Recover data from a diskpart > clean command

lonewolfs said:

While it is still scanning it found 2 lost/deleted partitions which I don't suppose I had on my drive. Am I going the wrong way?

Attachment 320295

3MB partitions are found a lot of times.... all fake stuff. It's trying to find all kind of remains of what is "possibly" a partition. You won't find anything usefull. You did overwrite start of partition!!

Try test disk instead. It's the best partition recoverer I know of.

lonewolfs said:

So I should abort the scan and scan using Testdisk? Cuz this is taking a lot of time and I am hoping that it scans the main big partition later on during scan?

Should i continue or abort and jump on testdisk?

Jump to testdisk. Just scan for lost partitions. Eventually use "deeper scan" later. Don't actually write back to disk!! First inform me, so I can confirm you're doing it correct!

lonewolfs said:

That's the Analyse option on testdisk no? Just want to be sure as I don't want to do another command line mistake hehe

1st screen: creat log file. So you can post it later.
2nd screen: select the external disk you want to analyse (the 2TB disk). It will be listed as about 1852GiB.
3rd screen: Partition table type selection: Intel
then Analyse and "quick search". Post screenshot of results

We are doing TestDisk Step By Step - CGSecurity btw. Once again.... don't write any modifications to disk yet!

"Quick scan" is running? Anything found yet? Any messages?

@GREG: On master boot record (MBR) disks, only the MBR partitioning information and hidden sector information are overwritten. On GUID partition table (GPT) disks, the GPT partitioning information, including the Protective MBR, is overwritten. If the ALL parameter is not used, the first 1MB and the last 1MB of the disk are zeroed. This erases any disk formatting that had been previously applied to the disk. The disk's state after cleaning the disk is 'UNINITIALIZED'.


What if first partition's start sector was 63 instead of 2048? Answer: Sector 63 to 2048 are zeroed by the diskpart "clean" command.