Microsoft reserved partition can't be recovered Topic is solved

[Popinaodude]

Hi there,

I accidentally wiped my partitions when trying to clone my drive to a larger drive. I have a dual boot debian/windows 10 lenovo laptop, and was trying to transfer my OS drive from a 1TB SSD to a 2TB SSD. I used clonezilla to clone my drive to the new drive, trying to have all the extra space on the drive in the windows partition. From lack of experience I ended up using sgdisk backwards, copying the empty 2TB partition onto my full 1TB drive. (why would the first argument be the target drive? mental)

Onto the matter at hand. I made a new windows installation on the new drive and am using testdisk on the old drive to try and recover my data. My important data is backed up but I would really rather not have to reinstall debian from scratch because it took me about a week to get it done properly the first time. When using a quick search, it is able to see all the partitions HOWVER, I get the following error:

Code: Select all

The harddisk (1024 GB / 953 GiB) seems too small! (< 2047 GB / 1907 GiB)                                                
Check the harddisk size: HD jumper settings, BIOS detection...                                                                                                                                                                                 

The following partition can't be recovered:                                                                             
     Partition               Start        End    Size in sectors                                                       
 >  MS Data               2000408575 3999557630 1999149056  
 

This is the output of the quick search:

Code: Select all

Disk /dev/sdc - 1024 GB / 953 GiB - CHS 124519 255 63                                                                   
     Partition               Start        End    Size in sectors                                                        
     >P MS Data                     2048    1085439    1083392 [Recovery]                                                    
      D EFI System               1085440    1290239     204800 [EFI System Partition] [NO NAME]                              
      D MS Data                  1259520 2000408575 1999149056                                                               
      D MS Data                  1323008 1576962047 1575639040                                                               
      D Linux filesys. data   1576962048 1933463551  356501504                                                               
      D Linux Swap            1933463552 2000408559   66945008      

You can see that the 2nd MS Data partition goes from 1259520 to the end of the drive, when it should end at 1323008. Is there a way to manually change the size? would that solve the problem? I have a record of what the partition table should look like from fdisk, which I give below:

Code: Select all

Device              Start        End    Sectors   Size Type
/dev/nvme0n1p1       2048    1085440    1083392   529M Windows recovery environment
/dev/nvme0n1p2    1085440    1290239     204800   100M EFI System
/dev/nvme0n1p3    1259520    1323008      32768    16M Microsoft reserved
/dev/nvme0n1p4    1323008 1576962047 1575639040 751.3G Microsoft basic data                        
/dev/nvme0n1p5 1576962048 1933463551  356501504   170G Linux filesystem                               
/dev/nvme0n1p6 1933463552 2000408559   66945008  31.9G Linux swap

• Is it at all possible to recover this drive so that it is bootable?
• Which should be the bootable partition?
• In the documentation I see that there's a way to mark a partition as bootable, but I don't seem to be able to do it using testdisk_win.exe. The option isn't there.
• Should all paritions be marked as Primary so that they are not deleted?
  
  I would post the log file here but it is too long. Where can I put it do that you can see it? I don't see a place to upload a .txt file

[recuperation]

This is the output of the quick search:

Code: Select all

Disk /dev/sdc - 1024 GB / 953 GiB - CHS 124519 255 63                                                                   
     Partition               Start        End    Size in sectors                                                        
     >P MS Data                     2048    1085439    1083392 [Recovery]                                                    
      D EFI System               1085440    1290239     204800 [EFI System Partition] [NO NAME]                              
      D MS Data                  1259520 2000408575 1999149056                                                               
      D MS Data                  1323008 1576962047 1575639040                                                               
      D Linux filesys. data   1576962048 1933463551  356501504                                                               
      D Linux Swap            1933463552 2000408559   66945008      

You can see that the 2nd MS Data partition goes from 1259520 to the end of the drive, when it should end at 1323008. Is there a way to manually change the size?

The only way with Testdisk I found is to reenter the whole partition table, not just one entry.

would that solve the problem?

No. Depending on the amount of overwritten data, dammage on your 1TB may vary substantially. The type of the filesystem written plays a role as well.

I have a record of what the partition table should look like from fdisk, which I give below:

Code: Select all

Device               Start        End    Sectors   Size Type
/dev/nvme0n1p1       2048    1085440    1083392   529M Windows recovery environment
/dev/nvme0n1p2    1085440    1290239     204800   100M EFI System
/dev/nvme0n1p3    1259520    1323008      32768    16M Microsoft reserved
/dev/nvme0n1p4    1323008 1576962047 1575639040 751.3G Microsoft basic data                        
/dev/nvme0n1p5 1576962048 1933463551  356501504   170G Linux filesystem                               
/dev/nvme0n1p6 1933463552 2000408559   66945008   31.9G Linux swap

Having the table is a good thing. Unfortunately there are overlapping partitions:
/dev/nvme0n1p1 overlaps /dev/nvme0n1p2
/dev/nvme0n1p3 overlaps /dev/nvme0n1p4
Both overlap by one sector. Testdisk may refuse that as an invalid structure.

