cgsecurity.org

TLDR; i have to use the original partitioning tool (minitool) to recreate the lost partitions on the disk to recover but minitool forces you to create a 128MB partition when initializing to GPT. Can i do the same with testdisk instead?

Full version:

1. The GPT disk to recover contained 5 veracrypt encrypted data partitions. the partitions were created with minitool partition wizard and later formatted/encrypted using veracrypt. partitions had the following sizes:
2. clonezilla script (accidentally) tried to restore a different mbr disk's image to the above disk. it errored before any actual data was overwritten but filesystem header and partition table were deleted. Here is a pseudo clonezilla log created after the fact but under similar conditions:
3. the partitions and the encrypted volumes therein were luckily created with poor security practices ie:
4. probably due to (3) there are large portions of hex 00's occupying the free space of the encrypted volumes. by using dmde's hex view i was able to find large swathes of these zeroes followed by data followed by zeroes and so on. the start to end sector ranges of these portions match the disk sizes listed in (1). screenshot of sdd5 for example. probable start sectors of partitions (ie first non 00 hex after lots of 00's): 5. this is where i'm stuck. i see from several sources (example here) that by simply creating the partitions of the same sizes using the same partitioning tool (in my case minitool), i should be able to mount the veracrypt volumes again. BUT:

• the disk is currently in MBR mode. If i try to initialize to GPT, minitool forces me to create a 128MB partition. this partition did not exist on sdd as it was promptly deleted after creation (when originally setting up the partitions on the disk).

• minitool does not allow specifying start and end sectors.

I'm positive i can do this with testdisk but don't know how. Can someone help me finish? Also note that i'm working on a cloned copy of the disk to recover created with ddrescue/knoppix.

If you don't want a 128MB (32 MB for smaller disk) Microsoft Reserved Partition (MSR), TestDisk will not force you to have one.

Run TestDisk, select the disk, EFI GPT, Quick Search, use 'a' to manually add each partition.
Once it's ok, go on next screen, choose Write, confirm, Quit and restart your computer
Good luck

cgrenier wrote: 17 Jan 2020, 20:54 If you don't want a 128MB (32 MB for smaller disk) Microsoft Reserved Partition (MSR), TestDisk will not force you to have one.

Run TestDisk, select the disk, EFI GPT, Quick Search, use 'a' to manually add each partition.
Once it's ok, go on next screen, choose Write, confirm, Quit and restart your computer
Good luck

which partition type do i select (for a GPT disk / primary partition): EFI, MBR, MSData?

The partitions were created as NTFS in mpw before veracrypt format. a working encrypted partition on a different disk created around the same time (and therefore likely to have been set up similarly although it is a logical partition on an MBR disk) shows up as:

• hpfs / ntfs in testdisk,

• partition type id 0x7, filesystem "Other" in mpw

• RAW in windows disk management.