not achieved: Recovering 1 NTFS-Partition Topic is solved

[Arran]

Mint12 KDE

Hello

I do hope to find some help here.

I have unfortunately deleted a whole partition with all my grafics and viedos on it. I realised this immediately so did not change anything at all on this pratition. It is one of several NTFS-Partitions. The Bootsystem is on another HD, this one is only for various data. I do not have a Windows operating system on my computer.


First, I used Photorec to save all files onto another («graphic-recovery») partition:

Code: Select all

PhotoRec 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 1000 GB / 931 GiB (RO) - ATA SAMSUNG HD103SI
     Partition                  Start        End    Size in sectors
 8 L HPFS - NTFS          29062   1  1 74738 254 63  733800942 [grafic]

31678 files saved in /media/Reserve/recup_dir directory.
Recovery completed.
txt: 17074 recovered
jpg: 7346 recovered
mrw: 3173 recovered
wmf: 1857 recovered
png: 531 recovered
mpg: 487 recovered
xcf: 276 recovered
bmp: 240 recovered
gif: 204 recovered
mp3: 135 recovered
others: 355 recovered

This took over 26 hours...


Then I started with

Code: Select all

sudo testdisk

and followed the instructions to select various parameters.

Finally I landed here:

Code: Select all

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition                  Start        End    Size in sectors
 8 L HPFS - NTFS          29062   1  1 74738 254 63  733800942 [grafic]

Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.


[  Quit  ]  [  List  ]  [Rebuild BS]  [Repair MFT]  [  Dump  ]
                            Return to Advanced menu

What now?

Can anybody give me a good tip? It would be much nicer having the partition reinstitued than to look at all my files and build a new structure, rename each file and then send it to the right folder.

Thank you very much in advance.

[Fiona]

There is already a partition in your partition table.
But it doesn't use the whole space.
Is this correct?
If you deleted a partition, you should use Analyse, Quick and if no partition is found, Deeper Search.
If your partition is found, please press p to list your files.
If TestDisk finds your correct partition, you can write it into your partition table again.

Please copy infos from analyse and quick serach.
If necessary from Deeper Search too.

Fiona

[Arran]

Hi Fiona, thanks for your response.

Here the results from Analyse:

Code: Select all

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Linux                    0  32 33  3569 159 46   57344000 [Saline]
 2 * Linux                 3570   0  1  7770 254 63   67489065 [Debian]
 3 E extended LBA          7771   0 62 121600 254 63 1828678889

Bad relative sector.
 5 L HPFS - NTFS           7771   1  1 10323 254 63   41013882 [backup]

Bad relative sector.
   X extended             10324   0  1 16312 254 63   96213285
 6 L HPFS - NTFS          10324   1  1 16312 254 63   96213222 [anwender]

Bad relative sector.
   X extended             16313   0  1 29061 254 63  204812685
 7 L HPFS - NTFS          16313   1  1 29061 254 63  204812622 [audio]

Bad relative sector.
   X extended             29062   0  1 74738 254 63  733801005
 8 L HPFS - NTFS          29062   1  1 74738 254 63  733800942 [grafic]

Bad relative sector.
   X extended             74739   0  1 121600 254 63  752838030
 9 L HPFS - NTFS          74739   1  1 121600 254 63  752837967 [Reserve]

[Quick Search]  [ Backup ]
                            Try to locate partition

We are talking about Partition 8 (grafic)


Here the result of the Quick search:

Code: Select all

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121602 255 63
     Partition               Start        End    Size in sectors
* Linux                    0   1  1  3287 194 42   52817856 [Sabayon]
P Linux                 3287 194 44  7172 166 34   62410752 [SalineOS]
P HPFS - NTFS           7771   1  1 10323 254 63   41013882 [backup]
L HPFS - NTFS          10324   1  1 16312 254 63   96213222 [anwender]
L HPFS - NTFS          16313   1  1 29061 254 63  204812622 [audio]
L HPFS - NTFS          29062   1  1 74738 254 63  733800942 [grafic]
L HPFS - NTFS          74739   1  1 121600 254 63  752837967 [Reserve]

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS, 375 GB / 349 GiB

I now clicked on P and find the following:

Code: Select all

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
   L HPFS - NTFS          29062   1  1 74738 254 63  733800942 [grafic]
Directory /

dr-xr-xr-x     0     0         0 11-Oct-2010 17:12 .
dr-xr-xr-x     0     0         0 11-Oct-2010 17:12 ..

Use Right arrow to change directory, c to copy,
    q to quit

What is the correct one to choose? And then to copy?

