Recovering external disk WD Elements 1TB 2.5" (NTFS)

How to use TestDisk to recover lost partition
Post Reply
Message
Author
blacknail
Posts: 3
Joined: 16 Jul 2014, 18:47

Recovering external disk WD Elements 1TB 2.5" (NTFS)

#1 Post by blacknail » 19 Jul 2014, 20:12

Hello all,

Some days ago, I've stupidly performed a dd command with the wrong drive (and yes, I know it's just plain ridiculous). In practical terms, what I accidentally did was convert my WD Elements 1TB 2.5" external drive into a CentOS live DVD, when the objective was to do it on a 2GB pen drive. More precisely, the command used was this:

Code: Select all

sudo dd if=CentOS-6.5-i386-LiveDVD.iso of=/dev/sdc
After that, I can "see" the drive in Linux Mint, but I can't mount it ("Unable to mount location / Can't mount file" pop-up) nor see it's contents. By the way, the drive was originally formatted in NTFS.

After googling a little, I found out about TestDisk and PhotoRec. I've already followed this useful tutorial ( http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step ), but after performing either a Quick Search and a Deeper Search, it found out nothing. After that, I've tried PhotoRec, and it did indeed found / recovered several files. The problem is, as you already know, that PhotoRec does recover files but doesn't keep their original names nor their folder structure. For me, this is impossible to deal with, because while a great part of the data in the drive is negligible, there are two folders that are extremely important for me - and if for one of them I have a fresh backup, for the other one I only have a backup dated several months. In each of both directories, there are hundreds of thousands of files to be recovered, so I urgently need to recover the files with their initial directory hierarchy, or at least with their original names. So, is it possible to achieve this in TestDisk or PhotoRec (or even with other linux tool that you can kindly recommend me)? I've attached some screenshot steps (1 to 5), to illustrate what I just have written above. You can see that in 2.png, I've chosen the partition table type as "None", because of the hint that TestDisk gave me. Say what you think about this, please. And many thanks for reading, of course. If you can help, I'll be deeply grateful.

João
Attachments
testdisk_tutorial_screenshots_steps_4-5.zip
(110.63 KiB) Downloaded 53 times
testdisk_tutorial_screenshots_steps_1-3.zip
(217.12 KiB) Downloaded 52 times

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovering external disk WD Elements 1TB 2.5" (NTFS)

#2 Post by Fiona » 20 Jul 2014, 06:50

Did you already overwrite data?
In case, your file system might be damaged and overridden data are not recoverable anymore.
If your file system is too much damaged, testdisk wouldn't be able to list any files of your previously affected partition.
Partition table type None leads to a result that only your Live CD appears, because a DVD/CD hasn't a MBR and a partition table.
Might be a result of your clone that testdisk recognizes your disk as a Live-CD.
Can you run partition table type Intel and "Deeper Search".
Deeper Search searches for partitions using the backup of the boot sector.
The backup of the boot sector is at the end of your previous NTFS partition.
Please copy and paste the content of you testdisk log into your next post.

Fiona

blacknail
Posts: 3
Joined: 16 Jul 2014, 18:47

Re: Recovering external disk WD Elements 1TB 2.5" (NTFS)

#3 Post by blacknail » 22 Jul 2014, 01:13

Thanks for the reply, FIona! As far as I know, the only data written to the disk is the one concerning the Live DVD. I'm already running a Quick Search with partition table type Intel, it will take a couple of hours, when it ends I'll run a Deeper Search and let you know. I'll also copy the content of the log file.

Thanks again,
João

blacknail
Posts: 3
Joined: 16 Jul 2014, 18:47

Re: Recovering external disk WD Elements 1TB 2.5" (NTFS)

#4 Post by blacknail » 26 Jul 2014, 14:40

Hello again,

Here are the screenshots and the log files (testdisk.log + backup.log) attached. The Quick and Deeper Search didn't found any partition, *however* (and as you can see in the 3rd screenshot) after selecting Intel as the partition table type, the Analyse option returned two invalid (hidden?) NTFS boots, that seem similar. Do you think is still possible to recover the folder hierarchy, or at least the files names'?

Greetings.
João
Attachments
logs.zip
(1.14 KiB) Downloaded 51 times
screenshots_4-6.zip
(128.69 KiB) Downloaded 56 times
screenshots_1-3.zip
(178.32 KiB) Downloaded 54 times

Post Reply

Who is online

Users browsing this forum: Google Adsense [Bot] and 2 guests