cgsecurity.org

Hello, everyone.

I am currently in mild panic.

I needed to add another partition to a single-partition NTFS hard-drive. After terrible judgement, I ran on it and, of course, 600gb worth of content disappeared.

There were, from what I can tell, no further writes in the hard-drive. I ran testdisk on it. After a very long scan (2h30m),

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors

With options to add partition and load backup.

Do I have any hope in this scenario? What exactly are the options?

Any assistance is very much appreciated. Thank you!

EDIT: I am looking through some other posts. In my case, this is an external HDD with no boot partition. From what I can recall, there was only a single partition with files, in NTFS format. Also, after reading the documentation for mkfs.exfat, I did not choose the full-format option, which brings me some hope.

Also, the log file from testdisk: I am also aware of best practice being to clone everything from the other drive with ddrescue. I don't currently have a 1TB harddrive at hand but am considering this possibility.

iaminpanic wrote: 25 Jan 2024, 14:15 Hello, everyone.

I am currently in mild panic.

I needed to add another partition to a single-partition NTFS hard-drive. After terrible judgement, I ran

Code: Select all

mkfs.exfat

on it and, of course, 600gb worth of content disappeared.

There were, from what I can tell, no further writes in the hard-drive. I ran testdisk on it. After a very long scan (2h30m),

I don't know what "a very long scan" means as there are different ways of getting to the lines below.

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors

With options to add partition and load backup.

Do I have any hope in this scenario? What exactly are the options?

Any assistance is very much appreciated. Thank you!

EDIT: I am looking through some other posts. In my case, this is an external HDD with no boot partition. From what I can recall, there was only a single partition with files, in NTFS format. Also, after reading the documentation for mkfs.exfat, I did not choose the full-format option, which brings me some hope.

Also, the log file from testdisk:

Code: Select all

Partition table type (auto): None
Disk /dev/sdd - 1000 GB / 931 GiB - Seagate Expansion
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

Results

Please post your complete log file.

I am also aware of best practice being to clone everything from the other drive with ddrescue. I don't currently have a 1TB harddrive at hand but am considering this possibility.

Please forget the idea of "repairing" your disk.

Hello! Thank you very much for the swift response.
Here's the complete log. Drive in question is /dev/sdd.

EDIT: I can get a 1.5TB HDD in half an hour to run `ddrescue`, in case that is advisable, although you recommend that I forget the idea. Is your assessment that all data is permanently lost, or that it is impossible to revert back to NTFS without loss of data?

Please answer all my questions!

Hello again. Sorry for the delay.

I don't quite remember what I did, so I'm trying to retrace the steps:

ran `testdisk`; selected the harddrive; at the partition type table menu I selected Intel, and the `hint` says `Hint: None partition table type has been detected.` And then I selected `Analyse`. After that I went with Quick search.

EDIT:

Please forget the idea of "repairing" your disk.

With this, you mean it is not possible to revert to the previous NTFS state, preserving file integrity and structure, yes?

EDIT2: and considering it is highly recommended to attempt any file recovery to a separate drive, I'll necessarily need another hard drive, correct?

Thank you for your help so far. And sorry for any unclear communication on my end, but I am very, very distressed about this.

The following assumes that you did not use any parameter of ext3.mkfs which makes the command overwriting every sector of the related disk.

You would need to run deep search as well to exclude! the possibility of recovering the NTFS file system.
I propose this to verify that TestDisk can't help you here as I can't say if and to which extent the Master File Table in your NTFS file system has been overwritten. That structure contains metadata information like file names p.e. or data location on disk.

You are left with the free and open source program PhotoRec and commercial programs. TestDisk does even "in situ" repairs, but this is limited to a few well-defined issues.

You can't restore what was overwritten. Commercial software can examine the remains of a dammaged file system. This ability could improve the recovery results compared to PhotoRec which is based on file signatures only.

iaminpanic wrote: 25 Jan 2024, 15:23 EDIT2: and considering it is highly recommended to attempt any file recovery to a separate drive, I'll necessarily need another hard drive, correct?

