Overwritten Partition Table

[philffm]

Recently I wanted to install XBMC on a SD Card (for my Raspberry Pi), followed the Instructions where was mentioned that the device letter is /dev/sdb usually. Usually, i have a look on the mount points but in this situation i just wanted to do it fast. It was an automated script which wipes everything on the disk including the partition table (?) to install the xbmc distribution. As I noticed afterwards, my external HDD was mounted at /dev/sdb and the SD card at /dev/sdd.
That means a massive data loss.
TestDisk didn't find any partitions (as I expected because of the overwritten table).
So what can I do? Before it was NTFS, now it's splitted in a System Partition (FAT) which has a size of 124mb and a Data Partition that takes the whole other space (1TB HDD)

Thank you in advance, Phil

[Fiona]

How is your disk listed in your disk management console.
Since W2k windows requires a signatur from 4 Bytes to handle it.
Please let me know, is your disk initialized in your disk management console.
If it's not initialized, please initialize it and run Deeper Search in TestDisk.
Please use TestDisk 6.14WIP and the 32 bit version.

Fiona

[muggi]

hehe, well I'm not the only one that stupid then, as i did the same.

Also a sdb when it should have been a sdd.

My hdd is a 3tb, so its was set up as a GPT disk , and formatted as NTFS. I then did the same as TS.

I first did the quicksearch in testdisk under linux, and it found the system partition of 124 mb created by Openelec.
It also found very easy a 3 tb partition (my old ntfs partition).
I was able to do a file list within testdisk and take a backup of data not backed up yet.

So the data seems to be fine.

i then tried to do the "write" command (the 3tb partition found had a P in front of it (primary part.))

But it seems like its not 100 % working as the 124mb partition still is there, and when trying to boot up,
the Pc hangs at the boot before even trying to get in to the bios.

I unplug the 3tb, as it is not an OS disk, i can then boot fine into the Pc. I plug the 3 tb to the pc after booting.

I am now under windows 7, where the disk management gives me this info for the HD:
129 mb unallocated
2048 gb RAW healthy (active, primary partition)
746,39 gb unallocated

so my question is, is it possible to recreate the old partition, as openelec only did a 127 mb write to the Hd after making changes to the partiotion table. I dodnt know if and how i should delete the 127 mb partition.

Im trying deeper search now, where its says this now:
check_FAT: unusual number of reserved sectors 4 (fat), should be 1.

It also give me a size error for the "old" partition in the LOG file now, see below


Latest Log from testdisk after i tried to write the partition

Code: Select all

Sun Jan  6 09:31:18 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, December 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.17
Compilation date: 2012-12-29T10:02:51
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=75385274368
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1529856
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - INTEL SSDSA2CW080G3, S/N:564352503031353832305a50383042304e472020, FW:4PC10362
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:202020202020202020202020315a304639573039, FW:CC4B
Drive E: - 1529 KB / 1494 KiB - CHS 1 64 32, sector size=2048 - DTSOFT BDROM, FW:1.05

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM001-9YN166
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 1565300736 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 1565300736 > partition 4294967295
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS             16 113 34 267365 202 36 4294967295
 1 * HPFS - NTFS             16 113 34 267365 202 36 4294967295

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
FAT16 at 0/32/33
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
FAT1 : 4-255
FAT2 : 256-507
start_rootdir : 508
Data : 540-255999
sectors : 256000
cluster_size : 4
no_of_cluster : 63865 (2 - 63866)
fat_length 252 calculated 250

FAT16 at 0/32/33
     FAT16 >32M               0  32 33    16  15 63     256000 [System]
     FAT16, blocksize=2048, 131 MB / 125 MiB
NTFS at 16/113/34
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 364801  66  1 5860268032 [HD45_seagate_3TB]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(5,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,2,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565567039(364801/99/34)) lseek err Invalid argument
file_pread(5,2,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565565952(364801/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1565565952(364801/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1565566080(364801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1565566208(364801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1565566336(364801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,1565566464(364801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1565566592(364801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,1565566720(364801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,1565566848(364801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,1565566984(364801/98/42)) lseek err Invalid argument
file_pread(5,3,buffer,1565566992(364801/98/50)) lseek err Invalid argument
file_pread(5,3,buffer,1565567039(364801/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,1565567055(364801/99/50)) lseek err Invalid argument
file_pread(5,11,buffer,1565567102(364801/100/34)) lseek err Invalid argument
file_pread(5,2,buffer,1565569024(364801/131/3)) lseek err Invalid argument

Results
   * FAT16 >32M               0  32 33    16  15 63     256000 [System]
     FAT16, blocksize=2048, 131 MB / 125 MiB
   P HPFS - NTFS             16 113 34 364801  66  1 5860268032 [HD45_seagate_3TB]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

interface_write()
 1 * FAT16 >32M               0  32 33    16  15 63     256000 [System]
 2 P HPFS - NTFS             16 113 34 364801  66  1 5860268032 [HD45_seagate_3TB] 

[muggi]

edit reason : double post

[muggi]

sorry, found a solution my self.

[gtree]

sorry, found a solution my self.

Would you mind sharing your own solution? Thanks!

[philffm]

Yes! I would be very thankful for this solution. I don't actually remember if it was msdos or GUID Partition Table.