Linux swap destroys data partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
cfeigs
Posts: 3
Joined: 06 May 2020, 05:23

Linux swap destroys data partition

#1 Post by cfeigs »

I have just lost a NTFS data partition more than 900GB on my laptop and I am having difficulty retrieving it with TestDisk.

The single partition was about 75% full (~750GB). A linux swap partition (4GB) was created alongside the data partition. The data partition was lost after reboot.

In an initial attempt to restore the data partition, I performed a deep search for Intel/PC partitions. I was unable to view the files of any NTFS partitions, getting the message “Can't open filesystem. Filesystem seems damaged.”

Despite this, I marked what I believed to be the correct partition as Primary, wrote it, and then restored the boot sector from backup (boot sector was labelled as bad, backup as OK). However the partition is still can’t be accessed.

I have noticed that one of the NTFS partitions which is about the right size ends on the same sector as the start of a (deleted) Linux Swap partition, which makes me wonder if this was the cause of the loss in the first place.

Anyway, I’m lost myself, as to how to retrieve my data.

I have performed another deep search for Intel/PC partitions and pasted the log below (sorry for all the deleted partitions).

Please help. I am in a critical situation. Any assistance is greatly appreciated.


Wed May 6 15:46:40 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104858579968
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM035-1RK172, S/N:ZDE0M5YV, FW:SDM1
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - Micron_1100_MTFDDAV256TBN, S/N:171416BC7F44, FW:M0MA020

Partition table type (auto): EFI GPT
Disk /dev/sda - 1000 GB / 931 GiB - ST1000LM035-1RK172
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 P HPFS - NTFS 2 42 48 119051 181 42 1912530937
1 P HPFS - NTFS 2 42 48 119051 181 42 1912530937
No partition is bootable

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [DATA]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121601/57/56
filesystem size 1539805177
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25752 200 56 121601 57 56 1539805177
NTFS found using backup sector, blocksize=4096, 788 GB / 734 GiB
NTFS at 121601/57/56
filesystem size 1539805177
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,2,buffer,1959815173(121992/217/23)) lseek err Invalid argument
file_pread(4,1,buffer,1959815173(121992/217/23)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 217449 169 56 1539805177
NTFS, blocksize=4096, 788 GB / 734 GiB
This partition ends after the disk limits. (start=1953523711, size=1539805177, end=3493328887, disk end=1953525168)
file_pread(4,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(4,1,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(4,2,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(4,1,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(4,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525255(121601/82/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(4,7,buffer,1953525384(121601/84/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(4,7,buffer,1953525512(121601/86/30)) lseek err Invalid argument
file_pread(4,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(4,7,buffer,1953525640(121601/88/32)) lseek err Invalid argument
file_pread(4,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(4,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(4,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(4,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1788 GB / 1665 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 217449 169 56 1539805177
NTFS, blocksize=4096, 788 GB / 734 GiB

Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [DATA]
NTFS, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 25752 200 56 121601 57 56 1539805177
NTFS found using backup sector, blocksize=4096, 788 GB / 734 GiB

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [DATA]
NTFS, blocksize=4096, 1000 GB / 931 GiB
check_part_i386 failed for partition type 07
HPFS - NTFS 25752 200 56 121601 57 56 1539805177
FAT12 at 39341/124/16
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 39341/124/16
FAT12 39341 124 16 39341 169 60 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Sat Sep 15 10:37:13 2018
Linux 70545 6 54 73808 79 63 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Mon Aug 27 15:17:00 2018
Linux 70702 151 42 73965 224 51 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Mon Aug 27 15:17:00 2018
Linux 70702 184 11 73966 2 20 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Mon Aug 27 15:17:00 2018
Linux 70765 15 35 74028 88 44 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Mon Aug 27 15:17:00 2018
Linux 70765 145 37 74028 218 46 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Sat Sep 15 10:37:13 2018
Linux 83388 151 28 86651 224 37 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Sat Sep 15 10:37:13 2018
Linux 88711 90 20 91974 163 29 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Sat Sep 15 10:37:13 2018
Linux 88711 122 52 91974 195 61 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB

