Need help recovering entire quick format HDD

[Jakin]

Hello, i have run into some issues this morning, and for the past well------- 6hours i have been trying to recover my quick formatted HDD; How? Well i was trying to resize my ubuntu partition to fill the extra 20gb i had sitting unallocated on my "500 GB" harddrive (real size when i bought it and found out is 462 GB ) The very instant that i realised it formated the entire drive rather than the 20gb i had unallocated on the drive, i hit the power button.
I cannot access any of the partitions, so i am on LiveCD of ubuntu, and have searched around, tried TestDisk, and here are my results:

-------------------------------------------------------

Sun Jun 24 15:54:43 2012
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.38-8-generic (#42-Ubuntu SMP Mon Apr 11 03:31:24 UTC 2011)
Compiler: GCC 4.5 - Oct 17 2010 19:13:58
ext2fs lib: 1.41.14, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
/dev/sr0 is not an ATA disk
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA ST95005620AS
Disk /dev/sr0 - 732 MB / 698 MiB - CHS 357479 1 1 (RO), sector size=2048 - hp DVDRAM GT30L

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ATA ST95005620AS
Partition table type: Intel

Interface Advanced

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
NTFS at 51/0/1
filesystem size 861375845
sectors_per_cluster 8
mft_lcn 618618
mftmirr_lcn 8434343
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 51 0 1 53669 42 29 861375845
NTFS, 441 GB / 410 GiB
NTFS at 56280/0/1
filesystem size 33482128
sectors_per_cluster 8
mft_lcn 769743
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]
NTFS, 17 GB / 15 GiB

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=10/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58364 61 2 60801 47 46 39149568
EXT4 Large file Sparse superblock, 20 GB / 18 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 51 0 1 53669 42 29 861375845
NTFS, 441 GB / 410 GiB
P HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]
NTFS, 17 GB / 15 GiB
P Linux 58364 61 2 60801 47 46 39149568
EXT4 Large file Sparse superblock, 20 GB / 18 GiB

interface_write()
1 * HPFS - NTFS 51 0 1 53669 42 29 861375845
2 P HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]
3 P Linux 58364 61 2 60801 47 46 39149568

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
NTFS at 50/254/63
filesystem size 819249
sectors_per_cluster 8
mft_lcn 7288
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 4 50 254 63 819249
NTFS found using backup sector!, 419 MB / 400 MiB
NTFS at 51/0/1
filesystem size 861375845
sectors_per_cluster 8
mft_lcn 618618
mftmirr_lcn 8434343
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 51 0 1 53669 42 29 861375845
NTFS, 441 GB / 410 GiB
NTFS at 56279/254/63
filesystem size 903318881
sectors_per_cluster 8
mft_lcn 618618
mftmirr_lcn 8434343
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 51 0 5 56279 254 63 903318881
NTFS found using backup sector!, 462 GB / 430 GiB
NTFS at 56280/0/1
filesystem size 33482128
sectors_per_cluster 8
mft_lcn 769743
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]
NTFS, 17 GB / 15 GiB

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=10/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58364 61 2 60801 47 46 39149568
EXT4 Large file Sparse superblock, 20 GB / 18 GiB

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=10/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58642 135 54 61079 122 35 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
This partition ends after the disk limits. (start=942092288, size=39149568, end=981241855, disk end=976784130)

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=10/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58643 108 26 61080 95 7 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
This partition ends after the disk limits. (start=942106624, size=39149568, end=981256191, disk end=976784130)

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=10/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58648 0 1 61084 241 45 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
This partition ends after the disk limits. (start=942180120, size=39149568, end=981329687, disk end=976784130)

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=10/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58652 88 61 61089 75 42 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
This partition ends after the disk limits. (start=942249984, size=39149568, end=981399551, disk end=976784130)

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=7/27, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4893696
recover_EXT2: part_size 39149568
Linux 58657 16 48 61094 3 29 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
This partition ends after the disk limits. (start=942325760, size=39149568, end=981475327, disk end=976784130)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 58805/18/30
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 58805/18/30
FAT12 58805 18 30 58805 64 11 2880 [BOOTTEST]
FAT12, 1474 KB / 1440 KiB
NTFS at 50/254/63
filesystem size 819249
sectors_per_cluster 8
mft_lcn 7288
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 51/0/1
filesystem size 861375845
sectors_per_cluster 8
mft_lcn 618618
mftmirr_lcn 8434343
clusters_per_mft_record -10
clusters_per_index_record 1
Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 502 GB / 468 GiB)
The following partitions can't be recovered:
Linux 58642 135 54 61079 122 35 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
Linux 58643 108 26 61080 95 7 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
Linux 58648 0 1 61084 241 45 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
Linux 58652 88 61 61089 75 42 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
Linux 58657 16 48 61094 3 29 39149568
EXT4 Large file Sparse superblock Recover, 20 GB / 18 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 1 4 50 254 63 819249
NTFS found using backup sector!, 419 MB / 400 MiB
HPFS - NTFS 50 254 63 101 253 59 819249
NTFS, 419 MB / 400 MiB
HPFS - NTFS 51 0 1 53669 42 29 861375845
NTFS, 441 GB / 410 GiB
HPFS - NTFS 51 0 5 56279 254 63 903318881
NTFS found using backup sector!, 462 GB / 430 GiB
* HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]
NTFS, 17 GB / 15 GiB
Linux 58364 61 2 60801 47 46 39149568
EXT4 Large file Sparse superblock, 20 GB / 18 GiB
FAT12 58805 18 30 58805 64 11 2880 [BOOTTEST]
FAT12, 1474 KB / 1440 KiB

interface_write()
1 * HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]

-----------------------------------------------------------------------

I really want to get it all back.... WORST case senario i start the entire HDD from scratch... can someone please help me?
At the end of the log "interface_write()
1 * HPFS - NTFS 56280 0 1 58364 42 22 33482128 [iDisk]" i knew this had to be wrong so i didnt do anything and exit terminal.

