cgsecurity.org

Posted: **26 May 2025, 22:29**

Hello everyone.
I Hope you had a great day so far. I will excuse myself in the beginning since my native language isnt english.

First I would like to tell you about my system:
The Problem device: 250GB SSD from Samsung 850 Evo
It was usually used as a Bootable System drive. Like a normal C:\ and data like pictures, docs, videos and all that kind of stuff. Almost completely full with data, Maybe 10GB free space left to that time.
Installed was an old Windows 10 Version. I guess in GPT.

CrystalDiskInfo
https://imgur.com/a/YFi5T70

Now i have to talk a bit more about what happened and how much mistakes i did as an unknown user.

I tried to start my PC after a long pause. It didnt work. The error message was like: select the proper boot device or insert boot media
So i thought there is something wrong with the bootsector. I disconected the SSD from my usual desktop setup and connected it with a SSD to USB Adapter to my laptop.
At that moment ALL data was still on it and accessible. ( unfortunatly, as i know later, i didnt do any backups at that point - the reason im writing you now)
As you already can imagine, i started "playing" in order to fix that "boot issue"

I came across some tutorials, that use diskpart through powershell.
I put commands like that... a few times... and selected (of course) also the fron volumes

Code: Select all

"
diskpart
list vol
sel vol y - (y = number of systempartition)
format FS="Fat32" Quick
assign letter=Z:  (Z as an example)
exit
bcdboot c:\Windows /l de-de /s Z: /f UEFI 
"

After that was there no data accessible and the drive was empty. ( cause of the quick format/ and everything else i did)

I tried photorec to rescue my files, without success.

If im running the programm only a few files are found. ( mini picture files, i never saw before and a few other files xmls not readable or without content in it)

if i try running Testdisk, Create log, EFI GPT,Analyse ( https://imgur.com/a/HSNsOpA ) than Quick search says ( https://imgur.com/a/aP0RLon )

Please dont get confused about those D: E: F: Partitions, i was trying to get as much as possible "active/primary" ( probably my next mistake)

When i try to list files for example the second one ( https://imgur.com/a/6NAFKSp )

I would like to know if it is possible to get the partions right again and if it is successful, is there any small mini chance to get access to my old data?

Sorry if i missed some information. I will provide the information as soon as possible.

Thanks for reading, smiling and head shaking

Posted: **26 May 2025, 22:30**

Here the log file from testdisk

Code: Select all

ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239087910912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=249330401280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=605028352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=249329352704
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - SanDisk SSD PLUS 240GB, S/N:25151K4A4K08, FW:42077100
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ASMT 2105, S/N:00000000000000000000
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 870 EVO 250GB, S/N:S6PENL0X302511K, FW:SVT02B6Q

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - ASMT 2105
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=488397167 (expected 488397167)
hdr_lba_start=34
hdr_lba_end=488397134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048     206847     204800 [NO NAME]
 2 P MS Data                   239616  487213055  486973440
 3 P MS Data                487213062  488394757    1181696 [NO NAME]

search_part()
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     MS Data                     2048     206847     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 14/233/28
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=122683392, part_size=249330401280, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 14/233/28
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   239616  487213055  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB
FAT32 at 30327/155/37
FAT1 : 5898-7044
FAT2 : 7045-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1181695
sectors : 1181696
cluster_size : 8
no_of_cluster : 146688 (2 - 146689)
fat_length 1147 calculated 1147
set_FAT_info: name from BS used

