0

I have a 4tb drive which had a formatted NTFS 3.9tb partition and several small partitions. The GUID Partition Table (GPT) main and backup partition tables were then re-written so the partitions were 'lost', however the partitons were not overwritten so I am sure they are still there.

I have both the original drive, and a backup whole disk image written to another drive with dd under Linux.

I would like a software recommendation for recovery software to restore the 3.9tb NTFS partition to a readable state, either from the original disk or backup disk image. I can use either Windows 7 or Linux.

I found this list: http://forensicswiki.org/wiki/Tools:Data_Recovery#Partition_Recovery

Note: Old website was abandoned and appears to have been recreated at: https://forensicswiki.xyz/wiki/index.php?title=Tools:Data_Recovery

But it makes no particular recommendations. Have people here used any of these before?

Improve this question
2
  • As I have never tried that, I'll put it into a comment rather than an answer: You've found the correct Wiki. TestDisk should be able to achieve that (if any tool is able at all then this). AFAIR it's capable of restoring the partition table and write the entire thing back to an image you then could write to disk using dd. If not the entire disk, it could at least extract the partition for dd to write. I've no idea about the other candidates mentioned in that list.
    – Izzy ♦
    Jun 9 '16 at 5:58
  • @Hokuto Okuyama: If an answer was helpful to you, then please consider marking it as the accepted answer so others may more easily find it in the future. This is also a polite way to thank the person answering your question for helping you out.
    – Andrea Lazzarotto
    Jan 7 '17 at 19:11
1

main and backup partition tables were then re-written so the partitions were 'lost', however the partitons were not overwritten

Then it is a super easy job for TestDisk. The tool has to be run on the target disk and it will show you a TUI (textual user interface):

sudo testdisk /dev/sda

It will scan the drive and show you a list of detected partitions. You can press P to see the contents, hence you can check what are those that you want to recover. In case the first scan does not work, it should prompt you to perform a deeper search.

You can highlight any partition and press T to change type (e.g. from deleted to active). When the table looks good, follow the on-screen procedure to continue and then write the changes on the disk.

Here's a screenshot from this answer on Ask Ubuntu:

Testdisk showing a list of partitions

Improve this answer
0

I decided to put here another option around mentioned problem. If you have data but partition lost in some reason, there is another tool related to testdisk. It is called photorec (https://www.cgsecurity.org/wiki/PhotoRec).

Utility restores data from raw device using "knowledge" about files, their format and structure.

You may also check my short article about this in more details (https://nantipov.org/2019/02/recovering-of-data-from-damaged-and-quickly-formatted-hdd/).

Improve this answer
0

If 'just' partition tables were lost, whether traditional MBR PT or GPT ideally you:

  • Clone drive (sector-by-sector clone) (=safety net)
  • Use DMDE to repair partition table 'in-place'.

You can use DMDE free version to repair partition tables. For $20 you can buy license and then you can also use it to 'extract' files from lost/corrupt/formatted etc. partitions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.