Tuesday, March 19, 2019

data recovery - Undo Diskpart clean


This is a life-destroying moment for me. I have a 2TB External Hard drive, with 2 partitions. The first one is UDF and second one is a Veracrypt-encrypted partition. The drive was GUID -based, and the first partition was made an OEM partition using Diskpart and the second one an EFI partition in order to prevent accidental formatting by the system. However, a sudden accidental left click has pasted this script in diskpart and ran it before I could halt it.


select disk 0
clean
convert gpt
create partition primary size=300
format quick fs=ntfs label="Windows RE tools"
assign letter="T"

The new partition has a 300MB partition called Windows RE tools, and the rest is unallocated. Is there any way to recover the previous data. It is extremely important for me and my job depends on it. The backup that I had crashed last week and I had sent it to RMA. Hence I'm left with no backups.


EDIT:
Here's the thing. The partitions I previously had were a 50MB UDF partition (for truecrypt and veracrypt portables and keyfiles.) and the second partition was Veracrypt (almost 1.8TB). The second partition was quick formatted with Veracrypt. Now, yesterday, Diskpart has made a 300MB partition and the rest is a RAW partition. I have opened the disk using WINHEX and I have seen the contents of the 50MB UDF partition. They are intact. Then there are gibberish, which I believe is the Veracrypt partition. And at the end of the disk there are thousands of zeroes, which I believe is there because the partition was quick formatted with Veracrypt. Now, could anyone tell me how to recover data from this? Is it at all possible?


Answer



If you happen to have saved the first few sectors of the disk (onto another disk) then you can copy that back to restore the old partition table. Likewise if you happen to remember the exact size (down to the sector) of each partition then you can recreate the partition table to match. (This isn't as far-fetched as it may seem - I have done this once or twice and have been able to scroll up to see where I printed the partition table a few steps earlier.)


However as you have formatted the first 300MB of the new partition, doing this almost certainly won't get your first partition back, only the second one.


As others have suggested, data recovery tools are pretty much the only option at that point. Providing they support your filesystem, chances are good that you can recover everything after the first 300MB.


However data recovery tools typically won't work with encrypted partitions, so if you need that one back, figuring out where the partition starts and recreating the partition table is probably the only option.


Also here's the obligatory telling off: data that you only have one copy of is data that you don't care about!


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...