NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
intraz
Posts: 5
Joined: 08 Jul 2021, 16:35

NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#1 Post by intraz »

Hi all,

By mistake, I deleted all partitions on my data disk (10TB WD with 2TB of actual data) during Windows installation.
Realised it immediately after the fact and made sure to have nothing access it so data is not compromised.
Used TestDisk from a live USB and then from Windows 10 after it was installed (on a different disk).
I recreated the boot sector and MBR.
I tried different other things but couldn't make the partition accessible in Windows (I was not really sure about all steps).
The issue seems to be overlap with another partition.
See attached log file of several attempts.
All my files in the one NTFS partition I care about are there and seem completely intact.
I copied them to a different disk for backup.
I could have called it end of story here but I would really like to simply make the partition accessible as copying all those files takes a long long time.
I feel like I am missing a trivial step to make it work.
I thought of marking the other partition as Deleted and then Write but was afraid of consequences due to overlap (even though I guess the writing is only done into the partition table).

TLDR:
NTFS partition not accessible in Windows
But all files accessible in TestDisk.
Might be due to overlapping partition.
Would like to make the NTFS partition accessible.
Do not care about anything else on the drive.

Would gladly provide any other relevant info.
Would appreciate any ideas or further steps.

Thanks a lot and in advance,
Eyal

Not sure how to attach a file here so pasting the log file below:

Code: Select all

Wed Jul  7 03:14:26 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 E extended LBA             1 232 40 267351  66 42 4294967295
No partition is bootable
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
Space conflict between the following two partitions
 1 E extended LBA             1 232 40 267351  66 42 4294967295
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(516,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB

interface_write()
 1 * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]

interface_write()
 1 * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 E extended LBA             1 232 40 267351  66 42 4294967295
No partition is bootable
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
Space conflict between the following two partitions
 1 E extended LBA             1 232 40 267351  66 42 4294967295
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
BAD_RS LBA=8621588288 2920290
check_part_i386 failed for partition type 04
     FAT16 <32M           536669  12 48 581885  34 10  726396389
file_win32_pread(516,2,buffer,19532873727(1215865/39/46)) read err: read after end of file

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
   P FAT16 <32M           536669  12 48 581885  34 10  726396389
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 2 P FAT16 <32M           536669  12 48 581885  34 10  726396389
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
You will have to reboot for the change to take effect.

TestDisk exited normally.



Wed Jul  7 19:23:16 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=371914951168
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
sector_size  60785
cluster_size 182
reserved     3898
fats         69
dir_entries  10781
sectors      47740
media        C5
fat_length   52122
secs_track   58469
heads        41848
hidden       307546634
total_sect   1029188780
check_part_i386 failed for partition type 04
NTFS at 2/10/9
Current partition structure:
 1 E extended LBA             1 232 40 267351  66 42 4294967295
Invalid FAT boot sector
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
No partition is bootable
Space conflict between the following two partitions
 1 E extended LBA             1 232 40 267351  66 42 4294967295
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
Space conflict between the following two partitions
 1 E extended LBA             1 232 40 267351  66 42 4294967295
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(520,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
sector_size  60785
cluster_size 182
reserved     3898
fats         69
dir_entries  10781
sectors      47740
media        C5
fat_length   52122
secs_track   58469
heads        41848
hidden       307546634
total_sect   1029188780
check_part_i386 failed for partition type 04
NTFS at 2/10/9
Current partition structure:
 1 E extended LBA             1 232 40 267351  66 42 4294967295
Invalid FAT boot sector
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
No partition is bootable
Space conflict between the following two partitions
 1 E extended LBA             1 232 40 267351  66 42 4294967295
 2 P FAT16 <32M           267349  89  4 312565 110 29  726396389
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
Space conflict between the following two partitions
 1 E extended LBA             1 232 40 267351  66 42 4294967295
 5 L HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(520,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
NTFS filesystem needs to be repaired.


search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(520,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB

interface_write()
 1 P HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.



Wed Jul  7 19:31:32 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
BAD_RS LBA=8621588288 2920290
check_part_i386 failed for partition type 04
     FAT16 <32M           536669  12 48 581885  34 10  726396389
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
   P FAT16 <32M           536669  12 48 581885  34 10  726396389
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 2 P FAT16 <32M           536669  12 48 581885  34 10  726396389
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB

interface_write()
 1 * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.



Wed Jul  7 21:36:28 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB

interface_write()
 1 * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB

ntfs_boot_sector
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
NTFS at 2/10/9
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS filesystem needs to be repaired.


Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720

TestDisk exited normally.



