cgsecurity.org

Hi,

what happened is that i had a 3TB HDD passthrough in Proxmox to a Windows 10 virtual machine.
After a Windows update the disk is just RAW.
It seems like the disk is ext4 when it should be NTFS.

A view weeks back i did run TestDisk and had this:




Here is the log: https://skulltronics.net/share/fixed/testdisk.log

After i got a new disk today its time to get my data back and connected the disk to my workstation.
At the Windows start i saw for 2 seconds a message like "windows does repair drive g:" or something likes this.

TestDisk does not say something about "the harddisk seems too small".

I thought maybe i just need to change the type? But that did not work.

What i did:
> No Log
> Select THOSHIBA DT01ACA300
> EFI GPT
> Analyse
> Quick Search

And here:


I did choose: T: change type > MS Data > NTFS > Enter > Write

But after a reboot nothing changed on the situation.

This is what i see in PhotoRec:

Can you try to list the files from each partition found by TestDisk ?
Once you have found the correct partition, use the arrow keys to switch the partition to recover to P(rimary).
On next screen, choose Write, confirm, Quit and restart your computer.

Trying to list the files says: No file found, filesystem may be damaged.

After the write and restart the drive letter is gone and the disk is now Healthy (Primary Partition) in Windows disk management.
The disk is still Linux filesys.

I downloaded the EaseUS Data Recovery Wizard and the files are there:

Do you really get "No file found, filesystem may be damaged." for each partition listed by TestDisk ?
Otherwise if you use PhotoRec and rename them as described in https://www.cgsecurity.org/testdisk.pdf you will get a similar results.

There is only one partition.

I do: No Log > Toshiba DT01ACA300 > EFI GPT > Analyse > Quick Search > P: list files
And get: "No file found, filesystem may be damaged."

I was hoping there is a way without using something like PhotoRec or Data Recovery Wizard because that means thousands of files have the wrong name and are in the wrong place.

What i don't understand is what happened that the disk is ext4 when it should be NTFS.