Data Recovery Case File · Portable Drives · More Anchors Than Usual
Three Filesystems Mean Three Sets of Markers to Find
His enquiry describes a familiar mistake on an unusually well-furnished drive. A 3TB external carrying three partitions in two different filesystems, onto which he "mistakenly flashed an image instead of a flash drive, so the original data and partitions are no longer accessible." An image write covers the beginning of a drive — and a drive divided into three volumes has structures at three separate places, most of which sit well beyond anything the write reached.
| Media | 3TB external hard drive carrying three partitions across two filesystem types — disk image written to the device in error, replacing the partition structure |
| Reported situation | External drive divided into three partitions using two different filesystems · installation image written to the drive in error · partition structure replaced · original volumes not accessible · contents required |
| Fault class | Sequential overwrite from the start of the medium — partition table replaced and leading region covered; volume structures beyond the written extent intact |
| Equipment used | Written extent measured against capacity before any conclusion · filesystem markers located by signature for each volume type · volume boundaries derived from surviving structures rather than from the partition table · imaged write-blocked before any reconstruction · files validated by opening |
The decode: what an image write covers, and what it leaves
What writing an image to a device does: replaces it sequentially from the first sector. It does not create a file on the drive — it becomes the drive, which is why selecting the wrong destination is so consequential and why the tools warn about it.
How far it reaches: as far as the image is large. An installation image is measured in gigabytes and his drive in terabytes, so the write covered a small fraction at the beginning and stopped, leaving the overwhelming majority of the medium untouched.
What was lost in that fraction: the partition table at the very start, and whatever lay in the leading portion of the first volume. The partition table is the map — which is why all three volumes disappeared at once, despite only one of them being physically written over.
Why the second and third volumes are almost certainly complete: they begin well beyond the region an image reaches. Their structures, their contents and their own internal records are exactly as they were — undescribed rather than damaged, in the same way that losing an index does not remove chapters.
Why the mixed filesystem layout is genuinely helpful: different filesystem types identify themselves with different markers at different offsets from a volume's start. Three volumes across two types gives three independent sets of recognisable structures to locate, and finding any one of them establishes a boundary directly rather than by inference.
How that reconstructs the whole layout: locating each volume's start and reading its own record of its size gives the partition arrangement back without the table. The drive describes itself, once you stop asking the map and start asking the territory.
Why both filesystem families keep spare copies: each maintains duplicates of its key structures away from the primary set, precisely so that damage at the start is survivable. Those copies sit far beyond an image write.
What must not happen: nothing further written, and no repartitioning. The system will now see a drive laid out as installation media and will offer to prepare it, which is the one action that would reach the untouched regions.
On the bench
Written extent was measured against capacity before any conclusion — an image write replacing a device sequentially from the first sector and extending only as far as the image is large, which on a multi-terabyte drive covers a small leading fraction. Filesystem markers were located by signature for each volume type, differing filesystem families identifying themselves by distinct markers at distinct offsets, and volume boundaries derived from surviving structures rather than from the partition table.
The outcome
The written extent measured, each volume located by its own markers, and boundaries derived from surviving structures. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: an image write covers only as far as the image is large, which on a multi-terabyte drive is a small leading fraction. All three volumes vanished because the map went — but two of them were never physically reached.
Installation image written to the wrong drive
Refuse any offer to prepare or reformat it — the system now sees a drive laid out as installation media and will suggest exactly that, which is the one action reaching the untouched regions. The arithmetic is in your favour: an image write replaces a device sequentially from the first sector and extends only as far as the image is large, so on a multi-terabyte drive it covers a small leading fraction. All your volumes disappeared because the partition table at the very start went, not because they were written over. Volumes beyond the first are almost certainly complete, and each filesystem carries its own markers to find them by.
Refuse the prepare prompt — call Easy Data Recovery on 028 9002 0144; written extent measured against capacity, each volume located by its own filesystem markers, boundaries derived from surviving structures.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.