Partition/Data Recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
unkool
Posts: 4
Joined: 27 Jul 2013, 23:14

Partition/Data Recovery

#1 Post by unkool »

Greetings all,

Please have a look at the quick search for partitions, as I have no idea what and how this happened. Please help as this is my only backup :(

Code: Select all

TestDisk 6.14-WIP, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
   EFI System                    40     409639     409600 [EFI]
   MS Data                     2048  273489919  273487872
   MS Data                135538083  135544256       6174
   MS Data                135544256  135550429       6174 [Boot]
   MS Data                135550544  135571282      20739 [NO NAME]
   MS Data                273489919  546977790  273487872
 P Mac HFS                691853376  691893391      40016
 P Mac HFS                693108770  693120689      11920
 P Mac HFS                697198080  704537335    7339256
 P Mac HFS                717000176  718897775    1897600
 P Mac HFS                745925120  745926143       1024
 P Mac HFS                750627972  763785915   13157944
 P Mac HFS                769154560  769224191      69632
 P Mac HFS                769236520  771611723    2375204
   MS Data                810092051  810098224       6174
   MS Data                810098224  810104397       6174 [Boot]
 P MS Data                810104512  810125250      20739 [NO NAME]
 P MS Data                822943388  822946267       2880 [PCD50BD]
 P MS Data                822946268  822950067       3800
 P MS Data                822950068  822996147      46080
 P MS Data                822996148  823042227      46080
 P MS Data                823042228  823045107       2880 [IBM DFT]
 P MS Data                823052412  823055291       2880
 P MS Data                823058515  823066794       8280 [Compressed]
 P MS Data                838397824  838400703       2880 [EFISECTOR]
   MS Data                838401631  838407804       6174
   MS Data                838407804  838413977       6174 [Boot]
 P MS Data                844667980  844670859       2880 [EFISECTOR]
 P MS Data                844670860  844673739       2880 [EFISECTOR]
 P Mac HFS               1142753792 1142754815       1024
 P Mac HFS               1142755324 1142756347       1024
 P Mac HFS               1142761984 1142763007       1024
 P Mac HFS               1142763516 1142764539       1024
 P Mac HFS               1142768640 1142769663       1024
 P Mac HFS               1142770172 1142771195       1024
 P Mac HFS               1142776320 1142777343       1024
 P Mac HFS               1142777852 1142778875       1024
 P Mac HFS               1142784000 1142785023       1024
 P Mac HFS               1142785532 1142786555       1024
 P Mac HFS               1142791680 1142792703       1024
 P Mac HFS               1142793212 1142794235       1024
 P Mac HFS               1142798336 1142799359       1024
 P Mac HFS               1142799868 1142800891       1024
 P Mac HFS               1142804992 1142806015       1024
 P Mac HFS               1142806524 1142807547       1024
 P Mac HFS               1142811648 1142812671       1024
 P Mac HFS               1142813180 1142814203       1024
 P Mac HFS               1142819328 1142820351       1024
 P Mac HFS               1142820860 1142821883       1024
 P Mac HFS               1142825984 1142827007       1024
 P Mac HFS               1142827516 1142828539       1024
 P Mac HFS               1142833152 1142834175       1024
 P Mac HFS               1142834684 1142835707       1024
 P Mac HFS               1144775680 1144776703       1024
 P Mac HFS               1144806400 1144807423       1024
 P Mac HFS               1144807932 1144808955       1024
 P Mac HFS               1144814592 1144815615       1024
 P Mac HFS               1144816124 1144817147       1024
 P Mac HFS               1144821248 1144822271       1024
 P Mac HFS               1144822780 1144823803       1024
 P Mac HFS               1144828928 1144829951       1024
 P Mac HFS               1144830460 1144831483       1024
 P Mac HFS               1144836608 1144837631       1024
 P Mac HFS               1144838140 1144839163       1024
 P Mac HFS               1144844288 1144845311       1024
 P Mac HFS               1144845820 1144846843       1024
 P Mac HFS               1144850944 1144851967       1024
 P Mac HFS               1144852476 1144853499       1024
 P Mac HFS               1144857600 1144858623       1024
 P Mac HFS               1144859132 1144860155       1024
 P Mac HFS               1144864256 1144865279       1024
 P Mac HFS               1144865788 1144866811       1024
 P Mac HFS               1144871936 1144872959       1024
 P Mac HFS               1144873468 1144874491       1024
 P Mac HFS               1144878592 1144879615       1024
 P Mac HFS               1144880124 1144881147       1024
 P Mac HFS               1144885760 1144886783       1024
 P Mac HFS               1144887292 1144888315       1024
 P Mac HFS               1146965504 1146966527       1024
 P MS Data               1149527905 1157897779    8369875 [^KM-(M-x^O^R^LM-;M->~
 P Mac HFS               1168335104 1168360143      25040
 P EFI System            1168419496 1168829095     409600 [EFI]
 P Mac HFS               1184041300 1602799875  418758576
 P MS Data               1795331496 1953525134  158193639 [NEW VOLUME]
Top
User avatar
AlexZvezdev
Posts: 3
Joined: 28 Jul 2013, 09:33

