Partition Recovery - Boot Sector Is Bad

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Peregrinus
Posts: 3
Joined: 13 Jun 2021, 19:36

Partition Recovery - Boot Sector Is Bad

#1 Post by Peregrinus »

Hiya all,

I have a one TB external disk connected via USB. This disk is used for a backup data partition (primary). Yesterday I set up a second primary partition (bootable) and tried to copy an image onto it. The process crashed somehow damaging the partition table. Afterwards only the second partition was recognized. I used testdisk to search for the lost partition and the search process showed me only the new one. The deeper search however showed me the original partition, the new second primary partition and two entries which seem to be incorrect copies of the original primary one. I kept the original one as P, the second as *, the copies remained D and wrote the new partition table. Originally both BS were shown as status: bad. After having written the PT the backup is status OK, of course.

Now I'm wondering whether I should copy the backup onto the BS, because a rebuild BS results in the message: extrapolated BS and current BS are different, showing a difference in the MFT.

Disk /dev/sdd - 1000GB / 931 GiB - CHS 121601 255 63

Partition Start End Size In Sectors
1 P HPFS - NTFS 0 1 1 52216 254 63 838866042

filesystem size 838866042 1
sectors per cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 52429127 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
extrapolated boot sector and current boot sector are different.

What I'm understanding is that the first value in each line describes the current, the second value the backup BS. The second now beeing OK, but with the result that the MFT and all the files on the partition being lost?! What could I do now? Thanks in advance for your help and suggestions. Very much appreciated.

Peregrinus

Peregrinus
Posts: 3
Joined: 13 Jun 2021, 19:36

Re: Partition Recovery - Boot Sector Is Bad

#2 Post by Peregrinus »

Hiya,

not having received replies to my initial post, I am writing a follow up here... did not have time to work on this problem for a couple of weeks.

after writing the extrapolated boot sector the status is OK and both sectors are shown to be identical.
but i am still getting "Memory Access Error" ("Speicherzugriffsfehler") for "list files and folders" as well as "check MFT".

Could it be that the extrapolated BS is different from the backup, which was found to be OK.

booting Windows with the disk connected results in partition to be recognized and accessible.

haven't had the time to check all the files, but beforehand I would like to know possible reasons for memory access error in TD.

Thanks in advance for your help.

Peregrinus
Posts: 3
Joined: 13 Jun 2021, 19:36

Re: Partition Recovery - Boot Sector Is Bad

#3 Post by Peregrinus »

Hiya,

and another follow up to the topic... :(

although Windows recognizes the disk and makes it accessible, the Paragon partition manager and diskmgmt.msc show an unformatted disk partition. But using the Windows Explorer I can access the folders and see the files... :o :?

apart from this obvious inconsistency, I am still trying to validate the number of files and folders on this disk's backup data partition....
Is there any place where Windows automatically creates a Protocol- or Logfile for ScanDisk, respectively CHKDSK, when an automated check is finished?
I know, except eventvwr.msc, because there most of the last weeks' and months' events are not available, due to having been deleted or what not.

Automated tests during the Windows boot process should originate from WinInit (Event IDs ?) or CHKDSK (ID 26226).

If most of the event data in the Event Viewer was deleted where could I still find data about a reasonably recent disk check and verify the status of the backup?

Locked