0

good day all

I am a slightly losing my mind at the moment. I recently bought a flashdrive for backup livecd/rescue purposes,but I am a day to late.

I have an external hard drive, 2TB Seagate - file system = NTFS with a single partition, MBR type.

While trying to format my flashdrive to gpt for reasons, the software defults to the first attached USB device, which is my external, and without realising it, I formated my external (95% full with data) to a single GPT:NTFS file system.

I immediately started a partition recovery, but to my understanding, changing the mbr/gpt does not actually affect the data. I stopped the recovery, deleted the gpt:ntfs partition, changed back to mbr:ntfs and started a recovery.

Here is the intesting bit, I have a copy of Active Partition Recovery, so I started that up, and did a full "cylinder/deep" scan, it showed multiple partitions each with its recovery possibility. My partition label "Ext" was an excellent recovery possibility, when I selected to recover data in-place/restoring partition records,etc it reported that this "Ext" partitin (which is the one I need to recover) was a logical partition and that I need to use chkdisk to check for errors, else I can remove the partition and replace it with the found "Ext" partition records. Which is what I did (2 times) and after it mounted in Windows, an empty drive.

Using 2 other freeware, which seemed remarkably similar in interface and options but from different companies, both reported a "System" partition which is the gpt:ntfs partition name I formated to (the cause of the problem) and +/- 665 logical partitions ranging from64Mb to +/- 100 kb in size were also listed, but not the Ext partition

I am considering doing a RAW data recovery/salvaging files but at present done own another 2Tb, I am scaning my drive in linux using testdisk, but assuming the worst, I'll have to buy another hard drive

Is there any recommendation/resolution for this, to restore the original Ext partition or recover the data from that partition instead of copying/salvaging those files since my hard drive was quite full (+/-95%)?

3
  • Recovering in place is always a bad idea when you don't understand what you are doing.
    – qasdfdsaq
    Nov 10, 2015 at 15:49
  • @qasdfdsaq the one is restoring the partition records onto the existing drive, the other is basically cloning the drive and restoring it, only difference is you dont have a backup
    – CybeX
    Nov 10, 2015 at 16:02
  • One is overwriting data in place.
    – qasdfdsaq
    Nov 10, 2015 at 16:07

2 Answers 2

2

without realising it, I formated my external (95% full with data) to a single GPT:NTFS file system.

It's important to understand that you did three entirely different things here:

  • You converted the disk from whatever partition table type it used (probably MBR) to GPT.
  • You created at least one new partition on the disk, replacing whatever partition(s) had been there originally.
  • You created a fresh New Technology File System (NTFS) on a partition on the disk.

All three of these operations were errors. The first two of them are relatively easy to fix, since the data structures involved are simple and are contained in relatively small and easy-to-predict sections of the disk. The third operation, though, is almost certainly impossible to fully reverse. By writing out fresh filesystem data structures, you've almost certainly overwritten the data structures that were originally present on the disk. This is especially likely to be true if the new filesystem (NTFS) is the same as the one it replaced and if the new partition starts in the same place as the old one. Thus, an attempt to recover the entire filesystem will almost certainly fail because critical parts of the old filesystem no longer exist; they've been replaced, in a sector-precise way, by new filesystem data structures.

Your best hope for recovery is to use a file-level recovery tool. Such programs scan the entire disk surface for recognizable fragments of filesystem data structures and for recognizable "signatures" of known file types. When such information is found, these tools can often extract partial or whole files and copy them to another disk. The tool like this with which I'm most familiar is PhotoRec, but I've seen claims that some Windows-specific tools do a better job when recovering files from an NTFS volume. Unfortunately, I don't have specific URLs or program names handy, so if you want to find something better than PhotoRec, you'll need to dig deeper yourself (or maybe somebody else will post a suggestion). To use such a tool, you really need another disk that's at least big enough to hold all the recovered files. You're likely to lose some or all of your directory structure; and PhotoRec, at least, does a poor job of reconstructing filenames, so you may end up spending a lot of time examining and renaming files.

3
  • Thank you for your response, yiu really explained indepth of my errors, i would still be able to recover the raw data? The actual files still or is it dependant on the files system present?
    – CybeX
    Nov 10, 2015 at 14:32
  • Also would you say i am wasting my time scanning for/analyzing partitions using test disk, should i rather get straight into recovering/salvaging?
    – CybeX
    Nov 10, 2015 at 15:04
  • I can't say it's certain that TestDisk will turn up nothing useful, but I think it's very likely that TestDisk will not be helpful. Using PhotoRec or something similar is much more likely to be useful -- but as I say, that's a much more tedious recovery path. You'll have to decide for yourself when to give up on TestDisk and programs like it.
    – Rod Smith
    Nov 10, 2015 at 17:38
0

I had similar problem, unfortunately had to get the data copied onto another disk. Bought recovery softwares, only to find they couldn't help recover all data. Here's a open source alternative that helped. Testdisk you might want to try it. http://www.cgsecurity.org/wiki/TestDisk

Take care in the future.

5
  • thanks for the response, could you possibly post your problem and how you went about solving it, just to know what options I still have, thnx
    – CybeX
    Nov 10, 2015 at 13:28
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post.
    – Ramhound
    Nov 10, 2015 at 15:51
  • @Ramhound I beg to differ, this actually DOES help me
    – CybeX
    Nov 10, 2015 at 16:01
  • While this does give a helpful pointer it is barely more than a software recommendation. We would prefer that you talk about how to use the tool and its benefits and describe how to use it to solve the problem as that would turn this answer into something great.
    – Mokubai
    Nov 10, 2015 at 17:27
  • This softcare can, Fix partition table, recover deleted partition, Recover FAT32 boot sector from its backup, Rebuild FAT12/FAT16/FAT32 boot sector, Fix FAT tables, Rebuild NTFS boot sector, Recover NTFS boot sector from its backup Fix MFT using MFT mirror, Locate ext2/ext3/ext4 Backup SuperBlock, Undelete files from FAT, exFAT, NTFS and ext2 filesystem, Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions. Usage is simple it has a GUI with a description of each menu option.
    – sudopower
    Sep 25, 2016 at 4:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .