NTFS partition overwritten

How to use TestDisk to recover lost partition
Post Reply
Message
Author
rawr
Posts: 3
Joined: 04 Dec 2017, 20:06

NTFS partition overwritten

#1 Post by rawr » 04 Dec 2017, 20:26

Hello,

I'm new here but I think testdesk gives me the biggest chance to get my data back.
I have a 4 TB drive that was filled 95% with data which I'm missing now. This is what I did:

Wanted to get the drive ready for a mdadm RAID 5:

Code: Select all

sudo parted /dev/sdx mklabel gpt
sudo parted -a optimal -- /dev/sdx mkpart primary 0% 100%
sudo parted /dev/sdx set 1 raid on
I don't know if it is important for you but I did this procedure twice (don't ask why...)

Okay that's all what I did. I did NOT format it, I did NOT add it to the RAID, no data has been written on the drive.

I started panicking... Downloaded several get-data-back tools, was able to restore 1.64 TB of data. I was able to see all files, all software I've tried only were able to restore these 1.64 TB. (3.64 TB - 2.00 TB which is MBR limit afaik = 1.64 TB hmmmmm... )

After this I finally downloaded testdsik. This program just did not came to my attention before. I've found a NTFS partition with quicksearch (I did not recognize that this NTFS partition was about half the size of the disk), was able to list all files, wrote it to the disk but after reboot I was not able to access the data.
Then I've tried to look at the boot sector.

Boot sector: Bad

Backup boot sector: Bad

-> Rebuild boot sector. Result: No access to my data. Windows now actually shows the drive, shows the one folder that was on it but when i try to access it, windows tells me, that the data is corrupt. Also windows reports the partition to be sized at 2TB.

Image

I am currently running a full quick search to see if testdisk can find my original partition (I've calculated that this will last at least 35h).

What I've found out:

When I select the disk in testdisc, go to advanced it reports the following partition:

Image

Now, I go on Type, change the partition to MS Data -> NTFS. Then I select Boot and it shows an intact backup bootsector.

Image


What should I do now? Wait for scans? Restore this backup boot sector? Or will it get worse when I try this? Please help me :(

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3808
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS partition overwritten

#2 Post by cgrenier » 05 Dec 2017, 07:01

In Advanced, choose Boot and BackupBS, confirm, Quit and restart.

Your disk should be listed as AFI GPT, not as basic (PC Intel) as Windows does...

rawr
Posts: 3
Joined: 04 Dec 2017, 20:06

Re: NTFS partition overwritten

#3 Post by rawr » 05 Dec 2017, 09:27

Hi,

that did not work. I was not able to list the files - bad MFTs. I'm rebuilding boot sector now, takes a while.

rawr
Posts: 3
Joined: 04 Dec 2017, 20:06

Re: NTFS partition overwritten

#4 Post by rawr » 05 Dec 2017, 11:40

I was not able to rebuild the boot sector and test disk only found bad MFTs.

After a long, long google search, I've found a tool named DMDE. I am able to recover every single file with this software. It is recovering at the moment.


Altough testdisk did not recover my partitions or files I would like to shout out a big thanks to the developer, testdisk is a great tool and it's free, I really appreciate that. It also has a very good documentation. In addition, I would have never found out about DMDE without testdisk.

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest