cgsecurity.org

Hi,

I am new to this forum, I have WD My Passport portable 2TB hdd which was by mistake formatted for couple of minutes on a D2H recorder. (Connected hdd to record TV programs but the settop box started formatting the harddisk) after noticing the hdd is being formatted I quickly within a minute removed the hdd from settop box but the damage was already done. Now when I connect the hdd to TV it just shows the folders but no contents in it and when I connect it to the laptop it got installed but does not show any drives.

I tried using recovery tool testdisk photorec_win - proceed by selecting 2000 GB hdd. I am getting following result.
I am not sure how to proceed further please help.

PhotoRec 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 2000 GB / 1862 GiB (RO) - WD My Passport 0748

Partition Start End Size in sectors
Unknown 0 0 1 243197 57 60 3906963456 [Whole disk]
> P FAT32 0 0 1 243197 57 60 3906963456


>[ Search ] [Options ] [File Opt] [ Quit ]
Start file recovery

Run TestDisk, select the disk, select PC/Intel partition table type, Analyse, Quick Search, Stop, Deeper Search, Stop,
use 'p' to list the files of each partition. If you can see your files, set this partition as P(rimary). On Next screen, choose Write, confirm. If asked, choose BackupBS and confirm.
Please post the testdisk.log file content if you have problems.

I have run testdisk_win.exe and followed your steps. Got attached log file.
Deep search takes around 7 to 8 hours to complete so I did not complete that and stopped it immediately after it started. I have completed it before but have not saved the old log file. Once deep search is complete it shows one more partition FAT32 of around 850 GB. I am confused why it shows two partitions one NTFS with 2000 GB and the other with FAT32 850 GB after deep search even though the disk is of 2000 GB.

Please guide me thanks..

Hi After complete Deep search I got following results.

TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
Partition Start End Size in sectors
>D HPFS - NTFS 0 32 33 243197 57 60 3906961408
D FAT16 LBA 51207 96 29 154957 79 56 1666742707

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, blocksize=4096, 2000 GB / 1862 GiB

When I check option P to list file details for first HPFS-NTFS partition getting following screen.

TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
HPFS - NTFS 0 32 33 243197 57 60 3906961408
Directory /

>dr-xr-xr-x 0 0 0 27-Oct-2013 09:35 .
dr-xr-xr-x 0 0 0 27-Oct-2013 09:35 ..
dr-xr-xr-x 0 0 0 11-Oct-2013 11:39 $RECYCLE.BIN
dr-xr-xr-x 0 0 0 1-Sep-2013 09:36 LOST.DIR
dr-xr-xr-x 0 0 0 23-Jul-2013 11:10 Mahabharat
dr-xr-xr-x 0 0 0 17-Apr-2013 19:41 Movies
dr-xr-xr-x 0 0 0 27-Oct-2013 09:34 Music
dr-xr-xr-x 0 0 0 23-May-2013 21:24 Nasir
dr-xr-xr-x 0 0 0 27-Apr-2013 23:41 Photoshop
dr-xr-xr-x 0 0 0 27-Oct-2013 09:37 Pradyumna
dr-xr-xr-x 0 0 0 27-Oct-2013 09:54 RawFud
dr-xr-xr-x 0 0 0 27-Oct-2013 09:38 Softwares
dr-xr-xr-x 0 0 0 17-Apr-2013 22:33 System Volume Information
dr-xr-xr-x 0 0 0 5-Jun-2013 19:22 Videos
-r--r--r-- 0 0 232960 7-Nov-2007 08:12 VC_RED.MSI
Next
Use Right to change directory, h to hide Alternate Data Stream
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file

For second partition FAT16 following options are displayed.

TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
FAT16 LBA 51207 96 29 154957 79 56 1666742707
Directory /

>dr-xr-xr-x 0 0 2745585204 1-Sep-2017 04:32 ??Z3??_?.?m?
drwxr-xr-x 0 0 4078874590 24-Mar-1938 09:08 xM?C????.^T4 -r
-xr-xr-x 0 0 2317282791 19-Jan-1920 23:42 @?Q?_^YV?.-B? -r
wxr-xr-x 0 0 3297146008 11-Jan-1999 10:19 ?? dr
-xr-xr-x 0 0 3608739535 14-Jan-2010 07:11 ?I?,?^?^K?.(?? -r
wxr-xr-x 0 0 3184462837 13-Dec-1930 19:38 -r
-xr-xr-x 0 0 1182223494 15-Apr-1985 02:14 ????<#?D.@x? drw
xr-xr-x 0 0 1000073803 28-Mar-1921 19:12 ??k^\????.N^Z? -r
-xr-xr-x 0 0 1226039317 5-May-1945 23:40 C??^X????.???

Next Use
Right to change directory, h to hide deleted files
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file

Please guide me on how to proceed ahead with recovering partitions and data.
Thanks in advance.

