How to ensure that you don't get an answer in this forum! Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

How to ensure that you don't get an answer in this forum!

#1 Post by recuperation »

Dear Testdisk users,

as it seems that the quality of requests is decreasing over the last days I'd like to point out some things you should care about:

1. A request has to contain a question.

viewtopic.php?p=33183#p33183
geordielad007 wrote: 20 Feb 2021, 17:29 Hi Guys and ladies.

Bit of a background as to why and how I am where I am.

So I have a HP G6 pavilion laptop and one night my can of Guiness decide to pick a fight with the keyboard. I thought I was pretty quick to resolve the dispute by removing the guiness from the keyboard. Alas that was never to be the case. Everytime I clicked onto a dialoge window there would be a string of 3's appearing. So, I shutdown the laptop by the dreaded power button, as this was the only option. I then powered up the laptop and once again a string of 3's appeared in my password. So I closed the laptop down and decided I needed to sort out the keyboard. Looked on you tube and followed the instructions of the video. Disconnected the power, but did not remove the battery. Saw some possible Guiness contamination around power button components and cleaned.

The short of it is the laptop would not switch on.

So I went down the rabbit hole in search of my lost data. Fitted my laptop Hitachi 1TB HDD to my other laptop. However, whilst the beep gave an audible indication that it had been fitted, the drives were not shown in windows explorer; though the Disk Management showed it as a 931GB unallocated drive.

So purchased the EaseRUS and ran that, took pretty much a day for the analyses to complete. I thought great can see a load of important named folders and sub folders and named files. After saving a load of the folders, sub folders and files to an external hard drive, I could open docs, but they were all egyption and tried various ecncoders without success. However most noteably all photos and pictures were okay. I'm probably boring you now, but I then purchased disk raid internals and again I am further down the rabbit hole and looks like I have manged to now have readable PDFs, excels and docs.

But I wanted to go the extra mile and download the TestDisk software and it has been running for probably about 36 hours with 41% complete, not so much worried about that, as I have read some of Recuperation's posts.

I don't wish anyone one to spend a huge amount of time on this, but I do have a few questions, for re-assurance I guess.

1. Given the information below as a copy of the disk recovery at 41 % is this pretty normal, is it likely to be successful. My HDD partition was as I remember it
2. There is an extreme possibility that after I partitioned the drive in windows 7 and before the upgrade (which was/is windows 10 upgraded), that I deleted any created files in those drives,
without the experience or knowledge of the purpose fo those files/

C:\ approx 250GB
D:\ recovery
G:\ approx 300GB
H:\ approx 300GB

Analyse cylinder 6305/15199: 41% MS Data 8666092 48439531 39773440 em Partition] [SYSTEM]
MS Data bytes per sector mismatches 512 (NTFS) != 4096 (HD)
MS D6ta 621 920732 48981081 39773440
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
MS Data 6414800 11685840 5271040
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
MS Data 474142 474913 771 [Boot]
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD))
ccheck_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
WaMS Datanumber of bytes p84868096 234751743 149883648 [DATA]96 (HD)
MS Data


Any small advice or explanation would be appreciated
2. Do not use acronyms. I am not familiar with your gamer talk. If you don't care about writing full words and being understandable why should I bother caring about your issues?
3. Select a good title (like in a newspaper) to give others a chance when searching for a similar problem
4. No whining! Do not mention "HELP!!!!" in the title and your posting. It is obvious that you are looking for support - if your posting contains at least a question (see point 1).

retrobob wrote: 07 Feb 2021, 03:31 256gb Samsung evo select
Balena said "Only the partition table was erased (it is the list of partitions and their offsets on the drive), the partitions are still there on the drive."
Balena said "testdisk is also available on Windows: TestDisk - CGSecurity"

After running Quick Search, both partitions appear in GREEN(* FAT 32 and P Linux)
I confirm WRITE with Enter, y and OK.
TestDisk displays You have to restart your Computer to access your data so press Enter a last time and reboot your computer.
I can now see file on my PC

I load image and start RPI3B+
Now I have a flashing cursor on my screen.
Image is supposed to autoexpand on first boot. Wait 3 minutes, turn off then start again.
Start up 2nd time and flashing cursor still there

I redo Analyse>Quick Search> both partitions appear in GREEN(* FAT 32 and P Linux)
I press (P) to list * FAT32, everything appears in white lettering
I press (P) to list P Linux, everything appears in white lettering, except -rw-r--r-- 1000 1000 554 3-Mar-2019 11:46 .ismount-test-file
unable to copy and move current file

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#2 Post by recuperation »

5. Avoid writing novels.
6. Use short simple sentences. Structure your thoughts! A sentence contains at least a subject and a verb.

