I used TestDisk to restore a "quick formatted" drive. When the software asked something about differing MFTs, I selected to copy the MFT backup. Now I've realized that whole directory branches are missing (like everything under
When I select the drive in TestDisk, I see the following:
Hidden sectors are present. size 312579695 sectors user_max 312579695 sectors native_max 312581808 sectors dco 312581808 sectors Host Protected Area (HPA) present.
While doing a deeper search, I see the following:
HPFS - NTFS 0 1 1 19455 254 63 312560577 Warning: Incorrect number of heads/cylinder 0 (FAT) != 255 (HD) Warning: Incorrect number of sectors per track 0 (FAT) != 63 (HD) FAT32 0 1 1 0 0 63 0
The FAT32 is probably the empty file system I had created by accident and deleted while trying to recover the NTFS one. It's missing from the final result:
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63 Current partition structure: Partition Start End Size in sectors 1 * HPFS - NTFS 0 1 1 19455 254 63 312560577
Unfortunately I had used some MB on the partly recovered drive before I dismounted it. I didn't do an image copy, but I made a backup with the list of partitions:
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63 Partition Start End Size in sectors >* HPFS - NTFS 0 1 1 19326 106 48 310478853 * HPFS - NTFS 0 1 1 19455 254 63 312560577
I can't find the missing files with the
P: list files option on either selection. (The option itself is only visible when I select the second one.) How could I get back those files? The Undelete function doesn't see them. I've lost heaps of important files including a lot of GPX (Guitar Pro) from the less common types. I'm on Linux now.