Hidden Folder Not Found in Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
201pilot
Posts: 7
Joined: 04 Nov 2017, 20:51

Hidden Folder Not Found in Partition

#1 Post by 201pilot »

Hello,

I have a Samsung NTSF HD that has become corrupted. TestDisk finds the partition and all the folders/files except those hidden by a program made by FSPro Lab:

https://fspro.net/hide-folders/

The tree below shows the expected folder structure. Most file recovery programs (Recuva, etc) easily find this hidden folder and contents, but TestDisk doesn't and this surprises me. Photo Rec finds the files for sure but identity and folder structure is lost. I know the folders/names etc are in good working order. Is there any way to recover these using TestDisk? How might I, if possible, make the $Extend folder show up in the partition contents?

Hidden File Structure: https://drive.google.com/file/d/1hUQ4ct ... sp=sharing

(While Recuva finds the folders there are many files that it cannot recover because the "file ame is too long" message. Other expensive recovery programs are able to recover these files without issue...)

Thanks for any help!

Peter



Sat May 22 16:48:26 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, Novembre 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1500301885440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1500301885440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=483927261184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=26843545600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1500291039744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3220755655168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1780090833920
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - SAMSUNG MZVLB512HAJQ-000L2, S/N:0025_388B_7100_07A7., FW:2L1QEXA7
Disk /dev/sdb - 5000 GB / 4657 GiB - CHS 608001 255 63, sector size=512 - Seagate Expansion, S/N:NAAYKR7H, FW:0712
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - Samsung G3 Station, S/N:801130168383

Partition table type (auto): Intel
Disk /dev/sdc - 1500 GB / 1397 GiB - Samsung G3 Station
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/1/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
1 E extended LBA 1 0 1 182400 254 63 2930256000
5 L HPFS - NTFS 1 1 1 182400 254 63 2930255937 [Samsung]
NTFS, blocksize=4096, 1500 GB / 1397 GiB

Analyse Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/1/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 E extended LBA 1 0 1 182400 254 63 2930256000
No partition is bootable
5 L HPFS - NTFS 1 1 1 182400 254 63 2930255937 [Samsung]

search_part()
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 1/1/1
filesystem size 2930255937
sectors_per_cluster 8
mft_lcn 3
mftmirr_lcn 183140996
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1 1 1 182400 254 63 2930255937 [Samsung]
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(6,2,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(6,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(6,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(6,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(6,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(6,7,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(6,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(6,8,buffer,2930278408(182401/100/44)) lseek err Invalid argument
file_pread(6,3,buffer,2930278416(182401/100/52)) lseek err Invalid argument
file_pread(6,3,buffer,2930278463(182401/101/36)) lseek err Invalid argument
file_pread(6,8,buffer,2930278479(182401/101/52)) lseek err Invalid argument
file_pread(6,11,buffer,2930278526(182401/102/36)) lseek err Invalid argument
file_pread(6,2,buffer,2930280448(182401/133/5)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
L HPFS - NTFS 1 1 1 182400 254 63 2930255937 [Samsung]
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS Volume is dirty.


dir_partition inode=5
L HPFS - NTFS 1 1 1 182400 254 63 2930255937 [Samsung]
NTFS, blocksize=4096, 1500 GB / 1397 GiB
Directory /
5 dr-xr-xr-x 0 0 0 22-May-2021 16:17 .
5 dr-xr-xr-x 0 0 0 22-May-2021 16:17 ..
1477 dr-xr-xr-x 0 0 0 10-Oct-2020 15:27 $RECYCLE.BIN
32 dr-xr-xr-x 0 0 0 11-May-2021 08:27 New folder
24907 dr-xr-xr-x 0 0 0 19-Oct-2010 10:46 RECYCLER
26004 dr-xr-xr-x 0 0 0 13-Oct-2010 10:23 Recycled
34 dr-xr-xr-x 0 0 0 6-Sep-2010 10:43 SamsungSoftware
27 dr-xr-xr-x 0 0 0 10-Aug-2018 17:42 System Volume Information
29 dr-xr-xr-x 0 0 0 6-Sep-2010 10:43 VProRecovery
122 -r--r--r-- 0 0 4268032 1-Apr-2010 18:04 AppInst.exe
123 -r--r--r-- 0 0 88 30-Dec-2009 23:35 Autorun.inf
1523 -r--r--r-- 0 0 2770568 10-Oct-2020 15:53 HFExt.exe
1523 -r--r--r-- 0 0 126 10-Oct-2020 15:53 HFExt.exe:Zone.Identifier

1524 -r--r--r-- 0 0 2770568 9-Sep-2020 06:36 test.exe
1524 -r--r--r-- 0 0 126 9-Sep-2020 06:36 test.exe:Zone.Identifier
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 1 0 1 182400 254 63 2930256000
5 L HPFS - NTFS 1 1 1 182400 254 63 2930255937 [Samsung]

recuperation
Posts: 2719
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Hidden Folder Not Found in Partition

#2 Post by recuperation »

201pilot wrote: 22 May 2021, 08:32 Hello,

I have a Samsung NTSF HD that has become corrupted. TestDisk finds the partition and all the folders/files except those hidden by a program made by FSPro Lab:

https://fspro.net/hide-folders/

The tree below shows the expected folder structure. Most file recovery programs (Recuva, etc) easily find this hidden folder and contents, but TestDisk doesn't and this surprises me. Photo Rec finds the files for sure but identity and folder structure is lost. I know the folders/names etc are in good working order. Is there any way to recover these using TestDisk?
Yes, if you use your proprietary "hide-folders" software to convert the on-disk folder structures back to standard NTFS.

From the FAQ of your software product:
Does Hide Folders change file system?

Not at all.
I doubt that. If there are no changes in the file system it will be sufficient to connect a drive with hidden folders to a machine where the filter driver is not installed.

201pilot
Posts: 7
Joined: 04 Nov 2017, 20:51

Re: Hidden Folder Not Found in Partition

#3 Post by 201pilot »

Thank you for your message!

I cannot use the FSPro software to unhide the folder because windows cannot access the disk! If only it could be so easy. All Windows tells me to do is format the drive!

P

recuperation
Posts: 2719
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Hidden Folder Not Found in Partition

#4 Post by recuperation »

Using undocumented proprietary stuff as p.e. Microsoft Storage Spaces or your software will always result in data loss when not performing backups.
You would need to ask the author of your software for help because he has his documentation on file.
Apart from that your secret other recovery software is able to do the recovery job, you said.

Locked