cgsecurity.org

Posted: **05 Feb 2025, 23:03**

Hi, I had several partitions/volumes on my SSD disk.

C: - System
D: - Data
Recovery (hidden partition)

I accidentally deleted my recovery volume with diskpart. I wanted to recover it with TestDisk. After analyzing the disk with TestDisk, I reseted the laptop. After the reset, there is no data - C: and D: also disappeared. The disk was encrypted with Bitlocker. I have the key. Is there a chance to recover the data? Did the TRIM function clean the disk and there is no chance to recover C and D partitions? What could happened? I have no access to logs since it was on the disk that has been cleared/broken?

Posted: **06 Feb 2025, 12:02**

pstryk67 wrote: 05 Feb 2025, 23:03 Hi, I had several partitions/volumes on my SSD disk.
C: - System

D: - Data

Recovery (hidden partition)
I accidentally deleted my recovery volume with diskpart.

How?! Your following description sounds like you deleted everything.

I wanted to recover it with TestDisk. After analyzing the disk with TestDisk, I reseted the laptop.

Please describe what you mean writing "I reseted"!

After the reset, there is no data - C: and D: also disappeared. The disk was encrypted with Bitlocker. I have the key.

Depending on any dammage arisen the use of your recovery key might be necessary.

Is there a chance to recover the data?

I can't foresee and your descriptions is raising questions instead of answering them.

Did the TRIM function clean the disk and there is no chance to recover C and D partitions?

There is no reason for the internal TRIM mechanism to delete your whole disk unless you did delete the whole disk - not just deleting partition entries.

What could happened? I have no access to logs since it was on the disk that has been cleared/broken?

I don't know. Unfortunately you do not provide anything regarding the current status of your disk, neither behaviour nor TestDisk log file.

Posted: **07 Feb 2025, 17:08**

I am still gathering any missing information

Posted: **09 Feb 2025, 10:15**

Ok, let's start from the beginning.

I have a disk that originally had three volumes. I removed one volume from the disk using DiskPart, but only one volume. The other volumes were working correctly. I was trying to find a way to recover the deleted partition. It took me a few days to come across TestDisk. During the time between removing the volume and running TestDisk for the first time, I rebooted the system a few times. Everything was working correctly, and the removed volume was shown as unused space in Disk Manager.

Summary of the status BEFORE the first Testdisk run:
1. Two correctly working partitions
2. Unallocated disk space, visible in the disk manager
3. System is able to reboot

I started TestDisk and followed the instructions. I used the option that searches for missing partitions. I waited for the analysis to be finished. I do not remember the exact message after the disk was analyzed by TestDisk (my bad). After I exited TestDisk, I rebooted the computer, and it was unable to start. I started the system with a USB and checked the partition table. There were no healthy volumes; each had been removed.

Summary of the status AFTER the first Testdisk run:
All partitions deleted
No volumes
No data
No logs since they were created on the partition that has been removed/overwrite by TestDisk.

I ran TestDisk again to check for deleted partitions. It currently looks like this

Disk \\.\PhysicalDrive1 - 1024 GB / 953 GiB - CHS 124519 255 63
Analyse cylinder 124519/124518: 99%

EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
MS Data 32768 2000406527 2000373760 [Nowy]
MS Data 2000406527 4000780286 2000373760

The last row looks like one of the deleted/overwritten partition. Unfortunately TestDisk seems to be "freezed" on 124519/124518: 99%

What should I do now? By the way, a quick analysis performed by TestDisk takes about 40 hours of continuous program operation. Is this normal?
I attached the log from the second (current) run of TestDisk

Posted: **09 Feb 2025, 11:30**

You are probably running a dammaged disk.
What is the name and model of the supposedly dammaged disk? Your Realtek interface (being either on mainboard or part of an external device) does not let the information go through.
How is your dammaged disk connected? To what machine?

A healthy 3,5'' disk running at 5400 rpm connected to a USB 3.0 interface should take 2-3 hours. 40 hours indicates severe problems.

Asking the disk about its health status is necessary:

viewtopic.php?f=5&t=10910

Depending on the outcome you would the clone the disk using ddrescue as described in the manual.

You would then use the clone target for your recovery attempts.