FAT32 at 30327/155/37
FAT: cluster=2(0x2), pos=487221248
     MS Data                487213056  488394751    1181696 [NO NAME]
     FAT32, blocksize=4096, 605 MB / 577 MiB
NTFS at 30401/75/10
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1423360  488396799  486973440
     NTFS found using backup sector, blocksize=4096, 249 GB / 232 GiB
NTFS at 30401/75/10
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                488396799  975370238  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB
This partition ends after the disk limits. (start=488396799, size=486973440, end=975370238, disk end=488397168)
file_win32_pread(640,11,buffer,488397159(30401/80/55)) read err: read after end of file
file_win32_pread(640,11,buffer,488397162(30401/80/58)) read err: read after end of file
file_win32_pread(640,8,buffer,488397161(30401/80/57)) read err: read after end of file
file_win32_pread(640,3,buffer,488397167(30401/80/63)) read err: read after end of file
file_win32_pread(640,8,buffer,488397165(30401/80/61)) read err: read after end of file
file_win32_pread(640,14,buffer,488397156(30401/80/52)) read err: read after end of file
file_win32_pread(640,14,buffer,488397157(30401/80/53)) read err: read after end of file
file_win32_pread(640,14,buffer,488397158(30401/80/54)) read err: read after end of file
file_win32_pread(640,14,buffer,488397159(30401/80/55)) read err: read after end of file
file_win32_pread(640,14,buffer,488397160(30401/80/56)) read err: read after end of file
file_win32_pread(640,14,buffer,488397162(30401/80/58)) read err: read after end of file
file_win32_pread(640,14,buffer,488397164(30401/80/60)) read err: read after end of file
file_win32_pread(640,14,buffer,488397166(30401/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (250 GB / 232 GiB) seems too small! (< 499 GB / 465 GiB)
The following partition can't be recovered:
     MS Data                488396799  975370238  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB

Results
   P MS Data                     2048     206847     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
     MS Data                   239616  487213055  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB
     MS Data                  1423360  488396799  486973440
     NTFS found using backup sector, blocksize=4096, 249 GB / 232 GiB
     MS Data                487213056  488394751    1181696 [NO NAME]
     FAT32, blocksize=4096, 605 MB / 577 MiB

interface_write()
 1 P MS Data                     2048     206847     204800 [NO NAME]
simulate write!

Analyse Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=488397167 (expected 488397167)
hdr_lba_start=34
hdr_lba_end=488397134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048     206847     204800 [NO NAME]
 2 P MS Data                   239616  487213055  486973440
 3 P MS Data                487213062  488394757    1181696 [NO NAME]

search_part()
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     MS Data                     2048     206847     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 14/233/28
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=122683392, part_size=249330401280, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 14/233/28
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   239616  487213055  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB
FAT32 at 30327/155/37
FAT1 : 5898-7044
FAT2 : 7045-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1181695
sectors : 1181696
cluster_size : 8
no_of_cluster : 146688 (2 - 146689)
fat_length 1147 calculated 1147
set_FAT_info: name from BS used

FAT32 at 30327/155/37
FAT: cluster=2(0x2), pos=487221248
     MS Data                487213056  488394751    1181696 [NO NAME]
     FAT32, blocksize=4096, 605 MB / 577 MiB
NTFS at 30401/75/10
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1423360  488396799  486973440
     NTFS found using backup sector, blocksize=4096, 249 GB / 232 GiB
NTFS at 30401/75/10
filesystem size           486973440
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                488396799  975370238  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB
This partition ends after the disk limits. (start=488396799, size=486973440, end=975370238, disk end=488397168)
file_win32_pread(640,11,buffer,488397159(30401/80/55)) read err: read after end of file
file_win32_pread(640,11,buffer,488397162(30401/80/58)) read err: read after end of file
file_win32_pread(640,8,buffer,488397161(30401/80/57)) read err: read after end of file
file_win32_pread(640,3,buffer,488397167(30401/80/63)) read err: read after end of file
file_win32_pread(640,8,buffer,488397165(30401/80/61)) read err: read after end of file
file_win32_pread(640,14,buffer,488397156(30401/80/52)) read err: read after end of file
file_win32_pread(640,14,buffer,488397157(30401/80/53)) read err: read after end of file
file_win32_pread(640,14,buffer,488397158(30401/80/54)) read err: read after end of file
file_win32_pread(640,14,buffer,488397159(30401/80/55)) read err: read after end of file
file_win32_pread(640,14,buffer,488397160(30401/80/56)) read err: read after end of file
file_win32_pread(640,14,buffer,488397162(30401/80/58)) read err: read after end of file
file_win32_pread(640,14,buffer,488397164(30401/80/60)) read err: read after end of file
file_win32_pread(640,14,buffer,488397166(30401/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (250 GB / 232 GiB) seems too small! (< 499 GB / 465 GiB)
The following partition can't be recovered:
     MS Data                488396799  975370238  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB

Results
   P MS Data                     2048     206847     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
     MS Data                   239616  487213055  486973440
     NTFS, blocksize=4096, 249 GB / 232 GiB
     MS Data                  1423360  488396799  486973440
     NTFS found using backup sector, blocksize=4096, 249 GB / 232 GiB
     MS Data                487213056  488394751    1181696 [NO NAME]
     FAT32, blocksize=4096, 605 MB / 577 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.

Posted: **27 May 2025, 07:30**

Der "Format"-Befehl rettet nie Daten.

Sie haben bei der Benutzung von TestDisk anstelle der Samsung SSD 870 EVO eine andere Festplatte ausgesucht, nämlich die "ASMT 2105" (vermutlich eine externe).

Code: Select all

Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ASMT 2105, S/N:00000000000000000000
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 870 EVO 250GB, S/N:S6PENL0X302511K, FW:SVT02B6Q

Sie müssen im Festplatten-Auswahlmenü auch die Samsung SSD 870 EVO 250 GB auswählen.
Angesichts dieser Fehler wäre es sinnvoll, wenn sie jemand bei Ihnen vor Ort bitten könnten, der Sie bei der Datenrettung unterstützt.

Des Weiteren sollten Sie sicherstellen, dass in Ihrem Bios auch die richtige Festplatte als "Boot"-Gerät eingestellt ist.

Posted: **27 May 2025, 10:37**

recuperation wrote: 27 May 2025, 07:30 Der "Format"-Befehl rettet nie Daten.

Sie haben bei der Benutzung von TestDisk anstelle der Samsung SSD 870 EVO eine andere Festplatte ausgesucht, nämlich die "ASMT 2105" (vermutlich eine externe).
Code: Select all
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ASMT 2105, S/N:00000000000000000000
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 870 EVO 250GB, S/N:S6PENL0X302511K, FW:SVT02B6Q
Sie müssen im Festplatten-Auswahlmenü auch die Samsung SSD 870 EVO 250 GB auswählen.
Angesichts dieser Fehler wäre es sinnvoll, wenn sie jemand bei Ihnen vor Ort bitten könnten, der Sie bei der Datenrettung unterstützt.

Des Weiteren sollten Sie sicherstellen, dass in Ihrem Bios auch die richtige Festplatte als "Boot"-Gerät eingestellt ist.

Hii recuperation,
PhysicalDrive1 is for sure my Samsung EVO 850, but TestDisk showed it as ASMT 2105, i dont know why.
Dont get confused with the PhysicalDrive2, that is an other Samsung SSD (870 Evo) a newer one i bought a short time ago.

What I noticed is, that while choosing the SSD in Testdisk, the Serial number is like "00000000000", while in CrystalDiskInfo every information is there.

Posted: **27 May 2025, 12:23**

As for the serial number, the TestDisk package obviously uses a different method of requesting that information.
smartmontools for instance has different methods but you have to try them out manually by adding extensions to the smartctl command like "d,sat" etc.
Crystaldiskinfo seems to try them all out.

Did you let nearly all file families selected as proposed in PhotoRec?
Did you select the right scope in PhotoRec? Maybe you have chosen a wrong partition.
If PhotoRec did not provide with any result you expected you are pretty much lost.

You can use hex editors like HxD to look at the sectors of your SSD to see if they are more or less filled with zeros.

I don't know how Windows 10 is handling a quick format operation. It might be that Windows does not only rewrites some structures, it might as well send the TRIM command as well, affecting the whole partition that is to be formated.

You can use another SSD, create one partition and format it using NTFS p.e. and fill the partition up with h2testw. Then you run a quick format on that partition and use HxD to learn if anything remains or if the partition has been zeroed out.

Posted: **27 May 2025, 13:11**

recuperation wrote: 27 May 2025, 12:23 As for the serial number, the TestDisk package obviously uses a different method of requesting that information.
smartmontools for instance has different methods but you have to try them out manually by adding extensions to the smartctl command like "d,sat" etc.
Crystaldiskinfo seems to try them all out.

