I have a Lenovo Thinkpad Yoga S1 20CD with 256 GB SSD. I purchased it in 2014, came with Win8 which at one point was upgraded to Win10, but I never changed the partitions.
It all worked fine until one day it failed to boot.
I didn't have a windows recovery drive, so I created one on another windows PC (I didn't think it's specific to the computer on which it was created). The laptop was able to boot from the USB stick, but it wasn't able to do any recovery, when I entered to command line mode, it only saw one partition (not the main one). At this point I probably made a mistake by running `bootrec /fixmbr` (given that it used UEFI boot).
Eventually I booted a live image, tried TestDisk locally, dd'd the entire disk into a file, tried TestDisk on it on a different computer... without much results.
Questions part 1
- are the chances of recovery lower if I just use an image instead of the actual disk? I.e. does TestDisk utilize any additional information about the device that isn't available in the image?
- I simply used `dd` (with conv=noerror,sync), as I didn't know about `ddrescue`. how is `ddrescue` different, isn't it exact copy either way?
Using 7.2-WIP x86_64 in Linux on the actual laptop and disk:
Code: Select all
Fri Aug 27 19:49:17 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 4.19.0-8-amd64 (#1 SMP Debian 4.19.98-1 (2020-01-26)) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 500118192 sectors
/dev/sda: user_max 500118192 sectors
/dev/sda: native_max 500118192 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - LITEONIT LCS-256M6S, S/N:S0C38670Z1ZSX7018263, FW:1C85205
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD Elements 25A2, FW:1021
Disk /dev/sdc - 4089 MB / 3900 MiB - CHS 1022 126 62, sector size=512 - Generic Flash Disk, FW:8.07
Disk /dev/loop0 - 639 MB / 609 MiB - 1248488 sectors (RO), sector size=512
Partition table type (auto): Intel
Disk /dev/sda - 256 GB / 238 GiB - LITEONIT LCS-256M6S
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
check_part_i386 1 type 7E: no test
BAD_RS LBA=2372971140 11327173
check_part_i386 2 type 27: no test
BAD_RS LBA=2744523419 6632306
check_part_i386 3 type 23: no test
BAD_RS LBA=3376438281 8166664
check_part_i386 4 type 57: no test
2 * Windows RE(store) 147710 158 37 328700 141 53 2907603296
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
3 * Sys=23 170838 173 51 409356 186 1 3831792440
4 * Sys=57 210173 143 28 217580 73 60 118989078
Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
check_part_i386 1 type 7E: no test
BAD_RS LBA=2372971140 11327173
check_part_i386 2 type 27: no test
BAD_RS LBA=2744523419 6632306
check_part_i386 3 type 23: no test
BAD_RS LBA=3376438281 8166664
check_part_i386 4 type 57: no test
Current partition structure:
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
Bad relative sector.
2 * Windows RE(store) 147710 158 37 328700 141 53 2907603296
Bad relative sector.
3 * Sys=23 170838 173 51 409356 186 1 3831792440
Bad relative sector.
4 * Sys=57 210173 143 28 217580 73 60 118989078
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
2 * Windows RE(store) 147710 158 37 328700 141 53 2907603296
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
Space conflict between the following two partitions
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
3 * Sys=23 170838 173 51 409356 186 1 3831792440
Space conflict between the following two partitions
3 * Sys=23 170838 173 51 409356 186 1 3831792440
4 * Sys=57 210173 143 28 217580 73 60 118989078
Code: Select all
Thu Sep 2 12:43:38 2021
Command line: TestDisk /log /media/peti/Elements/thinkpad.dd
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.10.40-1rodete2-amd64 (#1 SMP Debian 5.10.40-1rodete2 (2021-06-22)) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
User is not root!
Hard disk list
Disk /media/peti/Elements/thinkpad.dd - 256 GB / 238 GiB - CHS 31133 255 63, sector size=512
Partition table type (auto): Intel
Geometry from i386 MBR: head=192 sector=44
Disk /media/peti/Elements/thinkpad.dd - 256 GB / 238 GiB
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
BAD_RS LBA=2372971140 11327173
BAD_RS LBA=2744523419 6632306
BAD_RS LBA=3376438281 8166664
2 * Windows RE(store) 147710 158 37 328700 141 53 2907603296
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
3 * Sys=23 170838 173 51 409356 186 1 3831792440
4 * Sys=57 210173 143 28 217580 73 60 118989078
Analyse Disk /media/peti/Elements/thinkpad.dd - 256 GB / 238 GiB - CHS 31133 255 63
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
BAD_RS LBA=2372971140 11327173
BAD_RS LBA=2744523419 6632306
BAD_RS LBA=3376438281 8166664
Current partition structure:
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
Bad relative sector.
2 * Windows RE(store) 147710 158 37 328700 141 53 2907603296
Bad relative sector.
3 * Sys=23 170838 173 51 409356 186 1 3831792440
Bad relative sector.
4 * Sys=57 210173 143 28 217580 73 60 118989078
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
2 * Windows RE(store) 147710 158 37 328700 141 53 2907603296
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
Space conflict between the following two partitions
1 * Sys=7E 169312 85 7 305091 64 24 2181288330
3 * Sys=23 170838 173 51 409356 186 1 3831792440
Space conflict between the following two partitions
3 * Sys=23 170838 173 51 409356 186 1 3831792440
4 * Sys=57 210173 143 28 217580 73 60 118989078
Code: Select all
Disk /dev/sda - 256 GB / 238 GiB - LITEONIT LCS-256M6S
Partition table type: None
Interface Advanced
P Unknown 0 0 1 31130 233 63 500118192
Image created successfully.
Interface Advanced
P Unknown 0 0 1 31130 233 63 500118192
Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Current partition structure:
P Unknown 0 0 1 31130 233 63 500118192
search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
LVM magic value at 21083/249/47
LVM magic value at 21083/249/50
LVM magic value at 21083/249/53
Results
- Does the partition table (printed for `Intel`) make any sense? If so, do those partition types (7E, 23, 57) look correct? If not, what may be the correct type?
- Does anyone have an idea what the correct geometry should be for a 256GB SSD in a ThinkPad (from 2014)?
- Any idea what the typical partition table for Windows/ThinkPad looks like (or looked in 2014)? E.g. first 1GB EFI, followed by 4GB FAT for recovery, rest is NTFS.
- Do partition tables/partitions still actually address using CHS or is the geometry only used for aligning partitions on cylinder boundaries? The later would mean that I wouldn't need to check all the possible geometry configurations, but could just search using heads=sectors=1
- If geometry does matter, I wonder how I could automate checking all the configurations. I understand that I can specify geometry parameters using command line flags, but I'm not sure how I should parse the output to recognize success
- Any other suggestions?
Peter