All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 14 posts ] 
Author Message
 Post subject: lost partitions
PostPosted: January 2nd, 2023, 12:26 
Offline

Joined: December 31st, 2022, 14:08
Posts: 6
Location: USA Florida
Hello, NOOB here.
I may in the wrong topic, I'll repost if I need to, but all the info I've found on the net said Forensics.
I'm trying to save $ by figuring this out on my own. I have a quote from EaseUS for $400 to restore my drive and thought I'd try myself first. EaseUS remoted in and gave me a jump start when I watched them Winhex to see if it could be fixed. This is my last resort, reaching out for free or cheaper help.
I have a Seagate Barracuda St 4000DM005 SN WDH2S44G SATA AF connected via usb. I have one missing bitlocker partition and one missing EFI partition. I do have the bitlocker key.
I have backed up the image with Winhex, .whx.
The MBR does not contain the correct partition information.
I tried Seagate's restore program, didn't work.
From what I read the MBR can be edited to reflect where the partitions are. I'm at a lost here looking for partition starts, stops. Searches on this drive take forever.
I have a bunch of screenshots I can share from Winhex, and AccessData FTK.
Cheers,
Nick
Attachment:
File comment: pic 1
Picture1.png
Picture1.png [ 149.66 KiB | Viewed 6179 times ]

Attachment:
File comment: pic 2
Picture2.png
Picture2.png [ 100.32 KiB | Viewed 6179 times ]

Attachment:
File comment: pic 3
Picture3.png
Picture3.png [ 101.23 KiB | Viewed 6179 times ]

Attachment:
File comment: pic 5
Picture5.png
Picture5.png [ 86.1 KiB | Viewed 6179 times ]

Attachment:
File comment: pic 6
Picture6.png
Picture6.png [ 89.94 KiB | Viewed 6179 times ]

Attachment:
File comment: pic 4
Picture4.png
Picture4.png [ 102.07 KiB | Viewed 6179 times ]


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 2nd, 2023, 22:59 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Can you show us sector 32768? That should be the boot sector of the missing partition.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 3rd, 2023, 9:25 
Offline

Joined: December 31st, 2022, 14:08
Posts: 6
Location: USA Florida
Thanks for the reply, here is sector 32768


Attachments:
File comment: pic 7
Picture7.png
Picture7.png [ 118.31 KiB | Viewed 6136 times ]
Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 3rd, 2023, 10:06 
Offline

Joined: December 31st, 2022, 14:08
Posts: 6
Location: USA Florida
Looking through the sectors, i stumbled upon a sector fat32.
pic of that and next sector.
Is there a signature for bitlocker partition?
Are there any other signatures I can search for?
Cheers,
Nick


Attachments:
Picture10.png
Picture10.png [ 148.48 KiB | Viewed 6132 times ]
File comment: Pic 9
Picture9.png
Picture9.png [ 135.98 KiB | Viewed 6132 times ]
Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 3rd, 2023, 10:08 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
I'd use DMDE for restoring deleted partitions.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 6th, 2023, 10:04 
Offline

Joined: December 31st, 2022, 14:08
Posts: 6
Location: USA Florida
That didn't work. Anyone else?
Nick


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 6th, 2023, 12:17 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
nick34210 wrote:
That didn't work. Anyone else?
Nick


WHAT da f didn't work? This is as non descriptive as car does not start. Also if you post screenshots make them larger. And rather than sending us on wild goose chase with random screenshots post partitions TAB of DMDE.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 6th, 2023, 15:41 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Arch Stanton wrote:
nick34210 wrote:
That didn't work. Anyone else?
Nick


WHAT da f didn't work? This is as non descriptive as car does not start. Also if you post screenshots make them larger. And rather than sending us on wild goose chase with random screenshots post partitions TAB of DMDE.

+1

Like this ...

http://users.on.net/~fzabkar/DMDE/DMDE_Elements-8TB_Partitions.jpg

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 6th, 2023, 16:41 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
Or this https://youtu.be/XGDcQTPuubs

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 8th, 2023, 17:33 
Offline

Joined: December 31st, 2022, 14:08
Posts: 6
Location: USA Florida
That did find a partition I hadn't seen before. 5151635456-7814033407
Can I assume the bitlocker partion is 264192-5151635456?


Attachments:
pic12.png
pic12.png [ 42.14 KiB | Viewed 5771 times ]
Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 11th, 2023, 16:09 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
You can assume anything you like. We haven't got the foggiest idea what's up, you drop "one missing bitlocker partition and one missing EFI partition", there's no trace of it. You're missing stuff without telling us what happened in the first place and then you send us on a wild goose chase with some screenshots. We ask for bigger ones, next one is tiny again.

Since the last screenshot I asked for, I will comment on it.

* I'd check what's in sector 7814035455.

* The 2 'found' partitions can not co-exist, they overlap.

* The partition with label 4 TB part 2 appears to be complete although DMDE checks are limited. Again, if you restore this partition then that makes $Volume 01 impossible.

Then if you insist on an EFI partition I'd be looking for FAT boot records. If found see if that leads to a complete volume, if not restoring it is moot. From a data recovery perspective it does not have any priority.

Based on what's in 7814035455 I'd see if it's worth restoring it and add partition to tables.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 11th, 2023, 19:20 
Offline

Joined: December 31st, 2022, 14:08
Posts: 6
Location: USA Florida
My drive was working fine. 1) bitlocker partition and 1)NTFS (so i recently discovered.
My Drive stopped recognizing both partitions and said 4tb unallocated space.
They are screenshots saved as images and uploaded to the forum. When I look at them I double click to open the image (on the forum) and have no issues zooming in. Not sure how to make them bigger.
I added the sector you requested.
I understand the 2 partitions overlap. What I believe has to happen is manually edit the mbr to reflect the start and stops of the partitions.
I believe volume 1 is the bitlocker partition from the signature in picture 9 showing FVE.
I have found a fat partition, it is the volume 1 in picture 9, it shows fat32


Attachments:
Picture13.png
Picture13.png [ 240.26 KiB | Viewed 5609 times ]
Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 11th, 2023, 19:46 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
OMG, why you block ascii portion?!?!?!?!

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: lost partitions
PostPosted: January 11th, 2023, 19:54 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
NVM, done with this.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group