[*]Is it at all possible to recover this drive so that it is bootable?

The ability to boot can be restored with the recovery media that belongs to your operating systems.
But if your operating systems are dammaged that won't help you.
If your question was refering to a recovery success - that question can never be answered.
Furthermore you did not deliver information to the extent of overwritten data.

[*]Which should be the bootable partition?

I guess it should be the EFI one. It depends on your way of booting. If your configuration was based on using the BIOS compatibility support module then I don't know.

[*]In the documentation I see that there's a way to mark a partition as bootable, but I don't seem to be able to do it using testdisk_win.exe. The option isn't there.

I think it appears after the quick or the deep search.

[*]Should all paritions be marked as Primary so that they are not deleted?

Yes, they should like your partition table backup.

I would post the log file here but it is too long. Where can I put it do that you can see it? I don't see a place to upload a .txt file

There is a tab on the bottom of this page for uploads.

You would need to reenter your partition table and then use the p key ("list files") to see if you can recognize your file and folder contents inside.
If that works you might ignore Windows and make Linux boot again using your Linux installation media.

[Popinaodude]

Hi, thanks a lot for the comprehensive reply.

Having the table is a good thing. Unfortunately there are overlapping partitions:
/dev/nvme0n1p1 overlaps /dev/nvme0n1p2
/dev/nvme0n1p3 overlaps /dev/nvme0n1p4
Both overlap by one sector. Testdisk may refuse that as an invalid structure.

Sorry, this was a typo. I only had a photo of the output and so was typing it in manually. the original parition table should have said:

Code: Select all

Device               Start        End    Sectors   Size Type
/dev/nvme0n1p1       2048    1085439    1083392   529M Windows recovery environment
/dev/nvme0n1p2    1085440    1290239     204800   100M EFI System
/dev/nvme0n1p3    1290240    1323007      32768    16M Microsoft reserved
/dev/nvme0n1p4    1323008 1576962047 1575639040 751.3G Microsoft basic data                        
/dev/nvme0n1p5 1576962048 1933463551  356501504   170G Linux filesystem                               
/dev/nvme0n1p6 1933463552 2000408559   66945008   31.9G Linux swap

Which doesn't have any overlaps.

There SHOULDN'T be any overwritten data, I haven't done anything on the drive since deleting the table, and I'm able to list files and everything seems to be there and usual both in the windows and linux filesystem partitions. The only problem as far as I can tell is the ''Microsoft reserved' partition.

The only way with Testdisk I found is to reenter the whole partition table, not just one entry.

what is the way to do this? I can't find a way to manually reenter the partition table. I've tried enabling expert mode which according to the documentation should let me force the file system block size and the offset but it doesn't seem to change anything or actually let me input anything

I think it appears after the quick or the deep search.

I'm not seeing the option with a quick search. I started soing a deep search but it seemed like it would have taken over 24 hours to complete, so I stopped it.

There is a tab on the bottom of this page for uploads.

thanks. I've uploaded the log. it seems have a LOT of lines of this sort:

Code: Select all

file_pread(6,1,buffer,2000410663(124519/205/14)) lseek err Invalid argument

[recuperation]

There SHOULDN'T be any overwritten data,

Sorry I missed out the word "empty", but even an empty partition contains metadata to be copied.

I haven't done anything on the drive since deleting the table, and I'm able to list files and everything seems to be there and usual both in the windows and linux filesystem partitions. The only problem as far as I can tell is the ''Microsoft reserved' partition.

True. It is overlapping as well. But as it's reserved (may be even not formatted?) for future use the entry might not matter:
/dev/nvme0n1p2 1085440 1290239 204800 100M EFI System
/dev/nvme0n1p3 1259520 1323008 32768 16M Microsoft reserved

The only way with Testdisk I found is to reenter the whole partition table, not just one entry.

what is the way to do this? I can't find a way to manually reenter the partition table. I've tried enabling expert mode which according to the documentation should let me force the file system block size and the offset but it doesn't seem to change anything or actually let me input anything

Analyse, quick search, [Return] (to stop the quick search) followed by the "a" key like "add".

I think it appears after the quick or the deep search.

I'm not seeing the option with a quick search. I started soing a deep search but it seemed like it would have taken over 24 hours to complete, so I stopped it.

As I said "after" and not "with".

[Popinaodude]

Hey, thanks for the help.

I ended up manually rewriting the partition table, and was able to access and copy over all the files on both the linux and windows filesystems. Unfortunately I wasn't able to boot from the old drive but as I had already reinstalled windows I just spent the weekend reinstalling it just how it was before and everything works fine.

Thanks again!