broken/deleted NTFS-partition - Testdisk finds Linux partitions?!

[Phischy]

Hi,

I used my 4TB USB3 drive yesterday to backup some data from an older netbook. I used a LiveLinux for that... all worked normal. After copying the files with rsync I shutdown the linux and disconnected the drive. So far nothing I would consider to be harmful for the NTFS-partition.

Today I did want to make a backup of another harddisk on my main-PC Win7 told me it couldn't read the drive I did run checkdisk /F but it stopped with an filesystem-error

I kinda feel uncomfortable to running testdisk on the actual drive and not on a clone-copy, though no 4TB disk for that at hand right now. :/ Testdisk's "quickcheck" is still running since 4 hours, 2 more to go I think.
Though it already shows me this:



Is that normal? Why is it not seeing an NTFS parition? O_O

[cgrenier]

It's useless to search partitions inside a partition (K:).
If you want to search for lost partitions, select the PhysicalDrive instead.

If the partition isn't lost and Windows says it's RAW, run TestDisk, go in the Advanced menu, select the partition, Boot, RebuildBS, List and if you can see your files, choose Write, confirm, Quit.
If you have problems, please copy/paste the testdisk.log file

[Phischy]

Ahhh! Thank you

I just did a quick search, it found the NTFS-partition though it can't list files "Can't open filesystem - Filesystem seems damaged".
What is the proper why to go here now? Btw. where is the logfile created? In the same dir as the .exe?

Btw. "Search MFT" is now running since 1 hour already.... and my guess is that it will run 7 more hours... uhoh...

[cgrenier]

The log file is in the same directory than the exe files. Configure Windows explorer to not hide the file extension...

Usually the first step is to recover the NTFS partition, the second to fix its boot record and if it failed, to use PhotoRec to recover the data.

[Phischy]

I did the Rebuild BS but still not the help I needed:





Log: http://pastebin.com/yAJa0rbB

[Phischy]

Oh and since it is 4TB: shouldn't I search for GPT instead of Intel? Though God, this is slow... GPT-search is at 10cylinders/minute... whole drive needs about 67hours...

If I stop the search I get "the following partition can't be recovered" and the partition that's lost.

Can you recommend a commercial data-recovery tool that will try to reconstruct filenames and directories? At best one that doesn't cost a fortune...