Repairing an NTFS

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#21 Post by veleiro »

Sat Mar 17 19:31:29 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=159934054400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=8066271232
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000202241024
file_pread(4,1,buffer,312581919(73444/223/19)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 73444 224 19, sector size=512 - WDC WD1600JB-00EVA0, S/N:4457572d414d4b45303332343534 034 0 0 0 0, FW:15.05R15
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EADS-11M2B2, S/N:2020202057202d44435756414335313134383337, FW:80.00A80
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500KS-00MJB0, S/N:2020202057202d4443574e41334b313539353935, FW:02.01C03
Drive E: - 8066 MB / 7692 MiB - CHS 1923 64 32, sector size=2048 - ASUS DRW-1608P3S, FW:1.06

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD10EADS-11M2B2
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
Change partition type:
1 P FAT32 LBA 0 1 1 121600 254 63 1953520002

fat32_boot_sector
1 P FAT32 LBA 0 1 1 121600 254 63 1953520002
Boot sector
Bad

Backup boot sector
Bad

Sectors are identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

1 P FAT32 LBA 0 1 1 121600 254 63 1953520002
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=6873331, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
No FAT found, reserved=0, fat_length=0
find_sectors_per_cluster skip_sectors=89425 (skip_offset=45785600)
file_pread(5,16,buffer,1927445824(119977/243/11)) read err: Invalid argument
file_pread(5,16,buffer,1927446961(119978/6/14)) read err: Invalid argument
file_pread(5,1,buffer,1927446977(119978/6/30)) read err: Invalid argument
file_pread(5,1,buffer,1927446978(119978/6/31)) read err: Invalid argument
file_pread(5,1,buffer,1927446979(119978/6/32)) read err: Invalid argument
file_pread(5,1,buffer,1927446980(119978/6/33)) read err: Invalid argument
file_pread(5,1,buffer,1927446981(119978/6/34)) read err: Invalid argument
file_pread(5,1,buffer,1927446982(119978/6/35)) read err: Invalid argument
Can't find cluster size

fat32_boot_sector
1 P FAT32 LBA 0 1 1 121600 254 63 1953520002
Boot sector
Bad

Backup boot sector
Bad

Sectors are identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#22 Post by veleiro »

I don't understand how this could be so difficult.

The USB input on the external drive circuit board came out, so for a while I held the connector to the circuit board in order to get some files off of it (assuming that when I had the chance to plug it into my desktop, that I would be able to access everything). So I took it on a plane to get back home in my carryon, I plug it up to a Windows7 computer here that hasn't been used for 6 months and the original post explains the rest.

Maybe I don't understand enough about drives, but arent all NTFS partition tables the same? Doesnt the first part of the hard disk only say what kind of FS it is, then once it knows that, it knows how to display the files (even if they are fragmented)?

To me this whole process tells me that it is not like that, but something more like the partition tables contain the structure for every file on the drive.

Seriously though, I've had more luck with a head crash on a drive.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#23 Post by Fiona »

Would it be possible that your disk was encrypted?
Pretty similar like in this case?;
http://community.wdc.com/t5/My-Book-for ... d-p/279208

Because, it's strange that not even GetDataBack found any piece of data?

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#24 Post by veleiro »

It is very possible, and likely, now that I see this link. This seems to be my exact problem. Now that I think about it, this is my problem. Basically, I tried photorec to see what I could recover, and I got a bunch of nonsense 2-8 GB files.

However, since Windows 7 wrote a MBR and drive letter to it, via SATA, as I explained in the first post, is it possible that I forever messed it up? What would happen if I were to reconnect it via USB through the circuit board, could I analyze my drive and find a backup NTFS?

I am really hoping that by the encryption process, the entire drive isnt encrypted and fragmented :|

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#25 Post by Fiona »

Maybe hardware encryptet?
I assume that you didn't do anything about encryption?
So it might be important to get it repaired or another enclosure to test it.

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#26 Post by veleiro »

Fiona wrote:Maybe hardware encryptet?
I assume that you didn't do anything about encryption?
So it might be important to get it repaired or another enclosure to test it.
Yes, it is hardware encrypted. The circuit board has a key chip on it

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#27 Post by Fiona »

If you get it decrypted, it shouldnt be a problem.
TestDisk finds your partition using boot sectors and their backup.
So you can register your partitions into your partition table.
But decryption should be done first.

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#28 Post by veleiro »

Fiona wrote:If you get it decrypted, it shouldnt be a problem.
TestDisk finds your partition using boot sectors and their backup.
So you can register your partitions into your partition table.
But decryption should be done first.
Do I need to change drive type and cylinders back to what they were before I changed it to 121600, like 0 0 1 121601 254 63 1953536067? or it doesn't matter for the deencryption?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#29 Post by Fiona »

Currently it doesn't matter.
After encryption you can diagnose your disk.
That partition was only an empty partition to diagnose your boot sector and it didn't work.
So there is nothing else changed.
If your hdd gets recognized correctly and contains data, we'll able to repeat your diagnose.