Re: Partition/Data Recovery

#2 Post by AlexZvezdev »

what was the proper FS of this backup? - FS=file sistem :shock:
Top
unkool
Posts: 4
Joined: 27 Jul 2013, 23:14

Re: Partition/Data Recovery

#3 Post by unkool »

It was previously HFS I guess, for mac. But since then formatted to NTFS and exFAT :s
Top
User avatar
AlexZvezdev
Posts: 3
Joined: 28 Jul 2013, 09:33

Re: Partition/Data Recovery

#4 Post by AlexZvezdev »

ok, but the data you need are on what kind of FS?
Top
unkool
Posts: 4
Joined: 27 Jul 2013, 23:14

Re: Partition/Data Recovery

#5 Post by unkool »

One of them is in this, which is around 140GB:
"MS Data 135550544 135571282 20739 [NO NAME]"

And the other is missing, which is around 791GB.

Partition table is defaulted as EFI GPT, but the results posted below is using INTEL. Currently re-analyzing it, at 33%, it'll take another day to complete.
But strangely, I haven't found any one of the listed partition s 791GB. :s All broken up into these tiny little pieces.
Top
User avatar
AlexZvezdev
Posts: 3
Joined: 28 Jul 2013, 09:33

Re: Partition/Data Recovery

#6 Post by AlexZvezdev »

weird, tell us more, how all that happened?

Was it ok, is it on a kind of RAID or sPlit?
Top
unkool
Posts: 4
Joined: 27 Jul 2013, 23:14

Re: Partition/Data Recovery

#7 Post by unkool »

It all started with my win7 laptop failed to boot up. I then used ubuntu live cd (usb) to copy files over to the 1TB ext-hdd in question. But then I didnt know that the greyed-out "Paste" button is still functional. So I used dd command to clone one of the un-encrypted drive from the laptop to one of the drive in the ext-hdd. That said, it overwrites the first 200 or so MB of the drive, in which I then halted the dd. And managed to delete/undelete the 140GB partition.

After some help decrypting the other two partitions for the laptop, I managed to copy all of the data from the 3 partitions on the laptop and the 140GB partition from the ext-hdd to the 791GB partition on the ext-hdd.

Then here comes trouble. After rebooting into ubuntu, the 791GB partition shows up as GPT and not formatted. I then tried to convert it to MBR and partition shows up as RAW. Did the delete/undelete partition using partition manager again but that was unsuccessful.

Then I stumbled upon testdisk. And thats the result of my 4 days journey to salvage my data :( All my files are in the 791GB partition, and now its somehow gone.
Top
Locked

Return to “Partition Recovery”