Testdisk recovery question.

[nujinini]

Hi!

I was trying to recover my partition which I idiotically deleted .

Anyways, now I'm using testdisk and everything seems fine until the final step. One click and I'm done. I thought.

However the output below gave me a dilemma.

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63

     Partition                  Start        End    Size in sectors

 1 * HPFS - NTFS              0   1  1  1929 254 63   31005387 [XP Windows :(]
 2 P Linux                14512   0  2 15816 254 63   20964824 [Fedora-12-i686-L
 3 P HPFS - NTFS          15817   0  1 29554 254 63  220700970
 4 P Linux Swap           29555   0  1 30400 254 63   13590990



[  Quit  ]  [ Write  ]

I am trying to recover ONLY the deleted partition which is #3 HPFS-NTFS and to my surprise after search, it gave me 4 Partitions as per the output above. FYI, the other three are not deleted and are very active.

I am afraid that if I click "Write", it may (or may not) recover my deleted partition but also affect my other three.

May I please know how to handle this prudently?

Thank you!

[Kloschüssel]

if you just deleted the partition and did not write any data to the sectors of the partition, you just have to fix the partition table by restoring the partition definition. the data will be there again.

if you wrote something to the sectors of the deleted partition (i.e. you created another partition over it and created a filesystem and stored files there) you won't be able to recover it (at least not completely) because the data is lost on the sectors that were written. anyway, some files may still be intact and you could be lucky to get to the important stuff if the filesystem infrastructure is still intact and can be mounted / fixed.

[Segfault]

I'd take a disk image with dd as backup before proceeding.

[nujinini]

I'd take a disk image with dd as backup before proceeding.

Thanks guys!

I guess i'd have to put this on hold till I get to buy my 1T external HD. No budget yet .

[devils casper]

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63

     Partition                  Start        End    Size in sectors

 1 * HPFS - NTFS              0   1  1  1929 254 63   31005387 [XP Windows :(]
 2 P Linux                14512   0  2 15816 254 63   20964824 [Fedora-12-i686-L
 3 P HPFS - NTFS          15817   0  1 29554 254 63  220700970
 4 P Linux Swap           29555   0  1 30400 254 63   13590990



[  Quit  ]  [ Write  ]

I have used testdisk on a lot of Hard disks and it looks like testdisk has recognized deleted partition correctly. I would suggest you to go ahead and recover partition.

[nujinini]

Hello DC,

Thank you very much. It has given me much confidence.

But if I may be allowed to ask, why are the other two partitions (xp & fedora) detected also as deleted partitions but in reality their not. And so, should I go on with recovering partition, would it not overwrite these two partitions and make them inoperable. I am in no way doubting your wisdom but I just want to also understand as much my little brain can absorb

[Lostfarmer]

The display you have posted will be what is written to the MBR. So it will include all partitions to be written not just the deleted one.

[devils casper]

But if I may be allowed to ask, why are the other two partitions (xp & fedora) detected also as deleted partitions but in reality their not.

As Lostfarmer already mentioned, Testdisk is showing complete partition table and it will be written to the MBR.

Testdisk works on complete partition table instead of single/multiple selective partitions. It detects all partitions (doesn't matter if partitions have been deleted earlier or not), show you the result and write the same in MBR if user accepts its recommendation.

Testdisk recovers partition table only and it has nothing to do with data outside MBR.