Once you have all the positions, create the exact same layout. There might be random garbage that looks enough like a filesystem header anywhere on the disk to fool file. Don't just bruteforce it though, check around the positions they should be at. This way you'll know when you found each type. You remember the approximate sizes and the order, so there is a chance.įor the ext4 partition, file would say something like: /dev/stdin: Linux rev 1.0 ext4 filesystem data, UUID=52e69144-d086-54a3-882c-97fa6985226f, volume name 'proot20210224' (needs journal recovery) (extents) (64bit) (large files) (huge files)įor each type of filesystem, you can create it in a regular file, and then check what file says about them. You might have to check multiples of 512 bytes instead of whole megabytes. Tweak the skip= parameter until you find it. If it just says /dev/stdin: data, you got the wrong position. Or this: /dev/stdin: DOS/MBR boot sector, code offset 0x52+2, OEM-ID 'NTFS ', sectors/cluster 8, Media descriptor 0xf8, sectors/track 0, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor) NTFS, sectors 204799, $MFT start cluster 4, $MFTMirror start cluster 12799, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 064baf16e1b371b26 file would then say something like this: /dev/stdin: DOS/MBR boot sector, code offset 0x58+2, OEM-ID 'mkfs.fat', Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 2048, sectors 524286 (volumes > 32 MB), FAT (32 bit), sectors/FAT 4033, reserved 0x1, serial number 0x7109f176, label: 'EFI20210224'

You say the first partition was a windows recovery partition, probably NTFS or FAT.

To look at the second megabyte of your disk (probably the start of the first partition) try this: dd if=/dev/sdb bs=1M skip=1 count=1 | file. But there is no guarantee that this was the case. The first one often starts at 1 MB, and they tend to be aligned to whole megabytes. First of all, if any of those screenshots shows the original state, that could be enough information to recover it. You need to find where your partitions start. I don't know what the windows tool did, but assuming it just deleted the partition table, there is a chance.

Testdisk 7.2 data recovery