lost partitions

[nick34210]

Hello, NOOB here.
I may in the wrong topic, I'll repost if I need to, but all the info I've found on the net said Forensics.
I'm trying to save $ by figuring this out on my own. I have a quote from EaseUS for $400 to restore my drive and thought I'd try myself first. EaseUS remoted in and gave me a jump start when I watched them Winhex to see if it could be fixed. This is my last resort, reaching out for free or cheaper help.
I have a Seagate Barracuda St 4000DM005 SN WDH2S44G SATA AF connected via usb. I have one missing bitlocker partition and one missing EFI partition. I do have the bitlocker key.
I have backed up the image with Winhex, .whx.
The MBR does not contain the correct partition information.
I tried Seagate's restore program, didn't work.
From what I read the MBR can be edited to reflect where the partitions are. I'm at a lost here looking for partition starts, stops. Searches on this drive take forever.
I have a bunch of screenshots I can share from Winhex, and AccessData FTK.
Cheers,
Nick

pic 1

Picture1.png (149.66 KiB) Viewed 8143 times

pic 2

Picture2.png (100.32 KiB) Viewed 8143 times

pic 3

Picture3.png (101.23 KiB) Viewed 8143 times

pic 5

Picture5.png (86.1 KiB) Viewed 8143 times

pic 6

Picture6.png (89.94 KiB) Viewed 8143 times

pic 4

Picture4.png (102.07 KiB) Viewed 8143 times

[fzabkar]

Can you show us sector 32768? That should be the boot sector of the missing partition.

[nick34210]

Thanks for the reply, here is sector 32768

Attachments

pic 7

[nick34210]

Looking through the sectors, i stumbled upon a sector fat32.
pic of that and next sector.
Is there a signature for bitlocker partition?
Are there any other signatures I can search for?
Cheers,
Nick

Attachments

Pic 9

[Arch Stanton]

I'd use DMDE for restoring deleted partitions.

[nick34210]

That didn't work. Anyone else?
Nick

[Arch Stanton]

That didn't work. Anyone else?
Nick

WHAT da f didn't work? This is as non descriptive as car does not start. Also if you post screenshots make them larger. And rather than sending us on wild goose chase with random screenshots post partitions TAB of DMDE.

[fzabkar]

That didn't work. Anyone else?
Nick

WHAT da f didn't work? This is as non descriptive as car does not start. Also if you post screenshots make them larger. And rather than sending us on wild goose chase with random screenshots post partitions TAB of DMDE.

+1

Like this ...

http://users.on.net/~fzabkar/DMDE/DMDE_Elements-8TB_Partitions.jpg

[Arch Stanton]

Or this https://youtu.be/XGDcQTPuubs

[nick34210]

That did find a partition I hadn't seen before. 5151635456-7814033407
Can I assume the bitlocker partion is 264192-5151635456?

Attachments

[Arch Stanton]

You can assume anything you like. We haven't got the foggiest idea what's up, you drop "one missing bitlocker partition and one missing EFI partition", there's no trace of it. You're missing stuff without telling us what happened in the first place and then you send us on a wild goose chase with some screenshots. We ask for bigger ones, next one is tiny again.

Since the last screenshot I asked for, I will comment on it.

* I'd check what's in sector 7814035455.

* The 2 'found' partitions can not co-exist, they overlap.

* The partition with label 4 TB part 2 appears to be complete although DMDE checks are limited. Again, if you restore this partition then that makes $Volume 01 impossible.

Then if you insist on an EFI partition I'd be looking for FAT boot records. If found see if that leads to a complete volume, if not restoring it is moot. From a data recovery perspective it does not have any priority.

Based on what's in 7814035455 I'd see if it's worth restoring it and add partition to tables.

[nick34210]

My drive was working fine. 1) bitlocker partition and 1)NTFS (so i recently discovered.
My Drive stopped recognizing both partitions and said 4tb unallocated space.
They are screenshots saved as images and uploaded to the forum. When I look at them I double click to open the image (on the forum) and have no issues zooming in. Not sure how to make them bigger.
I added the sector you requested.
I understand the 2 partitions overlap. What I believe has to happen is manually edit the mbr to reflect the start and stops of the partitions.
I believe volume 1 is the bitlocker partition from the signature in picture 9 showing FVE.
I have found a fat partition, it is the volume 1 in picture 9, it shows fat32

Attachments

[Arch Stanton]

OMG, why you block ascii portion?!?!?!?!

[Arch Stanton]

NVM, done with this.