[Fiona]

If you delete a partition, you'll have unallocated space.
But in your case there is already an empty partition.
Did you create and format another partition?
Because it's empty like a fresh formatted partition.
Identical creating of a partition and formatting, will override your previous file system.
Then, you'll need datarecovery software to carve your data from your underlying sectors.
But you already used PhotoRec.
Please don't write anything to your partition anymore.
In case you made something different, you can run Deeper Search.

Fiona

[Arran]

But in your case there is already an empty partition.

Which one? The only one I am interested in to recover ist partition 8 «grafic» and this one is definitively NOT empty, I have explained, that I have put with photorec all files there into the partition 9 «Reserve». Except the manipulation with photorec and the above ones I have not touched this partition at all.

And yes, I have formated the partition Debian after the deleting orgy...

Do you think, all is lost or should I run the DeepSeaSearch?

[Fiona]

I have unfortunately deleted a whole partition with all my grafics and viedos on it. I realised this immediately so did not change anything at all on this pratition.

Has been your description.
If you delete a partition, this partition will be deleted out of your partition table also.
Then you should have unallocated space only.
But here are some infos from your partition table;

Current partition structure:
Partition Start End Size in sectors

1 P Linux 0 32 33 3569 159 46 57344000 [Saline]
2 * Linux 3570 0 1 7770 254 63 67489065 [Debian]
3 E extended LBA 7771 0 62 121600 254 63 1828678889

Bad relative sector.
5 L HPFS - NTFS 7771 1 1 10323 254 63 41013882 [backup]

Bad relative sector.
X extended 10324 0 1 16312 254 63 96213285
6 L HPFS - NTFS 10324 1 1 16312 254 63 96213222 [anwender]

Bad relative sector.
X extended 16313 0 1 29061 254 63 204812685
7 L HPFS - NTFS 16313 1 1 29061 254 63 204812622 [audio]

Bad relative sector.
X extended 29062 0 1 74738 254 63 733801005
8 L HPFS - NTFS 29062 1 1 74738 254 63 733800942 [grafic]

Bad relative sector.
X extended 74739 0 1 121600 254 63 752838030
9 L HPFS - NTFS 74739 1 1 121600 254 63 752837967 [Reserve]

[Quick Search] [ Backup ]

Do you have any idea why your partition grafic is listed, if it's deleted?
Also you tried to list your data;

L HPFS - NTFS 29062 1 1 74738 254 63 733800942 [grafic]
Directory /

dr-xr-xr-x 0 0 0 11-Oct-2010 17:12 .
dr-xr-xr-x 0 0 0 11-Oct-2010 17:12 ..

It's empty.
I see not even any piece of data.
It looks empty.
Do you have any explanation?

Of course I try to diagnose each possibility.
But if there are some questions, they should be solved also.
For example, if you created an identical partition and formatted it, you have overriden your previous file system.
Then you need data recovery software.
Otherwise if you are sure, that you only deleted it, you can run Deeper Search to have a try to get different results.

Fiona

[Arran]

Thank you Fiona.

I am sure, the data must be there on Partition 8, they have however been «photorec'd» onto partition 9. And:

For example, if you created an identical partition and formatted it, you have overriden your previous file system.

The now partition 9 has been kept as a unformatted reserve space on the HD. I did the NTFS-formatting only after the desaster. And with due care not to touch any other partition with KPartitioner.

I will now start a Deep Search and come back with the result.

[Arran]

Hello

The Deep Search has now gone through, see screenshot. The partition concerned is highlighted.

What should I do now?

[Fiona]

Deeper Search didn't find anything else.
I assume that your partition is still empty and looks like freshly formatted.
Your data are probably available in your underlying sectors.
It means that you need datarecovery software.
You can test PhotoRec.
Select in PhotRec your affected partition and scan it.
Please use version 6.14 32-bit.
For photos, music etc.. it's mostly ok.
If you need directories and file names. you should test commercial software.

Fiona

[Arran]

I will try a last straw:

To install my old XP with the PC-Inspector.

To do that I will first take the power cable off the two HDs and add a third empty NTFS-formatted one. With a fresh Start with the XP file in the computer, I can easily install XP again. I have another free slot and a second 40-pin bar on that wide cable.

I will probably, once XP is installed again, use it to print photos with my HP Photosmart D6160. The Linux Drivers are not half as good as the Windows one, for instance I have a postcard tray which worked perfectly in Windows but I can not get it to work with hplip.

So, unless somebody has another very good way to restore that partition, I will come back in a couple of weeks to give you my results.

Thanks a lot for your help.

At least it was a steep learning phase. That is the good side of it all.