0

I used TestDisk to restore a "quick formatted" drive. When the software asked something about differing MFTs, I selected to copy the MFT backup. Now I've realized that whole directory branches are missing (like everything under bar in /foo/bar/xxx/xxx/).

When I select the drive in TestDisk, I see the following:

Hidden sectors are present.

size       312579695 sectors
user_max   312579695 sectors
native_max 312581808 sectors
dco        312581808 sectors
Host Protected Area (HPA) present.

While doing a deeper search, I see the following:

HPFS - NTFS              0   1  1 19455 254 63  312560577
Warning: Incorrect number of heads/cylinder 0 (FAT) != 255 (HD)
Warning: Incorrect number of sectors per track 0 (FAT) != 63 (HD)
  FAT32                    0   1  1     0   0 63          0

The FAT32 is probably the empty file system I had created by accident and deleted while trying to recover the NTFS one. It's missing from the final result:

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * HPFS - NTFS              0   1  1 19455 254 63  312560577

Unfortunately I had used some MB on the partly recovered drive before I dismounted it. I didn't do an image copy, but I made a backup with the list of partitions:

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS              0   1  1 19326 106 48  310478853
 * HPFS - NTFS              0   1  1 19455 254 63  312560577

I can't find the missing files with the P: list files option on either selection. (The option itself is only visible when I select the second one.) How could I get back those files? The Undelete function doesn't see them. I've lost heaps of important files including a lot of GPX (Guitar Pro) from the less common types. I'm on Linux now.

1 Answer 1

1

The solution to get back the missing files was to use a commercial software from Windows.

  1. Create a disk image on a removable drive from Linux (without mounting the damaged file system).
  2. Recover the file structure from the image with GetDataBack.
  3. Copy back the recovered files to their original location.
  4. Rebuild grub.cfg with update-grub. (I still had a working Linux on a different drive.)

CHKDSK run automatically and I could boot my original Windows setup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .