Small GPT partition written to 3Tb external

[LamentingAussie]

Cgrenier do you answer everyones questions single-handedly? youre like a gift from above :

Some additional info for my problem might be found in this breif conversation? http://forums.debian.net/viewtopic.php?f=17&t=133338

I am trying to get my head around the nature of the recovery task in front of me. there are four subforums (partition. File system. Undelete. Etc) and im not even sure which I need to try first.

There was a 3Tb usb external plugged into windows 7 pc so it was maybe ntfs, no problems until I tried to clone a tails OS onto a usb stick and instead chose the 3Tb as the desination (all data will be lost!) It didnt complete successfully (not designed to go on large storage) but I remember seeing "formatted as fat32" then an error about gpt not found mrb found (or something similar). This hapoened in minutes so surely the 3Tb is mostly intact.

The installer was supposed to use gpt to create a 2.5gb partition (invisible to Windows) and leave the remainder of the device unpartitioned.

Which approach should I be taking to recover valuable files from the almost 3tb of unpartitioned space? Maybe the backup mbr?

And since the installation failed maybe even the 2.5gb fat32 volume is up for grabs (if the OS wasnt written there) but really there is just some small files I will do anything to recover.

Thanks in advance cgrenier

[cgrenier]

Use testdisk 7.1-WIP, EFI GPT, Analyse, Quick Search and if necessary Deeper Search.
TestDisk should find your NTFS partition using its NTFS backup boot sector.
When the partition is listed set it to P(rimary). On next screen, choose Write, confirm, BackupBS, confirm, Quit

[LamentingAussie]

christophe, first of all i'm not using 7.1 because i couldnt get it to install properly on ubuntu.

should i try working from a windows 7 computer so i can use the latest version?

ive made the image twice and both times testdisk yields the same or similar results.

analyse EFI GPT i end up here

Disk /home/white1/shane/rescue.img - 3000 GB / 2794 GiB - CHS 364802 255 63
Partition Start End Size in sectors
>P Mac HFS 5000704726 5000706275 1550 [^A^B\^A]
P Mac HFS 5030459873 5030461422 1550 [^A^B\^A]
P Mac HFS 5042747558 5042749107 1550 [1^A^B\^A]
P Mac HFS 5108979009 5108980558 1550 [^A^B\^A]
P Mac HFS 5143090838 5143092387 1550 [^A^B\^A]
P Mac HFS 5191494297 5191495846 1550 [^A^B\^A]
P Mac HFS 5207554942 5207556491 1550 [1^A^B\^A]

and heres what the deeper search is currently showing at 87%
check_FAT: number of bytes per sector mismatches 4096 (FAT) != 512 (HD)
check_FAT: number of bytes per sector mismatches 4096 (FAT) != 512 (HD)
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
check_FAT: Bad jump in FAT partition
Unknown 1782666012 1548114154574619 1548112371908608
check_FAT: Bad jump in FAT partition
Unknown 2069778364 2078043691 8265328
Unknown 2841253562 17183068181 14341814620 [M-48M-=t~A~_]
Unknown 4728755136 30927067794838463 30927063066083328
Mac HFS 5000704726 5000706275 1550 [^A^B\^A]
Mac HFS 5000703180 5000704729 1550 [^A^B\^A]
Mac HFS 5030459873 5030461422 1550 [^A^B\^A]
Mac HFS 5030458327 5030459876 1550 [^A^B\^A]
Mac HFS 5042747558 5042749107 1550 [1^A^B\^A]
Mac HFS 5042746012 5042747561 1550 [1^A^B\^A]
Mac HFS 5108979009 5108980558 1550 [^A^B\^A]
Mac HFS 5108977463 5108979012 1550 [^A^B\^A]

resulting like this:

Disk /home/white1/shane/rescue.img - 3000 GB / 2794 GiB - CHS 364802 255 63
Partition Start End Size in sectors
>D Mac HFS 5000703180 5000704729 1550 [^A^B\^A]
D Mac HFS 5000704726 5000706275 1550 [^A^B\^A]
D Mac HFS 5030458327 5030459876 1550 [^A^B\^A]
D Mac HFS 5030459873 5030461422 1550 [^A^B\^A]
D Mac HFS 5042746012 5042747561 1550 [1^A^B\^A]
D Mac HFS 5042747558 5042749107 1550 [1^A^B\^A]
D Mac HFS 5108977463 5108979012 1550 [^A^B\^A]
D Mac HFS 5108979009 5108980558 1550 [^A^B\^A]
D Mac HFS 5143089292 5143090841 1550 [^A^B\^A]
D Mac HFS 5143090838 5143092387 1550 [^A^B\^A]
D Mac HFS 5191492751 5191494300 1550 [^A^B\^A]
D Mac HFS 5191494297 5191495846 1550 [^A^B\^A]
D Mac HFS 5207553396 5207554945 1550 [1^A^B\^A]
D Mac HFS 5207554942 5207556491 1550 [1^A^B\^A]

before analysis it says 'hint: intel pc partition detected' and a search using intel yields a FAT12 (!) partition, size 4122083715 so at least getting close in size but this was a fairly new hard drive used by windows 7. during the process there are a few warnings such as check fat bad jump in fat partition.

is it photorec time or do i have other options? thanks in advance

[cgrenier]

Read https://www.cgsecurity.org/testdisk.pdf to learn how to install testdisk 7.1-WIP on Linux.

[LamentingAussie]

same result. hfs found using backup sector

Disk /media/white1/Seagate Backup Plus Drive/shane/rescue.img - 3000 GB / 2794 GiB - CHS 364802 255 63
Partition Start End Size in sectors
D Mac HFS 5000703180 5000704729 1550 [^A^B\^A]
D Mac HFS 5000704726 5000706275 1550 [^A^B\^A]
D Mac HFS 5030458327 5030459876 1550 [^A^B\^A]
D Mac HFS 5030459873 5030461422 1550 [^A^B\^A]
D Mac HFS 5042746012 5042747561 1550 [1^A^B\^A]
D Mac HFS 5042747558 5042749107 1550 [1^A^B\^A]
D Mac HFS 5108977463 5108979012 1550 [^A^B\^A]
D Mac HFS 5108979009 5108980558 1550 [^A^B\^A]
D Mac HFS 5143089292 5143090841 1550 [^A^B\^A]
D Mac HFS 5143090838 5143092387 1550 [^A^B\^A]
D Mac HFS 5191492751 5191494300 1550 [^A^B\^A]
D Mac HFS 5191494297 5191495846 1550 [^A^B\^A]
D Mac HFS 5207553396 5207554945 1550 [1^A^B\^A]
>D Mac HFS 5207554942 5207556491 1550 [1^A^B\^A]

[cgrenier]

Run PhotoRec, enable the expert mode in Options, start a recovery, force the blocksize to 512 bytes, use the default options otherwise.
Does it recover your data ? (unfortunately it will not recover the original filenames)

[LamentingAussie]

i already ran photorec without the block size adjustment and it recovered a heap of files.

thanks for your help. im going to see if i can get a result with some other software