Partition became RAW, TestDisk advice Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
JokuUkkeli
Posts: 2
Joined: 01 Apr 2021, 15:29

Partition became RAW, TestDisk advice

#1 Post by JokuUkkeli »

~3 days ago a 238.2GB NTFS partition became RAW, losing ~170-180GB of data, and I have been trying to fix the problem for about 14 hours.

Potential reasons partition went RAW:

1. I have dual-booted Manjaro, although no idea why would this make my partition RAW.
2. When I use Linux, I always had to browse to the partition from file explorer before programs recognized it at /run/media/peruna/Backup for Update, and have never intentionally unmounted the drive.
3. I resized and moved the partition earlier in Linux KDE Partition Manager, but after ~1hr, it threw some error and aborted its job; I did the same procedure again and was able to complete the job.

Symptoms found:

1. Linux: Dolphin file explorer doesn't show the drive
2. Windows: Explorer shows the drive [E:], but no name or information, with the partition showing 0B of data and space
When trying to open the drive, I receive error:
You need to format the disk in drive E: before you can use it. Do you want to format it?
After canceling, I receive error:
E:\ is not accessible. The volume does not contain a recognized file system.
Please make sure that all required file system drivers are loaded and that the volume is not corrupted.

Everything tried so far: (Fast Startup disabled before dual-booting)

1. iCare Data Recovery: worked pretty good, but I also need the correct file structure and file names, since all the data on the partition is dependent on file names and structure
2. TestDisk: I am not good at using this program and the tutorials don't seem to apply to my case, although I'm pretty sure TestDisk will be the program that will work in the end
TestDisk 7.2-WIP, Data Recovery Utility, March 2021

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:

Partition Start End Size in sectors
1 P Windows Recovery Env 2048 1085439 1083392 [Basic data partition]
2 P EFI System 1085440 1290239 204800 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
4 P MS Data 1323008 1249179569 1247856562 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
6 P Linux filesys. data 1249179570 1451933695 202754126

Quick Search does a quick jump to 74% in ~2s [90300 / 121600 cylinders], finding four partitions, receiving error two partitions can't be recovered (partition needed not included):
The harddisk (1000 GB / 931 GiB) seems too small! (< 1667 GB / 1552 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors
Mac HFS 1467399855 2308390576 840990722 [$_Func_impl@V<lambda_756265]
Mac HFS 1844913792 3255871105 1410957314

General view of partitions, without the partition needed, but before Quick Search I saw a partition, as well as a duplicate of it, with a size of 499542016 sectors, which kind of matches the one I'm searching for:
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63

Partition Start End Size in sectors
P MS Data 2048 1085439 1083392 [Recovery]
P EFI System 1085440 1290239 204800 [EFI System Partition] [NO NAME]
D MS Data 1323008 1249179569 1247856562
D Mac HFS 433956482 1844913795 1410957314
D Mac HFS 626409137 1467399858 840990722 [$_Func_impl@V<lambda_756265]
D Linux filesys. data 1249179570 1451933689 202754120
D Linux filesys. data 1662878752 1797094431 134215680
Fourth partition returned HFS found using backup sector!, with it and the fifth partitions returning upon opening:
Support for this filesystem hasn't been implemented.
Seventh partition returns upon being opened:
No file found, filesystem may be damaged.

https://pastebin.com/fXJ9Amcv Deep search resulted in a lot of:
file_pread(4,1,buffer,1953525169(121601/81/2)) lseek err Invalid argument
This content preceeding them:
Tue Mar 30 19:45:02 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2021

OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=638902559744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=255765512192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1507262464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:

Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA DT01ACA100, S/N:95J27VBNS, FW:MS2OA7L0
Drive F: - 1507 MB / 1437 MiB - CHS 359 64 32, sector size=2048 - ASUS SH-224FB, FW:1.00

Partition table type (auto): EFI GPT
Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA DT01ACA100
Partition table type: EFI GPT

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128

check_part_gpt failed for partition
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
check_part_gpt failed for partition
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]

Current partition structure:
1 P Windows Recovery Env 2048 1085439 1083392 [Basic data partition]
2 P EFI System 1085440 1290239 204800 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
4 P MS Data 1323008 1249179569 1247856562 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
6 P Linux filesys. data 1249179570 1451933695 202754126

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1085439 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB

FAT32 at 67/144/14
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
EFI System 1085440 1290239 204800 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB

NTFS at 82/90/9
filesystem size 1247856562
sectors_per_cluster 8
mft_lcn 49133508
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=677380096, part_size=638902559744, sector_size=512
NTFS partition cannot be added (part_offset<part_size).

NTFS at 82/90/9
filesystem size 1247856562
sectors_per_cluster 8
mft_lcn 49133508
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1323008 1249179569 1247856562
NTFS, blocksize=4096, 638 GB / 595 GiB

recover_EXT2: s_block_group_nr=0/773, s_mnt_count=28/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 25344265
recover_EXT2: part_size 202754120
Filesystem created: Mon Mar 22 17:25:30 2021
Last mount time: Sat Mar 27 20:49:09 2021
Linux filesys. data 1249179570 1451933689 202754120
ext4 blocksize=4096 Large_file Sparse_SB, 103 GB / 96 GiB

HFS magic value at 91341/106/13
part_size 840990722
Mac HFS 1467399855 2308390576 840990722 [$_Func_impl@V<lambda_756265]
HFS blocksize=16777216, 430 GB / 401 GiB
This partition ends after the disk limits. (start=1467399855, size=840990722, end=2308390576, disk end=1953525168)

HFS magic value at 91341/106/15
part_size 840990722
Mac HFS 626409137 1467399858 840990722 [$_Func_impl@V<lambda_756265]
HFS found using backup sector!, 430 GB / 401 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 1575737412 5781186085 4205448674
FATX, 2153 GB / 2005 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

recover_EXT2: s_block_group_nr=0/511, s_mnt_count=15/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 16776960
recover_EXT2: part_size 134215680
Filesystem created: Mon Dec 23 14:02:17 2019
Last mount time: Wed Nov 18 17:29:59 2020
Linux filesys. data 1662878752 1797094431 134215680
ext4 blocksize=4096 Large_file Sparse_SB Recover, 68 GB / 63 GiB

HFS magic value at 114840/145/58
part_size 1410957314
Mac HFS 1844913792 3255871105 1410957314
HFS blocksize=16777216, 722 GB / 672 GiB
This partition ends after the disk limits. (start=1844913792, size=1410957314, end=3255871105, disk end=1953525168)

HFS magic value at 114840/145/60
part_size 1410957314
Mac HFS 433956482 1844913795 1410957314
HFS found using backup sector!, 722 GB / 672 GiB
file_pread(4,1,buffer,1953525168(121601/81/1)) ReadFile The drive cannot find the sector requested.

It also returned a long list of partitions that do not fit in a PasteBin paste, so I've uploaded it to https://drive.google.com/file/d/1huOxI3 ... sp=sharing Google Drive:
At lines 44 and 53-54, I'm now sure these are the partitions I'm searching for, as while the size is about right and location exactly at the end of the disk, when I search the log, there is no partition with the size of 499542016 anywhere after the first 60 lines:
Tue Mar 30 19:45:02 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2021

OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=638902559744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=255765512192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1507262464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:

Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA DT01ACA100, S/N:95J27VBNS, FW:MS2OA7L0
Drive F: - 1507 MB / 1437 MiB - CHS 359 64 32, sector size=2048 - ASUS SH-224FB, FW:1.00

Partition table type (auto): EFI GPT
Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA DT01ACA100
Partition table type: EFI GPT

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128

check_part_gpt failed for partition
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
check_part_gpt failed for partition
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
Current partition structure:
1 P Windows Recovery Env 2048 1085439 1083392 [Basic data partition]
2 P EFI System 1085440 1290239 204800 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
3 P MS Reserved 1290240 1323007 32768 [Microsoft reserved partition]
4 P MS Data 1323008 1249179569 1247856562 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
6 P Linux filesys. data 1249179570 1451933695 202754126

search_part()

I found a few partitions (Mac HFS) with a size of 268 GB / 250 GiB in the Deeper Scan, so these might be what I'm searching for; however, there are many of them and I can't view the files because Support for this filesystem hasn't been implemented.
HFS found using backup sector!, 268GB / 250GiB"
I found this at lines 43-44, which is the partition I'm searching for:
check_part_gpt failed for partition 5 P MS Data 1453981696 1953523711 499542016 [Basic data partition]
Does this error message mean something big?

How should I proceed?

JokuUkkeli
Posts: 2
Joined: 01 Apr 2021, 15:29

Re: Partition became RAW, TestDisk advice

#2 Post by JokuUkkeli »

I got so tired of trying to recover the data that I just decided to format the partition and download everything again (I lost 12 programs / 170 GB of data) in ~47 hours + ~9 hours of extracting and installing stuff.

Locked