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#30 Post by veleiro »

Ok I reattached it to the same circuit board, and I expect better results now. I did Quick Search, and deeper, and got these results. It is seeing 2 Fat32 LBA now:




Tue Mar 20 03:06:11 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=999501594624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500106780160
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=999501594624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=350245355520
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=148999995392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\H:
file_pread(4,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1952154539(121515/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A362, S/N:3031393038304350344730324c56424b5a48434c, FW:PC4ACB1E
Disk /dev/sdc - 999 GB / 930 GiB - CHS 121515 255 63, sector size=512 - WD My Book 1110, S/N:WCAV5C118473, FW:2003

Partition table type (auto): Intel
Disk /dev/sdc - 999 GB / 930 GiB - WD My Book 1110
Partition table type: Intel

Analyse Disk /dev/sdc - 999 GB / 930 GiB - CHS 121515 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdc - 999 GB / 930 GiB - CHS 121516 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 999 GB / 930 GiB - CHS 121516 255 63
BAD_RS LBA=688359297 13830530
check_part_i386 failed for partition type 0C
FAT32 LBA 42848 98 4 212427 97 24 2724286593
This partition ends after the disk limits. (start=688359297, size=2724286593, end=3412645889, disk end=1952154540)
BAD_RS LBA=4222369438 15825225
file_pread(5,3,buffer,4222369438(262830/87/8)) lseek err Invalid argument
file_pread(5,1,buffer,4222369438(262830/87/8)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 262830 87 8 288913 239 26 419032990
This partition ends after the disk limits. (start=4222369438, size=419032990, end=346435131, disk end=1952154540)
BAD_RS LBA=1888703368 2968225
check_part_i386 failed for partition type 0C
FAT32 LBA 117566 88 35 117767 173 20 3234406
file_pread(5,7,buffer,1952151553(121515/207/38)) lseek err Invalid argument
file_pread(5,8,buffer,1952151560(121515/207/45)) lseek err Invalid argument
file_pread(5,3,buffer,1952151568(121515/207/53)) lseek err Invalid argument
file_pread(5,3,buffer,1952151615(121515/208/37)) lseek err Invalid argument
file_pread(5,8,buffer,1952151631(121515/208/53)) lseek err Invalid argument
file_pread(5,11,buffer,1952151678(121515/209/37)) lseek err Invalid argument
file_pread(5,2,buffer,1952153600(121515/240/6)) lseek err Invalid argument
Disk /dev/sdc - 999 GB / 930 GiB - CHS 121516 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (999 GB / 930 GiB) seems too small! (< 2376 GB / 2213 GiB)
The following partitions can't be recovered:
FAT32 LBA 42848 98 4 212427 97 24 2724286593
FAT32 LBA 262830 87 8 288913 239 26 419032990

Results
L FAT32 LBA 117566 88 35 117767 254 63 3239552

interface_write()
1 E extended LBA 117566 88 1 117767 254 63 3239586
5 L FAT32 LBA 117566 88 35 117767 254 63 3239552

search_part()
Disk /dev/sdc - 999 GB / 930 GiB - CHS 121516 255 63
BAD_RS LBA=688359297 13830530
check_part_i386 failed for partition type 0C
FAT32 LBA 42848 98 4 212427 97 24 2724286593
This partition ends after the disk limits. (start=688359297, size=2724286593, end=3412645889, disk end=1952154540)
BAD_RS LBA=4222369438 15825225
file_pread(5,3,buffer,4222369438(262830/87/8)) lseek err Invalid argument
file_pread(5,1,buffer,4222369438(262830/87/8)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 262830 87 8 288913 239 26 419032990
This partition ends after the disk limits. (start=4222369438, size=419032990, end=346435131, disk end=1952154540)
BAD_RS LBA=1888703368 2968225
check_part_i386 failed for partition type 0C
FAT32 LBA 117566 88 35 117767 173 20 3234406
file_pread(5,7,buffer,1952151553(121515/207/38)) lseek err Invalid argument
file_pread(5,1,buffer,1952151553(121515/207/38)) lseek err Invalid argument
file_pread(5,8,buffer,1952151560(121515/207/45)) lseek err Invalid argument
file_pread(5,3,buffer,1952151568(121515/207/53)) lseek err Invalid argument
file_pread(5,3,buffer,1952151615(121515/208/37)) lseek err Invalid argument
file_pread(5,8,buffer,1952151631(121515/208/53)) lseek err Invalid argument
file_pread(5,11,buffer,1952151678(121515/209/37)) lseek err Invalid argument
file_pread(5,2,buffer,1952153600(121515/240/6)) lseek err Invalid argument
Disk /dev/sdc - 999 GB / 930 GiB - CHS 121516 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (999 GB / 930 GiB) seems too small! (< 2376 GB / 2213 GiB)
The following partitions can't be recovered:
FAT32 LBA 42848 98 4 212427 97 24 2724286593
FAT32 LBA 262830 87 8 288913 239 26 419032990

Results
L FAT32 LBA 117566 88 35 117767 254 63 3239552

interface_write()
1 E extended LBA 117566 88 1 117767 254 63 3239586
5 L FAT32 LBA 117566 88 35 117767 254 63 3239552
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
write_all_log_i386: CHS: 117566/88/1,lba=1888703334

TestDisk exited normally.
Attachments
screen 5.jpg
screen 5.jpg (80.58 KiB) Viewed 13652 times

Locked