Recover (accidentally) Formatted Partition /w LOG

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Matej
Posts: 2
Joined: 17 Sep 2015, 14:04

Recover (accidentally) Formatted Partition /w LOG

#1 Post by Matej »

Hi there,
I believe this problem should be solvable, but I have only little practical experience so all comments are very welcome :)

In the process of migrating into a new computer I accidentally reformatted my 30 GB SD disk from NTFS to EXT4. It contained just data and no OS. So afterwards I made an image of the disk and restored it in the new computer. It's the /dev/sda10 (the partition is larger than the original image).
gparted.png
gparted.png (164.61 KiB) Viewed 1741 times
I can only run deep search on the whole disk and not just for one partition (sorry about the mess). What I want is to identify and recover the partition that used to be there instead of sda10 ext4. It must be a 30GB NTFS partition within the boundaries of sda10. I'm not very familiar with the sector count so I'm not certain which of the listed NTFS partitions is of the right size and located at the right place.

This is the log:

Code: Select all

Results
   * FAT32                    0  32 33    63 221 30    1024000 [ESP]
     FAT32, blocksize=4096, 524 MB / 500 MiB
   P FAT32                   63 221 31    68 246 50      81920 [DIAGS]
     FAT32, blocksize=512, 41 MB / 40 MiB
     HPFS - NTFS             85  72 52   346  94  4    4194304 [WINRETOOLS]
     NTFS, blocksize=4096, 2147 MB / 2048 MiB
     HPFS - NTFS            346  94  4   607 115 19    4194304
     NTFS, blocksize=4096, 2147 MB / 2048 MiB
     HPFS - NTFS            346  94  5  7995  75 16  122880000 [OS]
     NTFS, blocksize=4096, 62 GB / 58 GiB
     HPFS - NTFS            346  94  5 31130 223  5  494553088 [OS]
     NTFS found using backup sector, blocksize=4096, 253 GB / 235 GiB
     HPFS - NTFS            346  94 12  7995  75 16  122879993
     NTFS found using backup sector, blocksize=4096, 62 GB / 58 GiB
     Linux                 7995  75 17 13758 161 35   92588032
     ext4 blocksize=4096 Large file Sparse superblock Recover, 47 GB / 44 GiB
     Linux                10209  70 38 15972 156 56   92588032
     ext4 blocksize=4096 Large file Sparse superblock Recover, 47 GB / 44 GiB
     Linux                10212 248 21 15976  79 39   92588032
     ext4 blocksize=4096 Large file Sparse superblock Recover, 47 GB / 44 GiB
     Linux                10216 236  5 15980  67 23   92588032
     ext4 blocksize=4096 Large file Sparse superblock Recover, 47 GB / 44 GiB
     Linux                10217   1  1 15980 254 63   92598597
     ext4 blocksize=4096 Large file Sparse superblock Recover, 47 GB / 44 GiB
     Linux                10218 181 12 15982  12 30   92588032
     ext4 blocksize=4096 Large file Sparse superblock Recover, 47 GB / 44 GiB
     Linux                13758 161 36 20102 166 32  101916672
     ext4 blocksize=4096 Large file Sparse superblock Recover, 52 GB / 48 GiB
     HPFS - NTFS          13778 165 20 13791 101  6     204800
     HPFS - NTFS          13779 137 55 13792  73 41     204800
     HPFS - NTFS          13779 235 25 13792 171 11     204800
     HPFS - NTFS          13794 116 19 13807  52  5     204800
     HPFS - NTFS          13795  56 22 15260  30  2   23533568
     HPFS - NTFS          13796 191 28 13809 127 14     204800
     HPFS - NTFS          13804  69 26 15269  43  6   23533568
     Linux                16914 180 35 23258 185 31  101916672
     ext4 blocksize=4096 Large file Sparse superblock Recover, 52 GB / 48 GiB
     Linux                16918 103 18 23262 108 14  101916672
     ext4 blocksize=4096 Large file Sparse superblock Recover, 52 GB / 48 GiB
     Linux                16920 210 59 23264 215 55  101916672
     ext4 blocksize=4096 Large file Sparse superblock Recover, 52 GB / 48 GiB
     Linux                16923 161  7 23267 166  3  101916672
     ext4 blocksize=4096 Large file Sparse superblock Recover, 52 GB / 48 GiB
     HPFS - NTFS          17047 236 22 18512 210  2   23533568
     HPFS - NTFS          17138 242  1 18603 215 44   23533568
     HPFS - NTFS          19277 182 42 19290 118 28     204800
     HPFS - NTFS          19282 240 31 19295 176 17     204800
     HPFS - NTFS          19283  17 63 19295 208 49     204800
     HPFS - NTFS          19284  23  4 19296 213 53     204800
     HPFS - NTFS          19285 223 11 20750 196 54   23533568
     HPFS - NTFS          19287 233 19 20752 206 62   23533568
     HPFS - NTFS          19291 221  3 19304 156 52     204800
     HPFS - NTFS          19293 198 42 20758 172 22   23533568
     HPFS - NTFS          19294 236 15 19307 172  1     204800
     HPFS - NTFS          19295 241 19 20760 214 62   23533568
     HPFS - NTFS          19296  51 20 19308 242  6     204800
     Linux                23319 201 51 27212  84  8   62533632 [Data]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 32 GB / 29 GiB
     HPFS - NTFS          23319 201 51 29056 123 59   92160000
     NTFS found using backup sector, blocksize=4096, 47 GB / 43 GiB
     HPFS - NTFS          27212  77 50 29639 209 49   38998071
     NTFS, blocksize=4096, 19 GB / 18 GiB
     Linux Swap           29056 123 60 30088 180 44   16582656
     SWAP2 version 1, pagesize=4096, 8490 MB / 8097 MiB
     HPFS - NTFS          30088 180 45 31130 223  5   16742400 [PBR Image]
     NTFS, blocksize=4096, 8572 MB / 8175 MiB
all support is greatly appreciated

Matej
Top
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Recover (accidentally) Formatted Partition /w LOG

#2 Post by cgrenier »

If the partition 10 is mounted, unmount it first.
Run TestDisk, Advanced, select the partition 10, use Type to force the type to NTFS (7), Boot, RebuildBS, List.
If you can see your files, choose Write, confirm, Quit.
Please post the testdisk.log file content of you have problems.
Top
Matej
Posts: 2
Joined: 17 Sep 2015, 14:04

Re: Recover (accidentally) Formatted Partition /w LOG

#3 Post by Matej »

Dear Christophe,
thanks for getting back to me. Unfortunately the partition was 'hard' formatted and the residues that I previously found belonged to the disk where I copied the image to. Anyways big up TestDisk for being the most convenient software for data rescue that I have come across.

Matej
Top
Locked

Return to “Partition Recovery”