Following is logged in testdisk file




Sun Apr 12 08:42:51 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-04-05T19:50:39
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=477413507072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=21599617024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=39942144
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-1DG142, S/N:S3PF57LE, FW:1003YAM1
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Passport 0748, S/N:WXL1E92LMJU3, FW:1019
Drive E: - 39 MB / 38 MiB - CHS 9 64 32, sector size=2048 - hp DVDRAM GU90N, FW:U901

Partition table type (auto): None
Disk /dev/sdb - 2000 GB / 1862 GiB - WD My Passport 0748
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63
NTFS at 0/32/33
filesystem size 3906961408
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243197 57 60 3906961408
NTFS, blocksize=4096, 2000 GB / 1862 GiB
file_pread(5,8,buffer,3906963456(243197/57/61)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,3906963456(243197/57/61)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,3906963457(243197/57/62)) lseek err Invalid argument
file_pread(5,14,buffer,3906963458(243197/57/63)) lseek err Invalid argument
file_pread(5,3,buffer,3906963472(243197/58/14)) lseek err Invalid argument
file_pread(5,3,buffer,3906963519(243197/58/61)) lseek err Invalid argument
file_pread(5,8,buffer,3906963535(243197/59/14)) lseek err Invalid argument
file_pread(5,11,buffer,3906963582(243197/59/61)) lseek err Invalid argument
file_pread(5,2,buffer,3906965504(243197/90/30)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243197 57 60 3906961408
NTFS, blocksize=4096, 2000 GB / 1862 GiB


dir_partition inode=5
* HPFS - NTFS 0 32 33 243197 57 60 3906961408
NTFS, blocksize=4096, 2000 GB / 1862 GiB
Directory /
5 dr-xr-xr-x 0 0 0 27-Oct-2013 09:35 .
5 dr-xr-xr-x 0 0 0 27-Oct-2013 09:35 ..
35 dr-xr-xr-x 0 0 0 11-Oct-2013 11:39 $RECYCLE.BIN
74761 dr-xr-xr-x 0 0 0 1-Sep-2013 09:36 LOST.DIR
49 dr-xr-xr-x 0 0 0 23-Jul-2013 11:10 Mahabharat
43 dr-xr-xr-x 0 0 0 17-Apr-2013 19:41 Movies
37151 dr-xr-xr-x 0 0 0 27-Oct-2013 09:34 Music
4016 dr-xr-xr-x 0 0 0 23-May-2013 21:24 Nasir
74078 dr-xr-xr-x 0 0 0 27-Apr-2013 23:41 Photoshop
449 dr-xr-xr-x 0 0 0 27-Oct-2013 09:37 Pradyumna
98960 dr-xr-xr-x 0 0 0 27-Oct-2013 09:54 RawFud
38 dr-xr-xr-x 0 0 0 27-Oct-2013 09:38 Softwares
43438 dr-xr-xr-x 0 0 0 17-Apr-2013 22:33 System Volume Information
171 dr-xr-xr-x 0 0 0 5-Jun-2013 19:22 Videos
80108 -r--r--r-- 0 0 232960 7-Nov-2007 08:12 VC_RED.MSI
80109 -r--r--r-- 0 0 1442522 7-Nov-2007 08:09 VC_RED.cab
74240 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.1028.txt
74241 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.1031.txt
74242 -r--r--r-- 0 0 10134 7-Nov-2007 08:00 eula.1033.txt
74244 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.1036.txt
74245 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.1040.txt
74246 -r--r--r-- 0 0 118 7-Nov-2007 08:00 eula.1041.txt
74247 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.1042.txt
74239 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.2052.txt
74243 -r--r--r-- 0 0 17734 7-Nov-2007 08:00 eula.3082.txt
74248 -r--r--r-- 0 0 1110 7-Nov-2007 08:00 globdata.ini
74249 -r--r--r-- 0 0 562688 7-Nov-2007 08:03 install.exe
74250 -r--r--r-- 0 0 843 7-Nov-2007 08:00 install.ini
74231 -r--r--r-- 0 0 76304 7-Nov-2007 08:03 install.res.1028.dll
74232 -r--r--r-- 0 0 96272 7-Nov-2007 08:03 install.res.1031.dll
74233 -r--r--r-- 0 0 91152 7-Nov-2007 08:03 install.res.1033.dll
74235 -r--r--r-- 0 0 97296 7-Nov-2007 08:03 install.res.1036.dll
74236 -r--r--r-- 0 0 95248 7-Nov-2007 08:03 install.res.1040.dll
74237 -r--r--r-- 0 0 81424 7-Nov-2007 08:03 install.res.1041.dll
74238 -r--r--r-- 0 0 79888 7-Nov-2007 08:03 install.res.1042.dll
74230 -r--r--r-- 0 0 75792 7-Nov-2007 08:03 install.res.2052.dll
74234 -r--r--r-- 0 0 96272 7-Nov-2007 08:03 install.res.3082.dll
74252 -r--r--r-- 0 0 5686 7-Nov-2007 08:00 vcredist.bmp

interface_write()
1 * HPFS - NTFS 0 32 33 243197 57 60 3906961408

Choose to write this NTFS partition!