Please note that your second TestDisk run shows an EFI System partition overlapping with the following MS Data partition. This is not an allowed state that shows that you either modified it or something broke down. Your TestDisk log file, though, shows a healthy partition structure with no anomalies.

Posted: **09 Feb 2025, 20:04**

I'm using a device similar to the following one: https://www.amazon.com/dp/B0BVBPH5FG/ to connect the disk
My machine is a Lenovo ThinkPad L15 Gen 4.
Disk data below:

Code: Select all

smartctl 7.4 2023-08-01 r5530 [x86_64-w64-mingw32-w11-b26100] (sf-7.4-1)
Copyright (C) 2002-23, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Device Model:     SKHynix_HFS001TEJ4X164N
Serial Number:    4JC7N468510607D2T
Firmware Version: 51770C30
Device is:        Not in smartctl database 7.3/5528
ATA Version is:   [No Information Found]
Local Time is:    Sun Feb 09 19:41:07 2025 CEST
SMART support is: Ambiguous - ATA IDENTIFY DEVICE words 82-83 don't show if SMART supported.
SMART support is: Ambiguous - ATA IDENTIFY DEVICE words 85-87 don't show if SMART is enabled.
A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options.

Currently the PhysicalDrive1 contains empty partition. This partition was created by my IT department during a data recovery attempt. Originally, right after the reboot, the drive had about two small partitions. Less than 1GB total. All the remaining space was unallocated.

Please note that your second TestDisk run shows an EFI System partition overlapping with the following MS Data partition

I would like to recover the overlapped partition

Btw
I tried another USB cable, it is much faster

Posted: **10 Feb 2025, 15:03**

pstryk67 wrote: 09 Feb 2025, 20:04 I'm using a device similar to the following one: https://www.amazon.com/dp/B0BVBPH5FG/ to connect the disk
My machine is a Lenovo ThinkPad L15 Gen 4.
Disk data below:
Code: Select all
smartctl 7.4 2023-08-01 r5530 [x86_64-w64-mingw32-w11-b26100] (sf-7.4-1)
Copyright (C) 2002-23, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Device Model:     SKHynix_HFS001TEJ4X164N
Serial Number:    4JC7N468510607D2T
Firmware Version: 51770C30
Device is:        Not in smartctl database 7.3/5528
ATA Version is:   [No Information Found]
Local Time is:    Sun Feb 09 19:41:07 2025 CEST
SMART support is: Ambiguous - ATA IDENTIFY DEVICE words 82-83 don't show if SMART supported.
SMART support is: Ambiguous - ATA IDENTIFY DEVICE words 85-87 don't show if SMART is enabled.
A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options.
Currently the PhysicalDrive1 contains empty partition. This partition was created by my IT department during a data recovery attempt. Originally, right after the reboot, the drive had about two small partitions. Less than 1GB total. All the remaining space was unallocated.

Please note that your second TestDisk run shows an EFI System partition overlapping with the following MS Data partition
I would like to recover the overlapped partition

Btw
I tried another USB cable, it is much faster

"much faster" is as good as no information. Please avoid abbreviations!

Please note: I have no experience with Bitlocker.

Your partition table is messed up. According to the log file, your partition [Nowy] spans the whole disk which does not fit your initial description.

Rerun TestDisk. If the partitions found by TestDisk do not match your expectation continue with deep search to see if TestDisk finds the inital partitions.
You cannot look into a partition using the "p"-key when it has been encrypted. After writing the partition table disconnect the docking station.

Reconnect the docking station to a working windows machine supporting Bitlocker. Windows should recognize the modified partition table. Hopefully windows recognizes at least the partition you want to recover and will ask you for the password.

P.S.:

Regarding the title "TestDisk broke data?", I don't know what "breaking data" should mean. You were in a menu where you could have written a new partition table. If you carelessly just wrote a new partition table that does not fit to the real locations of the partitions on disk you may have lost the data in the partition table but not the content of your partitions. This statement only applies to GPT partitions. When writing an unsuitable MBR partition table this is different.

cgsecurity.org

TestDisk broke data?

TestDisk broke data?

Re: TestDisk broke data?

Re: TestDisk broke data?

Re: TestDisk broke data?

Re: TestDisk broke data?

Re: TestDisk broke data?

Re: TestDisk broke data?