I have never done this, and really need help from someone that has experience recovering a whole HDD from quick format.. I wait...


If it helps, im on a Momentus XT 500GB drive..






Quick Search findings ^

(Deep Search findings in later post, due to forum limitations)

[Jakin]

Nothing? Is it possible to save the NTFS partitions at the very least?

[darkod]

The log is not easy to understand like this. You don't actually need logging.

Open Testdisk again, do the quick search and then the deep search and post the screenshot of what it finds with the deep search. You should have internet in live mode so you can post that screenshot.

Testdisk should be able to bring back the original partitions.

[Jakin]

Okay, i shall append the screenshots of each step and testdisk' findings along with the log in my first post. (apologies for the way i had to post these)




^ This is the correct listing of my partitions as they were; although iDisk was not my boot partition, so im not sure why the star aside it.



then it finally asks to write to iDisk (which is the name i had given the win7 64bit recovery partition) writting to this partition wouldn't help i would think, so i just exit console.

[darkod]

OK. Post the deep search because the quick search doesn't look like it can help (and usually it doesn't in cases like this, so this is not strange).

[darkod]

OK. In the screen before the last you can see that all partitions except one have the letter D in front of the row. In the instructions on the bottom of the page it says clearly, D stands for Deleted.

If you hit Enter without changing the D on any partition that's why it suggested to write a partition table with only iDisk. You are right, it wouldn't have helped.

When you have the deep search listing, you can also try to list files on any partition by selecting it with up/down arrows and hitting P. That can help you decide which partition has files that can be read, and which doesn't.

By looking at the start/end numbers on the deep search, I would say you need to recover partitions number 1, 4 and 5 on the list. You can use the P to see if you can read them first.

As for partition 4, I am not sure if it should be 3 or 4. They have similar size but not identical. Can you tell by the size?

Also, one of them should be the bootable, but I am not sure if it should be 1 or 4 (or 3 if you decide to restore that one instead of 4, you can't restore both).

But don't worry too much about the boot flag, you can manipulate it later. The most important right now is writing the correct partition table.

Do you need to restore the linux partition on the deep search list also? If you don't have any important data in linux, I suggest you leave it as deleted (D).

For the windows partitions you want to restore, you will need to select them one by one using the up/down arrows and then using the left/right arrows to change the letter into * (for Primary with boot flag) and on the rest into P (Primary).

If you want to, you can even make all three of them P without worrying about the boot flag right now. You can manipulate it from ubuntu live mode later.

After you are happy with the changed letters, hit Enter and in the next screen Write to write the table.

[Jakin]

Well im something like 90% sure that (if you can understand this) based how i saw the partitions when i copied from old HDD when i upgraded to this momentus XT HDD; (no longer have that drive either, that was a year ago)

partition 1 was the boot (with something like 200mb also im sure grub2 is installed there)
partition 2 was my main win7 (which had 441 GB with all my important data- to which you had asked about important data on linux itself- not really, [i used linux far more than win7 though, and when i need to save something important i mount win7 and save it there)

partition3 i believe is win7 recovery iDisk (which was like 18gb)
and then there was like 20gb of unallocated HDD space.. (reading that i don't understand the numbers enough to tell which is which.. unfortunatly..

obviously remaining partition is ubuntu linux, which i could easily recreate if i needed to do so, so losing it... well its not as important as saving my main win7 partition (bootable of course)

[darkod]

OK, we are getting there. But you have to compare and understand that testdisk shows more possibilities. So there are more than 3 partitions in the deep search list. This helps you recover lost partitions but also sometimes it can create confusion because it might show some very old partitions you deleted on purpose.

For example, the first two in the deep search list have identical size, but are not on identical location on the disk and taking into account your last post, partition #1 in that list should be your win7 boot partition.

As for your main win7 partition, it looks like #4 is the one, because it's size is 903318881 sectors, and each sector is 512B. So that would make it 441GB or 430GiB (taken into account the 1000 vs 1024 difference). Does that sound about right?

Also, the best test is to do the deep search again, highlight the 903318881 partition and hit P. Do you see your win7 folders/files listed?

If this assumption is correct, in the deep search list you will need to set the * on the partition #1, the P on partition #4 and again P on partition #5 (iDisk partition).

That would write the partition table with the small partition as bootable, and the other two partitions as primary ntfs partitions.

[Jakin]

Okay, i shall rerun testdisk, it takes like an hour, so i wouldnt expect you to wait up now that i have abit of help, and not so much in panic mode, im in no hurry for you to reply back

[Jakin]

I believe this is how you said it appears it should be listed, and it does look right- however using " p " to check any of these, testdisk says "cannot open filesystem seems to be damaged"