Yes. This is a very basic fact.
If you are dealing with a broken disk, you need lots of storage, probably three times as big as a source: One time for a clone of your source, another time for a seond clone where you work safely on and a third time to have recovery space.

recuperation wrote: 25 Jan 2024, 15:45 The following assumes that you did not use any parameter of ext3.mkfs which makes the command overwriting every sector of the related disk.

I can confirm I did not use any other parameter.

You would need to run deep search as well to exclude! the possibility of recovering the NTFS file system.
I propose this to verify that TestDisk can't help you here as I can't say if and to which extent the Master File Table in your NTFS file system has been overwritten. That structure contains metadata information like file names p.e. or data location on disk.

So I now do a deep search to try and recover the NTFS file system? And if so, how do I select this option?

I'm not sure this is any helpful information. As I run the testdisk utility now, If I select 'None' I am shown the exFat partition. There are some files there because the hard drive got plugged into MacOS which already left some trace files.

You are left with the free and open source program PhotoRec and commercial programs. TestDisk does even "in situ" repairs, but this is limited to a few well-defined issues.

You can't restore what was overwritten. Commercial software can examine the remains of a dammaged file system. This ability could improve the recovery results compared to PhotoRec which is based on file signatures only.

EDIT: I realise you mention ext3.mkfs; I used mkfs.exfat, which, from my limited understanding, doesn't necessarily overwrite the whole disk.

EDIT2: I am leaving the house to buy some spare HDDs. I have already downloaded photorec too. If you have any more ideas, I'd appreciate all help possible. Otherwise, I think I'll clone the source to a backup HDD, scan the backup HDD and then eventual found data in a third HDD. Sigh.

iaminpanic wrote: 25 Jan 2024, 15:56

recuperation wrote: 25 Jan 2024, 15:45 The following assumes that you did not use any parameter of ext3.mkfs which makes the command overwriting every sector of the related disk.

I can confirm I did not use any other parameter.

You would need to run deep search as well to exclude! the possibility of recovering the NTFS file system.
I propose this to verify that TestDisk can't help you here as I can't say if and to which extent the Master File Table in your NTFS file system has been overwritten. That structure contains metadata information like file names p.e. or data location on disk.

So I now do a deep search to try and recover the NTFS file system? And if so, how do I select this option?

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

I'm not sure this is any helpful information.

There is no more helpful information. For a detailed explanation please consult with a professional recovery lab.

As I run the testdisk utility now, If I select 'None' I am shown the exFat partition. There are some files there because the hard drive got plugged into MacOS which already left some trace files.

This suggests that previous existing data was destroyed in addition to your formating operation.

You are left with the free and open source program PhotoRec and commercial programs. TestDisk does even "in situ" repairs, but this is limited to a few well-defined issues.

You can't restore what was overwritten. Commercial software can examine the remains of a dammaged file system. This ability could improve the recovery results compared to PhotoRec which is based on file signatures only.

EDIT: I realise you mention ext3.mkfs; I used mkfs.exfat, which, from my limited understanding, doesn't necessarily overwrite the whole disk.

Sorry, I wrote ext3.mkfs instead of mkfs.exfat. A quick format operation creating an exfat file system will not overwrite the whole disk.

Alright. Thank you very much for the guidance so far. I'm currently copying the whole content of the formatted hard drive to an external hdd, and I'll start working from there to reduce possible further disruption. Will keep you posted. Thank you very much, again, for all the help (and the tools!).

EDIT: this will take a while before I can do any further steps. Just to be clear: if I don't get any option for deeper search, it would mean nothing can be done and then I should advance to PhotoRec, correct?

iaminpanic wrote: 25 Jan 2024, 15:56 I have already downloaded photorec too.

PhotoRec is part of the Testdisk package. If you downloaded PhotoRec somewhere else separated from the TestDisk package, you should worry and post the download location.

Edited: 25.1.2024 23:01