undo a format of NTFS

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Posts: 2
Joined: 01 Dec 2013, 21:04

undo a format of NTFS

#1 Post by ktbos »

I've got a hard drive that has a SMART failure so my plan was to clone the data to a new hard drive (using Clonezilla). I created the disk image and stored it on a spare drive that happened to be Ubuntu and I chose "tmp" a the storage directory. When I booted into Ubuntu to check the image size, it was gone - because booting cleans out the tmp directory! Aigh! And since Ubuntu wrote new temp files into the tmp directory on boot, photorec was unable to find the complete image file to restore - double Aigh!!

Unfortunately, I had already begun cleaning the broken disk out (the image was created, after all!) so I had deleted or reformatted the only partition I cared about (I can't remember what I did since it didn't really matter at the time). Now, I want to get that partition back to do a proper image creation (and store the new image file somewhere other than in "tmp"!!

Using testdisk, I was able to get the partition back and all 4 of HP's factory created partitions are there and working. (With the exception of an occasional read error, presumably because of the SMART error.) The problem is that all the files are in the 3 partitions that I don't need, but the one partition I need, the "C" drive, has only two things in it: "$RECYCLE.BIN" and "System Volume Information", as though it was initialized by Windows (which it wasn't - it was Clonezilla). I have done the deeper search and it doesn't come up with anything more.

I did try photorec, but that's not what I'm looking for - I don't need individual files since I have a backup of the user data. What I need is to undo the format operation to get the partition back to where it was to do the image creation again so that hopefully I can do an image restore and be back where I was on a new disk.

Can I use testdisk to get the partition back the way it was? Fortunately, I didn't do anything crazy like write zeros to the disk so the data should still be there, right? Does the fact that testdisk only finds those two directories mean the other stuff is gone and can only retrieved with something like photorec as parts of files? Or can I effectively undo that format/delete of the partition to put things back the way it was? Thanks for any advice.

FYI, it's an HP laptop running Windows 7 64-bit. The hard drive is a 750 Gbyte drive with the C partition using most of the space although only 100 Gbyte of space is used. HP sets up the partitions as described here: http://h30434.www3.hp.com/t5/Other-Note ... 193#M28401. testdisk started off with 1 head, 1 sector, and 512 sector size but I found that switching to 255/63/512 worked best. (Since the drive appears to be "advanced format", I tried 255/63/4096 but that didn't seem to work as well.)

Posts: 2
Joined: 01 Dec 2013, 21:04

Re: undo a format of NTFS

#2 Post by ktbos »

For kicks I did run a PhotoRec session on the drive. It took a day and a half to recover lots (1000s) of files. As expected, they are not in a form that is usable as an OS partition. But it is proof that the file data is there.

And yet TestDisk is pretty insistent that the file data is not in the partition it used to be in.

With those two results, is the following conclusion correct?: The partition data that would allow access to the lost file data is now permanently lost, presumably overwritten with the new partition data that, while correctly showing partition size, doesn't have the structure to allow access to the lost data.

(I suspect my problem was in rebuilding the boot sector before I had the correct geometry set and that redefined the partition to be the way it is now, without the file data I was hoping to gain access to.)