitions, and trying to access presumed original partition, and failing.
I'm afraid I don't have the original log from when I completed the Quick Search. I will do it again if it's sensible, but as previously stated - it does appear to my amateur eyes that the partition is indeed being found.

How long did ddrescue run?
What did the overview screen tell about the number of bytes copied before you interrupted ddrescue?

-I had perfectly functioning 5TB My Passport, filled about 3TB.
-I was looking to make a clone of other disk which failed (2TB), using DDRescue, running on Ubuntu on pendrive. I stupidly believed it would make an "image", and store on the free 2TB that was left.

There is no "storing on the free 2TB". Your operating system choses the location within a file system where to store stuff.
A key information that you left out is the partition structure before the incident.

Has your disk been formated with on partition of 3 TB followed by another of 2 TB?
Which file system(s) did you use on your partition(s)?

1. DDrescue running time and bytes copied
-Running time - I would imagine it was 5-15 minutes. Could have been less. The moment i noticed the files disappear was when I realized what was happening and immediately interrupted.
-Alas I don't know what the screen was saying. I believe I panicked and just shut DDRescue.
-Like I said I can see some files on the overwritten disk from the damaged disk i was copying. It's very few files, worth perhaps 10 mb, if not less (a few text files)
-Btw that damaged disk I later did copy properly, to a fresh new disk - run TestDisk on - it found partition but there were many files missing. I recovered what I could - and then run photorec to still get some pictures out - and I believe I got most of them. Thank you for TestDisk and Photorec

2. Partition structure
-I'm confident it was NTFS
-I can't know 100% because I didn't check it myself
-It's WD My Passport 5TB bought in 2021
-They come already formatted - apparently NTFS - according to WD's site ("My Passport is formatted for Windows® 10+ to deliver plug-and-play storage out of the box. With WD software, you can also download the NTFS driver for macOS, so you can work seamlessly between operating systems without reformatting.") , and some other sources
-I haven't formatted it since, and would generally just put backup stuff there (=not heavy usage)

3. extra info: photorec
-I did run photorec for about 1-2 days.
-It was going slow but steadily, and i was recovering my pictures. It did stop/freeze like once or twice - and I had to restart it - and it resumed where it left
-I was running it on UBUNTU - the only computer free to run it
-On Ubuntu I was able to see the files recoverd
-But then interestingly upon plugging the disk (disk with photorec recovered data) to Windows - the disk works extremely slow (it was quick previously and it's a new one) - and the folder with my recovered files doesn't open (but it still opens on Ubuntu)

Assuming a 130 MB / sec write speed of a 5400 rpm 3,5'' drive the data overwritten is:

10 minutes x (60 sec / minute) * (130 MB / sec) = 78 000 MB = 78 GB.

That is sufficient to wipe out the MFT of a NT file system assuming it was still located at the beginning of your disk.

Even if you found the backup BS or even the MFT mirror (its just a few entries and not a full duplicate of the MFT) you won't get your file sytem up and running.

As Photorec is the tool of last resort and you don't know which file system has been on your overwritten disk, you should try other commercial recovery software that is able to deal with metadata and data remains residing on your overwritten disk.

Ok now I understand.
Thank you sir for helping and explaining the subject. I will try other solutions, and will post any meaningful results.

UPDATE:
I did use commercial software.
It found files, just like photorec would.
It found a semblence of the partition on the disk with which I overwrote my disk.
And then after full scan it found some weird entity which could have been either the original partition that i overwrote, or the new one,
But the bottom line is that in this weird 3rd partition, in the part of it indicating presumably either deleted files or deleted partition - i found my RECENT files in their folders, with metadata and all. Everything else I had backed up. So I got extremely lucky.
Thank you for help.
Good luck to everyone