8 GB iso file written to beginning of 4TB UEFI formatted hdd.

[nusserat]

Hi,
Could you suggest what to do.
I have a HGST 4TB HDD that I used as an archive disk.
It is partitioned as one whole drive with GUID partition table and had an approximately 100MB EFI partition under windows 7 with a NTFS file system.
Now the partition table is gone since I wrote an approximately 8GB iso image on it. I used the linux dd command to write the iso image to the HGST.
I had movies, documents, pdfs and much more on the hdd that I will sourly miss if I do not get it back.
I have an other hdd that had an earlier iteration of the file structure on it. I.e. once upon a time the I copied the whole file system from one disk to the other by drag and drop. But they were not an exact match, the one that is not destroyed has some sort of strange partition table since I used a software to be able to access the whole drive before my bios could do it. software from the company paragon.
so to recap:
A 4TB hdd with overwritten EFI partition.
I have a partial file structure of the destroyed partition table.
I know it is approximately 8 GB of iso file written to the beginning of the hdd.
I can to some extent copy files to the other hdd since I have two large archive hdds not just the one that got destroyed.
I can use programs in windows 7 or in linux to get the information back.

What steps and programs do you suggest I should do/use?

 

[Jared]

I would scan the drive with either R-Studio Demo or UFS Explorer Demo and see how much of the file system it is able to rebuild.

The old drive you did the drag and drop will be of no use as that type of copy doesn't put files back in their same sector locations.

 

[nusserat]

I have a couple of questions.
When I read about gpt partitions it says it has a secondary gpt which to my knowledge is a copy of the first, so there should be a copy of the partition table stored at the end of the hdd.
I looked at https://en.wikipedia.org/wiki/GUID_Partition_Table perhaps I misunderstood?

Since I wrote a iso-file with partition type DVD iso, i.e. UDF bridge format. I should be able to detect where the partition starts and ends.
Then if I have an gpt partition table, can it not be edited to regard all files that existed in the overwritten place to be lost and that there are empty space there.
Then I must have a program that can build a new EFI partition and place the new updated partition table there.
Is this possible?


I scanned the hdd to search for lost partitions with UFS Explorer and can not understand what I got back.
The scan gives back 50+ partitions, I had one originally. A link to the printout https://imgur.com/A171FQP
How can I decipher this?
Is there a text I can read about this, I find the manual at UFS's home page very lacking.

 

[LarrySabo]

I can't answer your questions but just want to suggest you try ReclaiMe File Recovery. It is exceptional at rebuilding file systems.

 

[Jared]

Yes, there is a backup copy of the GPT at the end of the drive. It's fairly easy to restore that using a program like TestDisk to put the partition back. However, most data recovery software (such as UFS which you mention) will automatically read the backup table and find the partition bounds.

Depending on what you originally did, it's likely that other metadata such as the MFT are overwritten. Your issue is likely much more than just the partition table.