recover_EXT2: s_block_group_nr=0/199, s_mnt_count=13/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6553088
recover_EXT2: part_size 52424704
Filesystem created: Mon May 7 09:41:30 2018
Last mount time: Sat Sep 15 10:37:13 2018
Linux 88712 95 24 91975 168 33 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
NTFS at 100424/104/32
filesystem size 589316089
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 45 56 100424 104 32 589316089
NTFS found using backup sector, blocksize=4096, 301 GB / 281 GiB
NTFS at 119051/181/42
filesystem size 1912530937
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 42 48 119051 181 42 1912530937
NTFS found using backup sector, blocksize=4096, 979 GB / 911 GiB
Linux Swap 119051 181 43 119561 163 10 8191984
SWAP2 version 1, pagesize=4096, 4194 MB / 3999 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/31, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8000
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1024000
recover_EXT2: part_size 8192000
Filesystem created: Wed May 30 21:33:52 2018
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB
NTFS at 120581/94/25
filesystem size 1523421177
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25752 200 56 120581 94 25 1523421177
NTFS found using backup sector, blocksize=4096, 779 GB / 726 GiB
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [DATA]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121601/57/56
filesystem size 1539805177
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25752 200 56 121601 57 56 1539805177
NTFS found using backup sector, blocksize=4096, 788 GB / 734 GiB
NTFS at 121601/57/56
filesystem size 1539805177
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,2,buffer,1959815173(121992/217/23)) lseek err Invalid argument
file_pread(4,1,buffer,1959815173(121992/217/23)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 217449 169 56 1539805177
NTFS, blocksize=4096, 788 GB / 734 GiB
This partition ends after the disk limits. (start=1953523711, size=1539805177, end=3493328887, disk end=1953525168)
file_pread(4,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(4,1,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(4,2,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(4,1,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(4,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525255(121601/82/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(4,7,buffer,1953525384(121601/84/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(4,7,buffer,1953525512(121601/86/30)) lseek err Invalid argument
file_pread(4,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(4,7,buffer,1953525640(121601/88/32)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1788 GB / 1665 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 217449 169 56 1539805177
NTFS, blocksize=4096, 788 GB / 734 GiB

Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [DATA]
NTFS, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 2 42 48 119051 181 42 1912530937
NTFS found using backup sector, blocksize=4096, 979 GB / 911 GiB
HPFS - NTFS 25752 200 56 120581 94 25 1523421177
NTFS found using backup sector, blocksize=4096, 779 GB / 726 GiB
HPFS - NTFS 25752 200 56 121601 57 56 1539805177
NTFS found using backup sector, blocksize=4096, 788 GB / 734 GiB
HPFS - NTFS 25752 200 56 121601 57 56 1539805177
FAT12 39341 124 16 39341 189 16 4096 [NO NAME]
FAT12, blocksize=512, 2097 KB / 2048 KiB
HPFS - NTFS 63741 45 56 100424 104 32 589316089
NTFS found using backup sector, blocksize=4096, 301 GB / 281 GiB
Linux 70545 6 54 73808 79 63 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 70702 151 42 73965 224 51 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 70702 184 11 73966 2 20 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 70765 15 35 74028 88 44 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 70765 145 37 74028 218 46 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 83388 151 28 86651 224 37 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 88711 90 20 91974 163 29 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 88711 122 52 91974 195 61 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux 88712 95 24 91975 168 33 52424704
ext4 blocksize=4096 Large_file Sparse_SB Recover, 26 GB / 24 GiB
Linux Swap 119051 181 43 119561 163 26 8192000
SWAP2 version 1, pagesize=4096, 4194 MB / 4000 MiB
Linux 119561 163 27 120071 145 10 8192000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 4194 MB / 4000 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Linux swap destroys data partition

#2 Post by cgrenier »

Have you tried to list the files from "HPFS - NTFS 0 32 33 121601 25 24 1953519616 [DATA]" ?
Can you choose EFI GPT and list the partition table ?
Top
cfeigs
Posts: 3
Joined: 06 May 2020, 05:23

Re: Linux swap destroys data partition

#3 Post by cfeigs »

Thank you for your reply.

The partition you refer to is the one I restored. It is empty of files and directories (I was not able to view the contents before restoring, it was a bit of a stab in the dark).

I have been running a deep search using EFI GPT for the last couple of days. It's now at 21%, and has slowed considerably (I thought it had stopped completely). It's been on the same sector for the past five minutes. At the current rate, it will not complete in a practical amount of time.

EDIT: comments in brackets about file contents
Top
cfeigs
Posts: 3
Joined: 06 May 2020, 05:23

Re: Linux swap destroys data partition

#4 Post by cfeigs »

I was able to locate the primary NTFS data partition after TestDisk had complete a deeper scan using EFI GUID partition table type! :D

I located the linux swap partition, and marked both as Primary, as Logical was not available( :? ).

I then wrote this scheme. The data partition started at sector 34816. No partition was found ahead of this (might have destroyed it by attempting to write the structure above...).

I recovered the boot sector from the backup.

After that the boot sectors were identical and I restarted.

During startup, Windows began to try to repair the disk. I stopped it from doing so.

Windows was subsequently unable to read D:\ (the data partition). A message says that 'The file or directory is corrupted or unreadable'.

I ran 'chkdsk /f D:' from cmd as admin and after this I was able to access D: and all the files on it! :D :D :D

The partition is still listed as RAW however (not NTFS). Also there is a small (17MB) partition immediately ahead of D:.

Now trying to fix this issue, but the main this is the data partition has been recovered and the files are readable.

Thank you so much for this program. I tried others (like EaseUS) and was unsuccessful. Will definitely be sending a contribution to support this project!
Top
Locked

Return to “Partition Recovery”