0

good day all

I am a slightly losing my mind at the moment. I recently bought a flashdrive for backup livecd/rescue purposes,but I am a day to late.

I have an external hard drive, 2TB Seagate - file system = NTFS with a single partition, MBR type.

While trying to format my flashdrive to gpt for reasons, the software defults to the first attached USB device, which is my external, and without realising it, I formated my external (95% full with data) to a single GPT:NTFS file system.

I immediately started a partition recovery, but to my understanding, changing the mbr/gpt does not actually affect the data. I stopped the recovery, deleted the gpt:ntfs partition, changed back to mbr:ntfs and started a recovery.

Here is the intesting bit, I have a copy of Active Partition Recovery, so I started that up, and did a full "cylinder/deep" scan, it showed multiple partitions each with its recovery possibility. My partition label "Ext" was an excellent recovery possibility, when I selected to recover data in-place/restoring partition records,etc it reported that this "Ext" partitin (which is the one I need to recover) was a logical partition and that I need to use chkdisk to check for errors, else I can remove the partition and replace it with the found "Ext" partition records. Which is what I did (2 times) and after it mounted in Windows, an empty drive.

Using 2 other freeware, which seemed remarkably similar in interface and options but from different companies, both reported a "System" partition which is the gpt:ntfs partition name I formated to (the cause of the problem) and +/- 665 logical partitions ranging from64Mb to +/- 100 kb in size were also listed, but not the Ext partition

I am considering doing a RAW data recovery/salvaging files but at present done own another 2Tb, I am scaning my drive in linux using testdisk, but assuming the worst, I'll have to buy another hard drive

Is there any recommendation/resolution for this, to restore the original Ext partition or recover the data from that partition instead of copying/salvaging those files since my hard drive was quite full (+/-95%)?

  • Recovering in place is always a bad idea when you don't understand what you are doing. – qasdfdsaq Nov 10 '15 at 15:49
  • @qasdfdsaq the one is restoring the partition records onto the existing drive, the other is basically cloning the drive and restoring it, only difference is you dont have a backup – Cybex Nov 10 '15 at 16:02
  • One is overwriting data in place. – qasdfdsaq Nov 10 '15 at 16:07
2

without realising it, I formated my external (95% full with data) to a single GPT:NTFS file system.

It's important to understand that you did three entirely different things here:

  • You converted the disk from whatever partition table type it used (probably MBR) to GPT.
  • You created at least one new partition on the disk, replacing whatever partition(s) had been there originally.
  • You created a fresh New Technology File System (NTFS) on a partition on the disk.

All three of these operations were errors. The first two of them are relatively easy to fix, since the data structures involved are simple and are contained in relatively small and easy-to-predict sections of the disk. The third operation, though, is almost certainly impossible to fully reverse. By writing out fresh filesystem data structures, you've almost certainly overwritten the data structures that were originally present on the disk. This is especially likely to be true if the new filesystem (NTFS) is the same as the one it replaced and if the new partition starts in the same place as the old one. Thus, an attempt to recover the entire filesystem will almost certainly fail because critical parts of the old filesystem no longer exist; they've been replaced, in a sector-precise way, by new filesystem data structures.

Your best hope for recovery is to use a file-level recovery tool. Such programs scan the entire disk surface for recognizable fragments of filesystem data structures and for recognizable "signatures" of known file types. When such information is found, these tools can often extract partial or whole files and copy them to another disk. The tool like this with which I'm most familiar is PhotoRec, but I've seen claims that some Windows-specific tools do a better job when recovering files from an NTFS volume. Unfortunately, I don't have specific URLs or program names handy, so if you want to find something better than PhotoRec, you'll need to dig deeper yourself (or maybe somebody else will post a suggestion). To use such a tool, you really need another disk that's at least big enough to hold all the recovered files. You're likely to lose some or all of your directory structure; and PhotoRec, at least, does a poor job of reconstructing filenames, so you may end up spending a lot of time examining and renaming files.

  • Thank you for your response, yiu really explained indepth of my errors, i would still be able to recover the raw data? The actual files still or is it dependant on the files system present? – Cybex Nov 10 '15 at 14:32
  • Also would you say i am wasting my time scanning for/analyzing partitions using test disk, should i rather get straight into recovering/salvaging? – Cybex Nov 10 '15 at 15:04
  • I can't say it's certain that TestDisk will turn up nothing useful, but I think it's very likely that TestDisk will not be helpful. Using PhotoRec or something similar is much more likely to be useful -- but as I say, that's a much more tedious recovery path. You'll have to decide for yourself when to give up on TestDisk and programs like it. – Rod Smith Nov 10 '15 at 17:38
0

I had similar problem, unfortunately had to get the data copied onto another disk. Bought recovery softwares, only to find they couldn't help recover all data. Here's a open source alternative that helped. Testdisk you might want to try it. http://www.cgsecurity.org/wiki/TestDisk

Take care in the future.

  • thanks for the response, could you possibly post your problem and how you went about solving it, just to know what options I still have, thnx – Cybex Nov 10 '15 at 13:28
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – Ramhound Nov 10 '15 at 15:51
  • @Ramhound I beg to differ, this actually DOES help me – Cybex Nov 10 '15 at 16:01
  • While this does give a helpful pointer it is barely more than a software recommendation. We would prefer that you talk about how to use the tool and its benefits and describe how to use it to solve the problem as that would turn this answer into something great. – Mokubai Nov 10 '15 at 17:27
  • This softcare can, Fix partition table, recover deleted partition, Recover FAT32 boot sector from its backup, Rebuild FAT12/FAT16/FAT32 boot sector, Fix FAT tables, Rebuild NTFS boot sector, Recover NTFS boot sector from its backup Fix MFT using MFT mirror, Locate ext2/ext3/ext4 Backup SuperBlock, Undelete files from FAT, exFAT, NTFS and ext2 filesystem, Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions. Usage is simple it has a GUI with a description of each menu option. – sudopower Sep 25 '16 at 4:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.