The following sentence does not contain ANY usable information. There is a subject "one of them" but not verb:
Now that I was just about ready to stop being lazy and booting on a usb stick and only doing live sessions after moving a lot of data from internal drives (I have 3 in the desktop), suddenly one of them, and definitely not the oldest (I have a 200gb very very first generation SATA WD drive in there that will not just die at all).
I've been using live sessions of ubuntu mate since a long time, from 18.04.3 then .4 then .5 then now 20.04 since win7 died in January last year and that my internal drives unlike my external drives, are so full, i've had to wait a while and have money to spend on a HDD swapping dock, some external drives including some that are solid state drives.

Now that I was just about ready to stop being lazy and booting on a usb stick and only doing live sessions after moving a lot of data from internal drives (I have 3 in the desktop), suddenly one of them, and definitely not the oldest (I have a 200gb very very first generation SATA WD drive in there that will not just die at all). It's a 1TB seagate drive and well, I should have kept the win7 partition as it was so I could boot it from grub, because it decided to be unable to mount in linux and even using Hiren's Boot 15.2 mini-xp...Minitools Partition Wizard and others (the mini live win7 just won't boot, the 2 boot manners there don't work), it would see the drive but not let me do anything with it, no chkdsk as Disks and gparted in ubuntu is telling me to do in a windows environment. Minitools Partition Wizard was calling it "Bad Drive".

But testdisk sees it while in a live session. I moved all the files safely, with minimal errors to one of my mechanical external drives mounted on my swapping dock. Now I'm ready to make it work again, which isn't easy, I got no other computer with win 10 or even 8.1 to plug it into and see what a real installed windows has to say about it. My fiancée has a win10 desktop but it is a HP so it definitely has no place in it for me to add a third drive, it has 2 in there, and they are in a RAID mode, so I can't take one out.

Can I just turn that drive/partition (for some reason it always had an empty partition and under it a partition in equal size that was an "Extended Volume", linux calls the drive sdb and the part that has the files sdb5, Disks tells me the same thing. I don't know why I formatted it that way 4 years ago when I bought that drive, but it wasn't on purpose. It's the last vestige of my NTFS days....sometime a live session froze to a black screen of death, something that is bound to happen with live sessions extended over months, just as I had noticed it would have a hiccup before mounting it successfully in Caja, there was a lag time and I thought, I should move my data from there next boot....well, when I rebooted the drive was impossible to mount at all, a lot of errors about sdb5 in the boot sequence if I presse ESC and Testdisk telling me the 2 partitions on the drive are "D" as in Deleted.

As I said, I copied everything almost a 100% successfully. Can I just turn them to L or P and they will be mountable? Or I will need to reboot to see? I know the drive is not broken, the BIOS and UEFI all sees it at boot, OS's see it, just can't use it one way or another. I'm ready to be able to format it, but I can't format it in an OS that won't mount it, at least not in a traditional way. GParted would let me do it, I think, I've seen that do miracles to a partition on an external drive back in the usb 2.0 days, very slow days, where it was able to bring it back along with all the data by using the Rescue feature...but right now it just tells me to go to windows and to chkdsk on it twice etc.

Shortly, if I turn a deleted partition, I guess it will have to be both, the "real" and the "extended" one, into a non-deleted one, will everything turn back to normal? I haven't been able to do anything of use in a kind of shady windows environment, the only one I can get, through Hiren's Boot, but the mini-winxp and all the utilities in it all tell me its "a bad drive", see it but don't let me do anything with it, so chkdsk is out of question.

I assume that if I turn them back to Primary or Logical partitions, a reboot will be necessary. I don't know what happened when a live session crash caused that drive to delete its partitions and act this way, but, it works, the only thing I see going on is Disks telling me about the 96 bad sectors and the errors related to that when booting in the boot sequence. Almost all files copied perfectly and thankfully those that did not are not dramatic, what matters is that about 800 music albums transferred just fine except for one band whose folder failed entirely, but I can easily get that back ;)

Sorry for the long winded post, start at the paragraph starting with Shortly (a polite tl;dr) to see what my actual pinpointed worry is quicker, but I like to bring in details...it was a very strange thing that caused the drive and the "Extended Partition" under the full 1TB partition (the one on top in Disks is the empty one), in Testdisk it's on top to delete itself after a live session of ubuntu mate 20.04 crashed. It's not broken and even if there is 96 bad sectors, systems and BIOS/UFI sees it down to the model, so I'm not worried about that.

Testdisk is amazing btw, no other program out there would have had me rescue 99%+ of the files/folders on there. Thanks in advance.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#3 Post by recuperation »

7. Do not write that your matter is urgent. You won't get any preferential treatment. For urgent matters contact a professional recovery company.
8. Do not write that your data is important. By definition it is not because you obviously did not care about a backup. You won't get a preferential treatment either rather the opposite.
9. Document your case. Provide log files, p.e. the testdisk log file. Screenshots can be attached using the attachment tab on the bottom of the page. Pictures at third party hosters will get lost sooner or later. For screenshots use an appropriate format, p.e. PNG. Your pictures will help me and others searching for a solution!

