It's a real messed situation, but I'm quite at the end of my options.

It's my personal hardrive, so it's very important for me, and yes, I have no backup =(

The short story:

  1. I have two discs. One with Windows, and another where I had a bit of empty space at the front of the disk, so i could install Linux. The rest was occupied by a 1.8TB NTFS partition filled with data.

  2. I installed Linux, and after a while realized there was not enough space for everything, so I tried using Gparted, and told it to re-size the NTFS partition, to a lesser size.

  3. The system jammed. I had to reboot and broke the Resizing operation.

Here's what I did to fix it:

  1. Rebooted into Linux Live, and used Testdisk,to deep analyze the disk, and recover the possible partitions. It found several versions of the NTFS partitions, probably made during the resizing. I told Testdisk to open every one of them, and only one could list its files. When trying to open the other options on Testdisk, it showed an error message. I assumed the one without errors, to be the correct one, and I told Testdisk to recover the partition, and write a new MBR.

  2. The partition had errors, and Linux has a NTFS fixing tool, used it, but the system still had errors.

  3. So I booted into windows and use chkdsk to correct all errors in the partition.

  4. Everything seems fine, but now, back in Windows, when I open one file, it opens another file, or part of another file. As in, some files took up the position of other files.

What I think happened is that I recovered an old tree, and not the most current one. And that one just happened to be intact, while the most recent one was damaged. As such, the files that were moved during the failed resizing, were now, during the automatic correction, assumed wrongly to be in their correct places.

So when I open a file, it tries to open another one. Radiohead - Creep.mp3 will open and it will actually be a bit from another song, or even code from a jpg. Some files seem to be all right, but others have seemed to have had their position taken by others.

Anyone knows of something really powerful that can help me solve this?

  • have you learned the value of a backup? Sometimes there is no un-fu** software or technique. You have made 2 mistakes, you should have made an image of the drive, work with repairing the image and not the actual drive, no one may be able to sort your mess now.
    – Moab
    Nov 12 '12 at 15:20
  • 1
    At the top of my head, I'm think of two solutions: raw analyze the disk and recover only the necessary files (doing it now). After that try my luck at the tree recovery operation again. It's too big to do an image of, although that certainly seems like good advice. And disks, specially disks with SMART in them in small scale operations, don't die without warning. Gives you plenty of time to get stuff out. It's only bad when you mess it yourself like I did. Nov 12 '12 at 16:24

The question was if someone knew something, software or procedure, that could help recover a very messed up partition and files.

After experimenting a lot, here's what I find works best in a situation where you compromised both the files and the file tree:

  1. Use a raw recovery tool to get all files you want, directly from the disk. Photorec http://www.cgsecurity.org/wiki/PhotoRec is a really nice tool that allows you to get most file extensions out of the disk. It does a raw recovery, so you won't get your filenames back, but mostly anything that can be recovered, will be.

  2. Use something like DMDE http://softdm.com to detect and browse through old/deleted/corrupt partition tables, and again get all your files out.

  3. Use something like Testdisk, to actually interfere with the disk and try to recover the old partition

  4. Use default file system correcting tools (ex: CHKDSK) to correct your file system.

  5. So, reviewing 1) is raw files, 2) is recovered files from recovered tree structure, 4) is files from recovered partition. Now for some deleting. Use something that will delete duplicates. What you want is to: compare 1) to 2) and delete all duplicates on 1), compare 1) to 4) and 2) to 4) and delete all duplicates on 1) and 2).

  6. Now you can safely combine the file structures from 2) and 4), always renaming files (notice: at this point, one of them will always be corrupt if they have the same name). You can code something for this or just do it manually.

  7. Finally, you can use something like Trid http://mark0.net/soft-trid-e.html to get rid of corrupt files. And, spend a lot of time seeing what you got from 1), and manually organizing it.

Regarding the other answers:

The "learn your lesson, always use a backup" advice is nice, but in the end pointless as a problem solver.

The "make an image before you start recovering" advice is also rather pointless if you know what you are doing, and simply don't write on the disk you're trying to recover from (yes, I know even stuff like last accessed/last modified stamps can be dangerous, but not really). There simply isn't a solid reason to do so if your disk's mechanical/electronic integrity is not compromised.

That's it.

All the tools I used were free at the time I wrote this.

This whole procedure will take easily more than a week. Hope this answer helps anyone. :)


This thing saved a lot of data for many users that asked me to help 'em out: Handy Recovery.

The great thing about it - it can recover deleted partitions! Although it takes a lot of time to find all the stuff you've lost, and of course you'll need a second hard drive to restore to.

  • Quote: "only $49 for a single user license".
    – harrymc
    Nov 21 '12 at 18:50
  • @harrymc Installing a Linux on a second partition - 0$, Handy Recovery - 49$, Data to be restored - priceless (c) Mastercard :)))
    – user157378
    Nov 21 '12 at 18:52
  • Just in case - I'm not affiliated to Handy Recovery in any way. I used this software to save a lot of users' data. That's all!
    – user157378
    Nov 21 '12 at 18:53
  • It just had to be said. This could be an excellent utility, just that free ones should be tried first.
    – harrymc
    Nov 21 '12 at 19:37

You have thoroughly loused up your disk. One never does partition changes without taking a backup first, as the least error will mean loosing the disk, but you did several.

Some of the files may still be recoverable, but you need a utility that analyzes the disk and searches for files without using the disk structure, because there is none now.

Below are listed some free recovery utilities. Try all of them, one after the other. Just remember to copy the potentially saved files to another drive than the formatted one. Don't write on that disk until you recover the data!

You will also need to check each and every "recovered" file to verify that some parts are not missing.

PC INSPECTOR File Recovery

  • 1
    If you see this, HDD Mechanic Standard is on a free giveaway here for today only (I have no personal experience with it).
    – harrymc
    Nov 27 '12 at 8:43
  • Too late now for HDD Mechanic.
    – harrymc
    Nov 28 '12 at 11:18

First, before keep trying anything else, do (yes: now) a low level bit-for-bit backup (I think Norton or Clonezilla allow you to do this).

Now you have secured what you currently have, let's try: You can use your partition recovery software again, check if the other partition tables are still there, and try to recover another, check if it works, then recover another, etc, you can always return to original state with your copy.

If none of this works, you can consider contacting a data recovery enterprise, they are great professionals which maybe can reconstruct your offsetted pointers, because surely it's a metter of offsetting block indexes. This will have an elevate cost (approximately, a few hundreds $), but only you know how much you price your data.

Good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.