Did you let nearly all file families selected as proposed in PhotoRec?
Did you select the right scope in PhotRec? Maybe you have chosen a wrong partition.
If PhotoRec did not provide with any result you expected you are pretty much lost.

You can use hex editors like HxD to look at the sectors of your SSD to see if they are more or less filled with zeros.

I don't know how Windows 10 is handling a quick format operation. It might be that Windows does not only rewrites some structures, it might as well send the TRIM command as well, affecting the whole partition that is to be formated.

You can use another SSD, create one partition and format it using NTFS p.e. and fill the partition up with h2testw. Then you run a quick format on that partition and use HxD to learn if anything remains or if the partition has been zeroed out.

In PhotoRec i havent changed the familie files. It finds a lot of .xml files, a bunch of random photo files ( never saw those pictures before) , the folders like Recovery and folder Log in it like "Reaload.xml" and "BootUX1.sqml and BootUX2.sqml", the System Volume Information folder with a kind of Systemfiles?! and a size of 320MB for exapmle names like "3{3808876b-c176-4e48-b7ae-04046e6cc752}" , the tracking.log file and the WPSettings.dat

I actually have no mini idea where to start fixing.

Is it usefull to get that message fixed first? - ( https://imgur.com/a/aP0RLon )
Do i need to rebuild something here? Or in other words, do i have to put something back in line first?

Bootsectors are kind of everywhere, no matter what partition i choose and check ( https://imgur.com/a/aJuQ67c )

When i look at overview ( https://imgur.com/a/HSNsOpA ) all these numbers dont fit together.
Yesterday i tried to read a lot of threads here and i noticed that the most numbers from other screenshots were matching together.
So maybe i need to figure that out first?

I got so much wierd questions in my head at the moment.
( probably a lot of these questions will expose me as an unknown pc user, i am, but you know that already since minute 1

)

Posted: **27 May 2025, 14:00**

If you disconnect one of the two main battery cables in a car, it does not matter whether the starter is broken. Your car won't start anyway.
You are ignoring my answer. Instead you are asking me questions like "What about if we remove the headlights ?"

If you do not believe me, try out other recovery software and see what that gives.

By the way, if I read your screenshot correctly, you already wrote 150 TB onto your SSD. Samsung guarantees you 75 TB for this model and size.

Posted: **27 May 2025, 14:19**

Hii,

i would like to make sure i understand what you are saying.

first of all, i disconnect the other SSD ( new 870 Evo ), to demonstrate that we talking about the Physical drive2.

Here the first screen:
( https://imgur.com/a/oZHkZ5i ) physical drive1 selected ( That is at the moment my windows system, where im typing from)
Second screen:
( https://imgur.com/a/DohJ2Um ) physical drive2 selected ( That is the problem device im talking about since i opened that thread, you see that serial number "000000" as well. and it show up as "ASMT2105"

I guess i chose the right one and the log i posted is from that selected drive too.

At the moment im not sure what answer you exactly mean. That i chose the wrong partition? - Well, i selected the right disk. buti got confused about what parts of the different partitions i should activate, since the sector numbers dont fit to eachother.

Sorry for that misunderstanding. While im sitting here and reading and reading a lot of stuff, my head starts missing sometimes.

Posted: **28 May 2025, 09:34**

Again, under the condition that the missing partition is not encrypted and that you either selected "Whole Disk" or the correct partition in PhotoRec that contains your missing data,

your failed Photorec recovery suggests total failure.

Obviously you either ignore or do not believe me as I stated this already above.

Your options as "ungläubiger Thomas" are:

1. Try out any other recovery software (they typically all provide free test modes)
2. Consult a professional recovery lab

cgsecurity.org

quickformated SSD and changed partitions, data rescue

quickformated SSD and changed partitions, data rescue

Re: Messed up my SSD

Re: quickformated SSD and changed partitions, data rescue

Re: quickformated SSD and changed partitions, data rescue

Re: quickformated SSD and changed partitions, data rescue

Re: quickformated SSD and changed partitions, data rescue

Re: quickformated SSD and changed partitions, data rescue

Re: quickformated SSD and changed partitions, data rescue

Re: quickformated SSD and changed partitions, data rescue