cgsecurity.org

So basically i accidently quick formatted my HDD and then immediately stopped
After i set the drive to read-only using diskpart,then i did a scan with TestDisk,so my HDD went from GPT to MBR for some reason after that quick format,it did find the primary partition and the recovery partition,however the primary partition had a damaged MFT,they were both detected as NTFS but TestDisk said "NTFS found using backup sector" on the primary partition

So here are the logs:"# Drive went from GPT to MBR (i tried doing a GPT partition scan,but it would have been way too slow,taking days)



Tue Feb 25 19:44:47 2025
Command line: TestDisk

TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3840755982336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=3839290729984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
Hard disk list
Disk \\.\PhysicalDrive0 - 3840 GB / 3576 GiB - CHS 466945 255 63, sector size=512 - SAMSUNG MZ7LM3T8HCJM-00003, S/N:S242NAAH500062, FW:GXT3003Q
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - JMicron Generic, S/N:0123456789ABCDEF, FW:0405

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - JMicron Generic
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 32 33 243201 45 44 3907024896
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 243201 45 44 3907024896
1 P FAT16 >32M 0 32 33 243201 45 44 3907024896
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 243070/195/5
filesystem size 3904692224
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 14 233 28 243070 195 5 3904692224
NTFS found using backup sector, blocksize=4096, 1999 GB / 1861 GiB
NTFS at 243070/195/6
filesystem size 2097152
sectors_per_cluster 8
mft_lcn 87381
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 243070 195 6 243201 78 13 2097152 [Recovery]
NTFS, blocksize=4096, 1073 MB / 1024 MiB

Results
* HPFS - NTFS 14 233 28 243070 195 5 3904692224
NTFS found using backup sector, blocksize=4096, 1999 GB / 1861 GiB
P HPFS - NTFS 243070 195 6 243201 78 13 2097152 [Recovery]
NTFS, blocksize=4096, 1073 MB / 1024 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Not an exFAT boot sector.

* HPFS - NTFS 14 233 28 243070 195 5 3904692224
NTFS found using backup sector, blocksize=4096, 1999 GB / 1861 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

* HPFS - NTFS 14 233 28 243070 195 5 3904692224
NTFS found using backup sector, blocksize=4096, 1999 GB / 1861 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
P HPFS - NTFS 243070 195 6 243201 78 13 2097152 [Recovery]
NTFS, blocksize=4096, 1073 MB / 1024 MiB
Directory /
5 dr-xr-xr-x 0 0 0 20-Nov-2024 10:33 .
5 dr-xr-xr-x 0 0 0 20-Nov-2024 10:33 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2023 01:31 Recovery
36 dr-xr-xr-x 0 0 0 11-Feb-2023 14:55 System Volume Information
40 -r--r--r-- 0 0 0 9-Oct-2024 14:24 $WINRE_BACKUP_PARTITION.MARKER
45 -r--r--r-- 0 0 0 20-Nov-2024 10:33 Recovery.txt
Not an exFAT boot sector.

* HPFS - NTFS 14 233 28 243070 195 5 3904692224
NTFS found using backup sector, blocksize=4096, 1999 GB / 1861 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 14 233 28 243070 195 5 3904692224
2 P HPFS - NTFS 243070 195 6 243201 78 13 2097152 [Recovery]
"

So i would like to know if this is recoverable,Im planning to send the drive to a professional,I really hope its recoverable

Thanks

XXXDark303 wrote: 18 Jun 2025, 17:41 So i would like to know if this is recoverable,Im planning to send the drive to a professional,I really hope its recoverable

You will be told your professional. I don't have a crystal ball.

Ok.
I just asked if this could be recoverable btw.