You may be right about exfat. It isn't too widely used so you might have problems finding software that supports it. Your problem now isn't just that there isn't a partition table but that since windows doesn't know that anything is there it considers the entire drive fair game and can at any time overwrite a sector that one of your pictures resides on. Good luck but don't expect to get everything back.
The recovery is still running, but so far the results on my 1TB drive are promising although not perfect. There are a lot of corrupt CR2 (Canon RAW photo files), which is disappointing as those are the ones I was most keen to save. JPGs seem fine, but I haven't been shooting JPG files for the last six months. Perhaps the strangest bit is that when recovering the same batch of files, occasionally one will be corrupt at the first attempt but not at the second. I think I'm going to contact the software developers to see if this is an issue with the way the files are being recovered. As these photos were backed up onto the other drive that I also wiped the partition table on I'm hoping that I'll be able to extract uncorrupted copies of those files from the backup. A number of pieces of GoPro footage also won't open, but I haven't looked at them much. At first I thought it was down to filesize (the GoPro footage is about 4gb a file, and the CR2 files are relatively large picture files at 25-30mb each) but I successfully opened a 4gb ISO file.
Actually my understanding is that without a partition table the OS can't write to the drive, for the same reason it can't read from it, so the OS shouldn't be able to overwrite any of the data. The issue is whether enough of the partition table can be resurrected to make it readable again.
I have been watching this thread but did not want to enter because the 1TB drive was exFat and the other one HFS+exFAT.
OK, today I got to work on it atleast on the exFat drive - I have no clue still about the HFS+exFat - and have picked up courage to have a go with it.
I created a single exFat volume on my 750GB trial drive and copied some jpgs into it. Using bootice I viewed the partition structure. Sector 0 had the MBR code and partition table. Sector 1-2047 was all zeros. Sector 2048 had the volume bootsector. I zeroed sector 0. So now sectors 0 to 2047 is all zeroes - the same that would be when you run diskpart clean. After this when I opened Windows Disk Management, it asked to be initialised. I didn't, for I want to recover the data without doing that.
Partition Wizard - Quick Scan did not find the volume boot sector at 2048. Conclusion: PW cannot handle exFat. It is blind.
TestDisk was sucessful in finding the partition and writing it to sector 0. Drive accessible again after a reboot.
So if what you have done is only diskpart clean, and we can confirm that sectors 0 - 2047 are all 00s and sector 2048 still has the volume boot sector, you should be able to recover the drive.
After you finish with your current data recovery process, install Bootice 64 bit version on your Windows 10 64bit machine to which the 1TB external drive is connected, examine and confirm that sectors 0 to 2047 are all 00s and sector 2048 still has the volume boot sector. Post a screenshot of sector 2048.
Lost partitions!
Last edited by jumanji; 14 Jul 2016 at 17:40.
Hi Jumanji, thanks for looking into this, I really appreciate it. I've had partial success with file recovery software, but there are a lot of damaged files and verifying which are good and which aren't is an enormous task.
I've installed Bootice and looked at both the 1tb ExFAT and 500gb ExFAT/HFS drives and they show very similar results, although they differ from yours. Sector 0 of each drive is almost but not entirely zeroes, sectors 2-2049 are all zeroes, and sector 2050 is the first sector after sector 0 with data. Sector 2050 of each drive has identical first and last lines, but to avoid confusion I have only posted screenshots of the 1tb ExFAT drive.
Sector 0
Sector 2050
A couple of other points which may or may not be relevant:
- The last 2048 sectors (i.e. 1,953,456,128 to 1,953,458,175) of the 1tb drive are also zeroes (my understanding is that diskpart clean zeroes the first and last 2mb of the drive)
- Immediately after running diskpart clean I rebooted. When the drives didn't show up I opened Windows Disk Management and inadvertently re-initialised the drives. I then ran diskpart clean again, thinking that would put me back in the situation I was in prior to initialising the drives. I successfully recovered the NTFS partition on my 2tb drive after doing this, so I hope no further damage was done
- A couple of days ago I ran testdisk again on the 1tb drive, using the 'none' partition table option. As with the 'Intel' and 'GPT' attempts it found numerous partitions, but no ExFAT partitions. However DMDE did find traces of the ExFAT partitions on both the 1tb and 500gb drives, although it doesn't seem to have a partition recovery option and didn't manage to extract all the files
- I am now reasonably (80%) certain that all the drives were using MBR. All are WD Passport drives and I bought another WD 2tb drive to use for data recovery, and that is using MBR. All the other drives are older and I don't believe I converted them to GPT at any point - though it's possible (I think unlikely) that OSX may have done so for the 500gb drive
- The 1tb drive is very much the drive I want to save. I think the 500gb drive only had training footage and the backup of my photos on it - whilst it would be a shame to lose some of the footage, it's by no means a disaster
Thanks again!
Last edited by CurlyBen; 14 Jul 2016 at 23:08.
I've just been looking at the 'Templates' in Bootice, and I see that in the template for an NTFS partition there are entries for the start cluster of $MFT and $MFTMirror, so if I'm understanding it correctly the file tables are not located in the first 2048 sectors and so aren't wiped by diskpart clean. When partition recovery software runs, is it these file tables it looks for and finds to recreate the partition? I can't see an equivalent entry for file tables in the ExFAT template, and I'm wondering if this is why recovering ExFAT partitions is harder. Apologies if this is a complex question, I'm just trying to understand a little better how the partition system works.
If it's of any use, I've attached a screenshot of the DMDE search results for the 1tb disk. Testdisk also found a lot of HFS/HFS+ partitions on this drive, which surprised me as I don't recall having had any on there, but not the ExFAT partitions. DMDE doesn't support HFS, and I only scanned for NTFS and ExFAT partitions (Testdisk found some FAT12 and FAT16 partitions, but they were megabytes in size with labels such as 'Boot'). The documentation for DMDE isn't great, and for example I'm not sure why there are two figures in the '%' column.
As far as I know and perceive exFat does not have MFT but only File Allocation Table. ( I am just learning about exFat because of your problem, and that is still not complete)
Your sector 0 does show it as an MBR drive but without the partition table. ( an external drive really does not need the MBR code)
I want to see sector 2048 ( seeing is believing
I do not know much about DMDE and so cannot comment on it. But on my recommendation atleast one user used DMDE , learnt about it with his own effort and successfully retrieved the hidden space on his HDD. I commented I had to learn using DMDE from him :).
Unfortunately my sector 2048 doesn't look like yours!
I have set DMDE searching for the string "EXFAT" (I couldn't see a search command in Bootice) so I'll report back if it finds anything.
OK, the exFAT volume bootsector is missing. I have to do some more experimentation now and see what could be done to retrieve that situation. Will take quite sometime. shall return after another 10 hours from now.
Whatever you do, try not to write anything on the drive. ( I have a lingering fear using the drive with MacOS could have written something on your exFat drive and spoilt it. Apple and Microsoft don't go well together.)
Quote
