cgsecurity.org

Hello,

I accidentally deleted the partition of my external "Seagate Expansion Desktop" Hard Drive.
I was willing to reformart a USB stick for some purpose. I entered the parted tool on my ArchLinux system but selected the wrong device and ended deleting my "Seagate Expansion Desktop" partition.

In my research, Testdisk is the tool that keeps on coming back as the one that would solve the problem.

Unfortunatelly, I performed several quick + advanched search operations and all I get is the following output :

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63

Partition Start End Size in sectors

1 E extended LBA 95796 0 1 95804 254 63 144585
5 L FAT16 <32M 95796 109 26 95804 149 25 131040

I never formatted my "Seagate Expansion Desktop" since I bought it.
I think it came originally with a NTFS partition on the whole 2TB space. Let's say I am 80% confident the partition was NTFS, 20% it was something else (FAT32 or extFAT probably).

I don't wanna risk destroying all my data. So I didn't took any action since the accidental delete, beside scanning with Testdisk.
My question is, what does the above output mean ? Can I write the result on the disk and hope to see my files back ? I am pretty sure there was only 1 big partition of 2TB, so I don't understand the FAT16 line.

Any help would be appreciated.

Many thanks in advance.

KR
SHand

It's the actual partition table. What is the ouput of Quick Search/Deeper Search ?
Please paste the whole testdisk.log file.

Hi,

Thanks for your reply.

I performed a quick/deeper search but this time Testdisk wasn't able to find anything.
Didn't write or anything on the disk. Just made a dd of the disk on another one.
Photorec though still finds lots of file.

Any chance I can get back my partition and file structure ?

Thanks !

Here is the testdisk.log output :



Fri Oct 27 11:31:45 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.13-1-ARCH (#1 SMP PREEMPT Thu Apr 27 12:15:09 CEST 2017) x86_64
Compiler: GCC 6.3
Compilation date: 2017-03-29T18:57:40
ext2fs lib: 1.43.4, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 250069680 sectors
/dev/sda: user_max 250069680 sectors
/dev/sda: native_max 250069680 sectors
/dev/sda: dco 250069680 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 1953525168 sectors
/dev/sdb: user_max 1953525168 sectors
/dev/sdb: native_max 1953525168 sectors
/dev/sdb: dco 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - TOSHIBA THNSNK128GVN8 M.2 2280 128GB, S/N:665S102CTQ9V, FW:K8DA4101
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:86UTTXLMT, FW:AX0P3D
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Expansion Desk, FW:0711
Disk /dev/mapper/sdb1_crypt - 1000 GB / 931 GiB - 1953517568 sectors, sector size=512
Disk /dev/mapper/VG--DISK1 - 127 GB / 118 GiB - 249016320 sectors, sector size=512
Disk /dev/mapper/VG--DISK1-SWAP - 17 GB / 16 GiB - 33554432 sectors, sector size=512
Disk /dev/mapper/VG--DISK1-SYS--ROOT - 110 GB / 102 GiB - 215457792 sectors, sector size=512
Disk /dev/mapper/VG--DISK2-PART--HOME - 536 GB / 500 GiB - 1048576000 sectors, sector size=512
Disk /dev/mapper/VG--DISK2-PART--VAR - 214 GB / 200 GiB - 419430400 sectors, sector size=512
Disk /dev/dm-0 - 127 GB / 118 GiB - 249016320 sectors, sector size=512
Disk /dev/dm-1 - 17 GB / 16 GiB - 33554432 sectors, sector size=512
Disk /dev/dm-2 - 110 GB / 102 GiB - 215457792 sectors, sector size=512
Disk /dev/dm-3 - 1000 GB / 931 GiB - 1953517568 sectors, sector size=512
Disk /dev/dm-4 - 214 GB / 200 GiB - 419430400 sectors, sector size=512
Disk /dev/dm-5 - 536 GB / 500 GiB - 1048576000 sectors, sector size=512

Partition table type default to Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - Seagate Expansion Desk
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced

TestDisk exited normally.

I don't know why testdisk didn't find your partition. Looks like you will have to sort the files recovered by PhotoRec...