10. If you find bugs, document them in a traceable way. I would have expected providing at least a picture. The following is probably supposed to be a bug report:

viewtopic.php?f=10&t=10804
Ändert man die Größe des Testdisk-Fensters unter WIndows 10, verschieben sich die Inhalte so, dass man sie zwar noch lesen, aber eher nicht mehr verstehen kann.
Bug oder Feature?
Translation:
If ones changes the size of a Testdisk window running Windows 10, content are moving in such a way that one could read them but not understand them anymore.
Bug or feature?
11. Do not split one issue into multiple postings.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#4 Post by recuperation »

12. Avoid asking questions that could be solved by a minimum amount of research on your own. In this case one simple google request would have solved the question:

viewtopic.php?p=33140#p33140
Re: smartmontools
Is smartmontools part of W10, as I cant find it?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#5 Post by recuperation »

13. Form IS important. I won't sort your garbage. If you are not able to copy a logfile correctly into a forum posting or are unable to upload a screenshot to cgsecurity.org I have to assume that you are lacking some basic abilities to handle Testdisk or Photorec.

viewtopic.php?p=33146#p33146
I clicked on continue following the previous message and this is what I got thus far:
Disk /dev/sdb - 128 GB / 119 GiB - CHS 15566 255 63 Partition Start End Size in sectors >P EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM] D MS Data 567296 248049663 247482368 [Windows] D MS Data 246042625 248049664 2007040 D MS Data 248049664 250056703 2007040 [Windows RE tools] P MS Data 248049664 250068991 2019328 [Windows RE tools] Structure: Ok. Use Up/Down Arrow keys to select partition. Use Left/Right Arrow keys to CHANGE partition characteristics: P=Primary D=Deleted Keys A: add partition, L: load backup, T: change type, P: list files, Enter: to continue FAT32, blocksize=4096, 272 MB / 260 MiB
14. Do not ask how long your recovery process will take or how to speed up the process. You don't have to sit and wait while Testdisk is working. You are free to do anything else. If you are in a hurry with your recovery, your best option is to contact a professional data recovery company. For a nice mark-up your issue will be treated in a preferred way. Basically you can buy time from them but you can't save on both time and money simultaneously by trying to recover your drive yourself.
Norwegianwood wrote: 20 Feb 2021, 20:13
recuperation wrote: 20 Feb 2021, 18:48 Please post your testdisk log file. PVRs might use encryption to prevent you from recovering your recordings.
Many thanks
My PVR does not encrypt its recordings.
On a working drive, I can download its recordings and play them on a PC.
And I can also edit them on the PVR or on the PC.

Does TD produce the log file you require after it displays my drives current partition structure?
If so, how long would that take TD to do this, on my 1TB drive?



More hints to come.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#6 Post by recuperation »

15. There is no help for users with massive communication problems
limux i made a very rash decision to re-installl windiows and try and put the disk back to it orfiinal fileststem, amount of partions i.e. 1. and try to recover tha data from there.

is it goig to ne posible to restore any jpegs from the oiginak ntfs filessyem? if so please tell me how i vam go cack doig this>?
Source:

viewtopic.php?f=5&t=11645

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#7 Post by recuperation »

16. Failed pictures

People dare to post pictures that are hard to read that are taken off screens in viewing angles that no normal human being would use:

viewtopic.php?f=5&t=11665

I will never understand why people are posting really bad pictures that could be much better with just a minimum of effort.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#8 Post by recuperation »

17. Do not ask why your computer/disk failed

If the reason seems to be obvious you will probably told about it.

Answering this question will require an extensive examination of your computer and the environment he is in and even when done in a forensic matter there is no guarantee of success.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#9 Post by recuperation »

18. Use quantitative terms.

Example: "My drive is so slow" is as good as no information. But even if you said my super SSD-drive is only running at 35 MByte/sec that would be perfectly OK when being connected over USB 2.0. Furthermore, drive speed has to be seen in relation to the sustained speed of your drive when not being limited by an inadequate slow interface. The best is obviously to name the maker and model of the drive and the type of interface used.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: How to ensure that you don't get an answer in this forum!

#10 Post by recuperation »

19. Provide a case description

Descriptions like:
[...J'ai mon disque dur externe qui a planté. Je l'ai utilisé normalement pour enregistrer des photos etc pour mes cours et le lendemain matin il ne fonctionnait plus...]

Translation:
(I have an external disk that failed. I have used it normally to record pictures and for my courses and the following morning it did not work).

Even with a Testdisk log file enclosed this is not a case description. The forum rules clearly state:

[...
- Include as many details as you can,
...]

Locked