Deep Search shows tons of deleted partitions

How to use TestDisk to recover lost partition
Post Reply
Message
Author
manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Deep Search shows tons of deleted partitions

#1 Post by manuyavuz » 15 Aug 2016, 17:25

Hi all,

I've accidentally repartitioned my external drive, and trying to recover using testdisk.

I've run "Quick Search", and it showed only currently active partitions, there were no deleted partitions.

Then I've run "Deep Search", this time it found thousands of deleted partitions whose sector sizes are the same but start/end values are shifted by some margin.

And because the partition that I want to save is an HFS partition, I can't try using "list" option and detecting which of the listed partitions will show the file list.

How can I detect which of the partitions is the true one?
quicksearch.jpg
Result of "Quick Search"
quicksearch.jpg (168.24 KiB) Viewed 440 times
deepsearcherror.jpg
Warning after "Deep Search" completion
deepsearcherror.jpg (145.01 KiB) Viewed 440 times
deepsearch.jpg
Result of "Deep Search"
deepsearch.jpg (177.2 KiB) Viewed 440 times

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3619
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deep Search shows tons of deleted partitions

#2 Post by cgrenier » 15 Aug 2016, 21:27

To find the correct HFS+ partition, you should try the partition where "+ Backup" is listed on the last line of the screen when highlighted.

manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Re: Deep Search shows tons of deleted partitions

#3 Post by manuyavuz » 15 Aug 2016, 22:01

Thanks for the fast response!

So I'll move with the following partitions:

Code: Select all

>P EFI System                    40     409639     409600 [EFI] (Which can list files via "p" button)
>P Mac HFS                   411648  488692895  488281248 (HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB)
>P Mac HFS                488955040 1465517535  976562496 (HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB)
>P Mac HFS               1465779680 1758486527  292706848 (HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB)
>P MS Data               1758748672 1953523711  194775040 (exFAT, blocksize=131072, 99 GB / 92 GiB) (Which can list files via "p" button)
Changing these from Deleted to Primary and then continuing would be enough right?

manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Re: Deep Search shows tons of deleted partitions

#4 Post by manuyavuz » 15 Aug 2016, 22:18

I've tried to write new partition table but write failed with "write error" message.

By the way, I see that the above partition table which I selected from deleted partitions seems to be exactly the same with current partition structure, which is the folowing:

Code: Select all

 1 P EFI System                    40     409639     409600 [EFI System Partition]
 2 P Mac HFS                   411648  488692895  488281248 [Apple_HFSX_Untitled_2]
 3 P Mac HFS                488955040 1465517535  976562496 [TimeMachine]
 4 P Mac HFS               1465779680 1758486527  292706848 [MacMini]
 5 P MS Data               1758748672 1953523711  194775040 [windows]
 
What should I do to be able to correctly write deleted partition and reach the files?

manuyavuz
Posts: 5
Joined: 15 Aug 2016, 17:07

Re: Deep Search shows tons of deleted partitions

#5 Post by manuyavuz » 22 Aug 2016, 11:20

Hi again,

I had to run a Deeper Search from scratch. Here is the full log file :
testdisk.log.zip
(53.55 KiB) Downloaded 27 times
Is it possible to switch only one partition from deleted to primary? I really need to save only one partition, namely the following (most probably):

Code: Select all

HFS+ magic value at 1465517534/0/1
part_size 976562496
     Mac HFS                488955040 1465517535  976562496
     HFS+ found using backup sector!, 499 GB / 465 GiB
which has the same Start/End sectors with the current partition table:

Code: Select all

 Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   411648  488692895  488281248
     HFS+ blocksize=4096 + Backup, 249 GB / 232 GiB
   P Mac HFS                488955040 1465517535  976562496
     HFS+ blocksize=4096 + Backup, 499 GB / 465 GiB
   P Mac HFS               1465779680 1758486527  292706848
     HFS+ blocksize=4096 + Backup, 149 GB / 139 GiB
   P MS Data               1758748672 1953523711  194775040
     exFAT, blocksize=131072, 99 GB / 92 GiB
How should I continue now? Would switching only the above partition work without switching EFI System to primary?

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests