cgsecurity.org

recomend testdisk incorperate the date-time into log file name.
re-writing the log everytime seems primitive doesnt it?
are you sure you people know what your're doing?
if i had yesterdays log it would explain my mistake.
i cant.

recovered wrong partition i guess.

hello, i made a bit of a pickle with my 4TB Seagate running on MBR bios in WinXP x64.
I know, I know,.. its time to upgrade OS but its on the todo list ok?
I somehow had it partitioned as one big drive but its unclear if that was a GPT partition OR if i used SEAGATE diskwizard extended capacity driver and created a dynamic disk from the smaller partitions.
a SPANNED volume comprised of the two (or three?) partitions created with Seagate ECM (diskwizard).
so thinking i had disconnected the drive i deleted some missing volumes that were cluttering my disk managment console
its really unclear if the drive was connected. or this is entirely the windows record of the dynamic pairing that was delelted as i did not discover the issue for
some days at the least.
but it was gone , the partitions or the dynamic volume or something made it go away.
i ran testdisk analyse for hours and it came back with two partitions highlighted in green.
one looked big enough to be the entire disk but i am not good with the geometry numbers.
that was identified as partition 1
and also
partition 5 however it was identified as FAT16.
they were green so i chose to WRITE rather than deeper search.
quickly came back with "write error"
i fired up r-studio to see if it would yield clue to the structure info but iot was locked out apparently write protcted by testdisk.\
so after reboot now i see divisions of THREE partitions the first ending at 2TB which suiggest i guess that i went the SEAGATE ECM route
and... only the middle partiton was apparently written or recoverd by that testdisk manuveur.
the MIDDLE partition now has drive letter but unreadable at 600+GB.
i think perhaps fixing ONE item WOULD have corrected the rest but i chose wrong.
perhaps i should have written only the ONE large partiton found by testdisk and the other would have fallen into line.
question now.... DELETE? the newly written partition to make room for the large full partiton?
the smaller partion seems to maybe have BLOCKED the larger from being corrected?
I will be including a shot of the second run at analysing with testdisk.
I have rstudio and easeus partition master also. Hirens and Gandalfs rescue disks and ultimate boot cd.
Apparently now what i need to find is a drive with 4TB free space.

The first line of testdisk.log contains the date/time!
You had the choice between Create and Append to log file when you started TestDisk.
Choose EFI GPT as your disk is over 2 TB.
You can also use TestDisk 7.0 instead of older 6.14.

apologies.
i am moody.
thank you for the info.

so upon reflection i think what has happened is that three deletions occurred?
the spanned volume and the two partitions that comprised it, one of which is not
visable or accessible without the seagate extended capacity driver having mounted it..?
i think..
or something like.

but you say its GPT. are you able to be certain its straight up pure GPT? and
not the complex spanned concoction i previously mentioned?

also..

are the fat16 partitions caused my my having formatted each partition seperately thru the command prompt format command?

thank you.

additionally i will be able to provide full scan log from yesterday and more screenshots however 3 file upload limit here.
i can also offer the long scan result from and old version of R-Studio and even one from another
brand recovery.
i am setting up a machine to bench this problem so win7 and testdisk7 almost running.
many new recovery softwares with free trials that can offer clues.
i'm not certain i formatted that disk the ugly way but if not then its
my first successful big disk GPT simple format.
windows gave me some resistance to first attempts tryingit last year probably due to not rebooting
after partitioning or deleting upon reconsidering the partition method mid-stream or something.

edit:
since my r-studio scan is running for some hours yet, i will note that software is reporting some
"known filetypes scan has respawned because of analysis timeout." starting at around 50%.

i am reluctant to continue.
i am honestly thinking i constructed the filesytem upon the complex concoction i
previously mentioned.

installing disc wizard driver first which created a virtual drive.
converted that volume as well as the base 2.2tb volume to dynamic volumes added to a pool
used to create a spanned dynamic volume of 4tb THEN formatted with gpt filesystem

if the base volumes were wiped then windows nor seagate does not see beyond 2.2tb
which cuts the partition in half.
unless your product understands loads or emultates the seagate / acronis driver
them many of us are neglected.
i was thinking maybe testdisk recognizes a VHD? created by seagate and mounts it?

i think perhaps i should first scan for INTEL to recontruct those base volumes first getting seagate software to mount the +2.2 volume.

are there any known recovery softwares capable of addressing these points?

it seems that testdisk should load sort of driver or take some steps to see beyond 2.2Tb
in any mbr system since windows likely does not see or load the GPT structure either.
how is that addressed? mounted inside a yet another virtual GPT volume?



you can criticize my stupidity all day but there are thousands like me encouraged to use the seagate software as windows is sometimes picky about partitoning GPT and especially so if someone tried to change method mid-stream as that software has begun protecting that portion of the disk.

identifying the point /file / method near 2.2tb where seagate /acronis begins to enable the added accessability.

let this be lesson to those of you planning to use the seagate wizard method you will not be able to recover files. a bare metal GPT structure is best.

if i can locate a semi-recent backup of the OS drive.. where / what folder does WINDOWS retain info
of the spanned dynamic volume and the volumes that comprised it?