Partition Can't Be Recovered after quick and deep scan

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
slashscreen
Posts: 2
Joined: 07 Apr 2021, 09:12

Partition Can't Be Recovered after quick and deep scan

#1 Post by slashscreen »

Hey, I'm trying to repair my friend's internal HDD (1TB, shown here as ST1000LM035-1RK172) for a laptop that I totally screwed up, and I am attempting to undelete some files.
In short, what happened to the poor thing was:
-Partitions Deleted
-Partially overwritten with 0s (only about .1%)
-New partition over it

And while trying to quick and deep scan to find partitions to undelete files from, only a malformed(?) partition showed up which roughly equated to the new partition over it, but did not have the proper name in brackets.
This is what the log for this run said. What does this mean and how do I fix it? I'm starting to run out of options...
Tue Apr 6 17:54:20 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, March 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=15931539456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=15931539456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1000199946240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=998988041216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=524288000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=13442220032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=524288000
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 970 EVO Plus 2TB, S/N:0025_3853_1190_D3F7., FW:2B2QEXM7
Disk /dev/sdb - 15 GB / 14 GiB - CHS 1936 255 63, sector size=512 - Multiple Card Reader, S/N:AU6485, FW:1.00
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM035-1RK172, S/N:WQ97SHLD, FW:RTM2
Drive E: - 524 MB / 500 MiB - CHS 16000 2 32, sector size=512

Partition table type (auto): None
Disk /dev/sdc - 1000 GB / 931 GiB - ST1000LM035-1RK172
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 121488/200/57
filesystem size 1794048
sectors_per_cluster 8
mft_lcn 74752
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 121488 200 57 121600 117 53 1794048
NTFS, blocksize=4096, 918 MB / 876 MiB
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(6,2,buffer,1953859589(121622/34/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953859589(121622/34/18)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB
This partition ends after the disk limits. (start=1953523711, size=1007616, end=1954531326, disk end=1953525168)
file_pread(6,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(6,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(6,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(6,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB

Results
HPFS - NTFS 121488 200 57 121600 117 53 1794048
NTFS, blocksize=4096, 918 MB / 876 MiB
HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
Can't open backup.log file: No such file or directory
interface_load
Invalid partition structure.

Interface Advanced

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(6,2,buffer,1953859589(121622/34/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953859589(121622/34/18)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB
This partition ends after the disk limits. (start=1953523711, size=1007616, end=1954531326, disk end=1953525168)
file_pread(6,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525830(121601/91/33)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB

Results
* HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

* HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 121538 128 63 121601 57 56 1007616

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(6,2,buffer,1953859589(121622/34/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953859589(121622/34/18)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB
This partition ends after the disk limits. (start=1953523711, size=1007616, end=1954531326, disk end=1953525168)
file_pread(6,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525830(121601/91/33)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB

Results
* HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB

interface_write()
1 * HPFS - NTFS 121538 128 63 121601 57 56 1007616
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB
NTFS at 121601/57/56
filesystem size 1007616
sectors_per_cluster 8
mft_lcn 41984
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(6,2,buffer,1953859589(121622/34/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953859589(121622/34/18)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB
This partition ends after the disk limits. (start=1953523711, size=1007616, end=1954531326, disk end=1953525168)
file_pread(6,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525767(121601/90/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953525830(121601/91/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525830(121601/91/33)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 121663 241 49 1007616
NTFS, blocksize=4096, 515 MB / 492 MiB

Results
* HPFS - NTFS 121538 128 63 121601 57 56 1007616
NTFS found using backup sector, blocksize=4096, 515 MB / 492 MiB

interface_write()
1 * HPFS - NTFS 121538 128 63 121601 57 56 1007616
Thanks in advance.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition Can't Be Recovered after quick and deep scan

#2 Post by recuperation »

After running quick search, you need to enter the possible partitions for recovery using the "p"-key ("list files").
If you that fails continue with deep search and retry the above.

If that fails - what I assume - run Photorec or any commercial recover software.

slashscreen
Posts: 2
Joined: 07 Apr 2021, 09:12

Re: Partition Can't Be Recovered after quick and deep scan

#3 Post by slashscreen »

it says filesystem is damaged when i try that with the only partition that shows up (which isn't the one I want)

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition Can't Be Recovered after quick and deep scan

#4 Post by recuperation »

See above.

Locked