2 NFTS Partitions deleted

[x3dre]

I accidentally wiped my /dev/sda device which was my Windows Vista partiton..

Luckily I still have access to my debian partition to run testdisk and see if I can recover my lost files and partitions.

So far looking through some of testdisk funnctions I noticed both my MFT and MFT backups were corrupted..

I can see the files in my NTFS recovery partition but not in my NTFS OS partition where my data lives.

I'm now doing a deeper search and see what I can get if possible any of my data files back ..

So far I've run testdisk and have a log file.

I'll post if here and hopefully I can recover my data



Sat Dec 22 06:31:19 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.7-1.slh.1-aptosid-686 (#1 SMP PREEMPT Tue Dec 18 15:31:48 UTC 2012) i686
Compiler: GCC 4.6
Compilation date: 2012-01-16T23:06:01
ext2fs lib: 1.42.5, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sdc: LBA, LBA48, DCO support
/dev/sdc: size 488397168 sectors
/dev/sdc: user_max 488397168 sectors
/dev/sdd: LBA, LBA48, DCO support
/dev/sdd: size 488397168 sectors
/dev/sdd: user_max 488397168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Warning: can't get size for Disk /dev/md - 0 B - CHS 1 1 1 (RO), sector size=512
Hard disk list
Disk /dev/sda - 7904 MB / 7538 MiB - CHS 1020 244 62, sector size=512 - Generic USB Flash Disk, FW:8.07
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - TOSHIBA MK2552GSX, S/N:38DPT08XT, FW:LV011C
Disk /dev/sdd - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - TOSHIBA MK2552GSX, S/N:38DPT09FT, FW:LV011C

Partition table type (auto): Intel
Disk /dev/sdc - 250 GB / 232 GiB - TOSHIBA MK2552GSX
Partition table type: Intel

Analyse Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdc - 250 GB / 232 GiB - CHS 30402 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30402 255 63
NTFS at 28846/0/1
filesystem size 24981074
sectors_per_cluster 8
mft_lcn 170152
mftmirr_lcn 255229
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 28846 0 1 30400 254 62 24981074
NTFS, 12 GB / 11 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 28846 0 1 30400 254 63 24981075
NTFS, 12 GB / 11 GiB

interface_write()
1 * HPFS - NTFS 28846 0 1 30400 254 63 24981075
write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

[Fiona]

Might be necessary to run Deeper Search to have a look that your data partition will be at least found.
Currently your partition table is empty and I suppose that your found partition using Quick Search would be your Recovery partition.
Please copy the content of the testdisk.log if Deeper Search is finished.
If another partition would be found, please check it and press p to have a try to list your files.
Please let me know.

Fiona

[x3dre]

I get this after doing the deeper search in testdisk ..

Disk /dev/sda - 250 GB / 232 GiB - CHS 30402 255 63
Partition Start End Size in sectors
* HPFS - NTFS 0 1 1 28845 254 63 463410927 [OS]
>D HPFS - NTFS 28846 0 1 30400 254 62 24981074
D HPFS - NTFS 28846 3 22 30401 10 9 24981504 [HP_RECOVERY]

I press p and get two directories of

parent and child but alas no files..

.
..

But the testdisk.log has not updated itself from Saturday even though I today just completed deeper search ?

[Fiona]

Might be worth a try, to write your partitions into your partition table and afterwards to diagnose your boot sector to get access to your files.
Could I get some more infos about your found 2 directories?
Before you can do any boot sector recovery, you must write your partition into your partition table.
Infos will follow.

Fiona

[x3dre]

I have the log now... It's pretty large at 7.4 Mb so pasting it is not really workable ...

Plus the BB does not like upoads with extension like log or txt

What do you suggest ?

[Fiona]

Would it be possible to create some screen shot photos?
Easily press p to list your directories and save it either as jpg or gif.
It's not as big!

happy christmas

Fiona

[x3dre]

Hi Fiona

I'm doing the deep search again in terminal window that I can copy and paste the contents to a Jpeg or GIF ..

Kind regds

Dre

A merry Xmas to you too

[x3dre]

Hi Fiona

I hope this helps ?

Kind Regds

Dre

[x3dre]

Hi Fiona

Last Image file of lost OS partition files :-/

Kind Regds

Dre

[Fiona]

Your partition is empty.
Does not contain any data.
Looks like fresh formatted.
How did you wipe your disk?
Did you use any tools?
To exclude that you were overriding your files, you can use commercial datarecovery software as a trial and scan your disk to diagnose your files.
Also you can have a try to recover data using PhotoRec.
But it doesn't keep file names and directories.
You should save your data to an intact partition or disk.
Some Infos about PhotoRec;
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
http://www.cgsecurity.org/wiki/PhotoRec
Another good idea or hint might be, to use "File Opt" in PhotoRec.
You can press s to deselect all file types and mark only these, where you'd like to recover.
So it'll decrease the amount of files to sort, after recovery.

Please let me know.

Fiona