Wed Jul  7 22:10:32 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
No partition is bootable
Backup partition structure
partition_save

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(540,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(540,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             1 232 40 267351  99 12 4294969344
 5 L HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720

TestDisk exited normally.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#2 Post by recuperation »

intraz wrote: 08 Jul 2021, 17:27 TLDR:
???
intraz wrote: 08 Jul 2021, 17:27 I thought of marking the other partition as Deleted and then Write but was afraid of consequences due to overlap (even though I guess the writing is only done into the partition table).
When using GPT as partition table, you need to mark the partition to be recovered as primary and any overlapping ones as deleted and write.

intraz
Posts: 5
Joined: 08 Jul 2021, 16:35

Re: NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#3 Post by intraz »

recuperation wrote: 09 Jul 2021, 08:59 intraz wrote: ↑Yesterday, 19:27
TLDR:
???
It's an acronym for "Too Long. Didn't read".
I meant this as a summary of the situation and my request.
recuperation wrote: 09 Jul 2021, 08:59 intraz wrote: ↑Yesterday, 19:27
I thought of marking the other partition as Deleted and then Write but was afraid of consequences due to overlap (even though I guess the writing is only done into the partition table).
When using GPT as partition table, you need to mark the partition to be recovered as primary and any overlapping ones as deleted and write.
Thanks a lot.
I will try and update.

intraz
Posts: 5
Joined: 08 Jul 2021, 16:35

Re: NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#4 Post by intraz »

recuperation wrote: 09 Jul 2021, 08:59
intraz wrote: 08 Jul 2021, 17:27 TLDR:
???
intraz wrote: 08 Jul 2021, 17:27 I thought of marking the other partition as Deleted and then Write but was afraid of consequences due to overlap (even though I guess the writing is only done into the partition table).
When using GPT as partition table, you need to mark the partition to be recovered as primary and any overlapping ones as deleted and write.
Hi recuperation,

I wanted to try your suggestion but the next quick search gave a different partition structure.
I decided to run a deep search and got the following log file:

Code: Select all

Sat Jul 10 02:55:28 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1919725657088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
 1 P HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB

interface_write()
 1 P HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]

search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size           4294967295
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 267351  99 11 4294967295 [Data]
     NTFS, blocksize=4096, 2199 GB / 2047 GiB
check_FAT: Bad jump in FAT partition
BAD_RS LBA=4443370073 500453
check_part_i386 failed for partition type 0C
     FAT32 LBA            276586 253 45 341850  17 56 1048451304
BAD_RS LBA=8621588288 2920290
check_part_i386 failed for partition type 04
     FAT16 <32M           536669  12 48 581885  34 10  726396389
NTFS at 1215864/229/45
filesystem size           19532836864
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2  10  9 1215864 229 45 19532836864 [Data]
     NTFS found using backup sector, blocksize=4096, 10000 GB / 9313 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file

Results
     HPFS - NTFS              2  10  9 267351  99 12 4294967296 [Data]
     NTFS, blocksize=4096, 2199 GB / 2048 GiB
     HPFS - NTFS              2  10  9 1215864 229 45 19532836864 [Data]
     NTFS found using backup sector, blocksize=4096, 10000 GB / 9313 GiB
     FAT32 LBA            276586 253 45 341850  17 56 1048451304
     FAT16 <32M           536669  12 48 581885  34 10  726396389
My original NTFS partition was on the entire disk so it seems to match the second NTFS partition in the results.
The size of the first NTFS partition is 2GB when the size of all the files I copied off the HDD using TestDisk is around 3.4GB.
So it looks like I should delete the first NTFS partition and keep the second one (as Primary as you suggested before). Side note: I am able to view all files in both of them.
Also, I am not sure what to do with the FAT partitions.
Would appreciate your input on both the FAT and NTFS partitions.

Thanks!
Eyal

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#5 Post by recuperation »

You did not unterstand when i wrote "When using a GPT table".

As the log states a sector size of 512, you should select GPT as partition table style.

With a sector size of 512 byte only 2TB of your drive can be addressed and used.

Some external drives with a native sector size of 512 come with an additional interface electronics that seem to contain a converter showing a sector size of 4096 byte. Only in a such a case using the old MBR-style partition table is possible.

If you bought a naked drive without enclosure name the manufacturer and product so that I can see which sector size your drive uses or shows externally.
That determines the right partition table choice.

Please provide the information requested and rerun Testdisk again creating a log based on the selection of GPT.

intraz
Posts: 5
Joined: 08 Jul 2021, 16:35

Re: NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#6 Post by intraz »

Thank you for the clarification.
My drive is a 10TB WD Gold Enterprise Class SATA Hard Drive (https://shop.westerndigital.com/product ... #WD102KRYZ).
I will rerun TestDisk with GPT selected as the partition table style and update here with the new log file.

intraz
Posts: 5
Joined: 08 Jul 2021, 16:35

Re: NTFS partition: all files accessible but partition not accessible and overlaps another partition i don't need

#7 Post by intraz »

Quick update,

I started a new quick search after choosing GPT partition table type.
It's running extremely slowly. 3% in 7 hours since I started.
At this rate it will take about a week to finish. Is this normal?

Current log:

Code: Select all

Tue Jul 13 00:06:12 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1919725657088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: EFI GPT
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=19532873727 (expected 19532873727)
hdr_lba_start=34
hdr_lba_end=19532873694
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=19532873727
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=19532873694
hdr_lba_table=19532873695
hdr_entries=128
hdr_entsz=128
Trying alternate GPT

Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=19532873727 (expected 19532873727)
hdr_lba_start=34
hdr_lba_end=19532873694
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=19532873727
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=19532873694
hdr_lba_table=19532873695
hdr_entries=128
hdr_entsz=128
Trying alternate GPT
Current partition structure:
Trying alternate GPT
Ongoing test info:

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Analyse cylinder 309269/1215864: 25%


  MS Data                    32768 4295000062 4294967295 [Data]
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster
  Linux filesys. data   4704189757 4704528073     338316 [~W6~D^OM-,~Wj>/M-8^Ya$M-%']                                   

Locked