A fool proof manual for the nuts is missing...

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
marezio
Posts: 2
Joined: 03 Nov 2012, 21:06

A fool proof manual for the nuts is missing...

#1 Post by marezio »

Hi you, computer guru's (don't know how lucky you are!!!)
A friend of mine made a mistake and formatted (by mistake) a partition that was full of his data.
Since I tried hard to understand how testdisk works and couldn't get it, I will go through the routine requested by the Support page, that is:
- run testdisk_win.exe or testdisk,
- choose 'Create a new log file',
- select your hard disk,
- select the partition type,
- choose Analyse, Quick Search and next Deeper Search
- for each partition, use 'p' to list the files,
- at the end, choose Quit,
Please post on the forum a description of your problem
- the testdisk.log file,
- a brief explanation about the problem and
- some information (size, label, filesystem type) about your previous partitions.

So... The mentioned HD is a MAXTOR DiamondMax 21 PATA - STM3160215A 160 Gb with 2 partitions - The first is the boot one 57 Gb (NTFS) and the second one is just a logical 103 Gb partition called [DATI]

The first one is OK, but the second one wrongly re-formatted has 3 typical (empty) invisible directories made by windows formatting (found.000, Recycler, and System Volume Information). I can't get to retrieve the old data contained in it. By the way, he told me that it was almost full (close to 90 Gb) - I just can't find them!!! :evil:

Log file is here:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Sat Nov 3 20:50:53 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-10-25T19:31:29
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=300090728448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdh)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=300090728448
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=48833455104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=451271761920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=46464574464
filewin32_getfilesize(\\.\G:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\I:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\I:
filewin32_getfilesize(\\.\J:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\J:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\J:
filewin32_getfilesize(\\.\K:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\K:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=487757824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=3538550784
filewin32_getfilesize(\\.\N:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\N:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\N:
filewin32_getfilesize(\\.\O:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\O:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\O:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=107605983744
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - STM3500418AS, FW:CC38
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - MAXTOR STM3500320AS, FW:MX15
Disk /dev/sdc - 300 GB / 279 GiB - CHS 36483 255 63, sector size=512 - Maxtor 6L300S0, S/N:364c4d304633474b202020202020202020202020, FW:BACE1G10
Disk /dev/sdh - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - MAXTOR S TM3160215A
Drive L: - 487 MB / 465 MiB - CHS 116 64 32, sector size=2048 - NF3134V RFN230V, FW:1.0
Drive M: - 3538 MB / 3374 MiB - CHS 843 64 32, sector size=2048 - NF3134V RFN230V, FW:1.0

Partition table type (auto): Intel
Disk /dev/sdh - 160 GB / 149 GiB - MAXTOR S TM3160215A
Partition table type: Intel

Analyse Disk /dev/sdh - 160 GB / 149 GiB - CHS 19457 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 6373/166/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=5
get_geometry_from_list_part_aux head=16 nbr=5
get_geometry_from_list_part_aux head=32 nbr=5
get_geometry_from_list_part_aux head=64 nbr=5
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=5
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 5648 254 63 90751122
2 E extended LBA 6373 165 1 19455 254 63 210168000
5 L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]

search_part()
Disk /dev/sdh - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/1/1
filesystem size 90751122
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 5671945
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS, blocksize=4096, 46 GB / 43 GiB
NTFS at 6373/166/1
filesystem size 210167937
sectors_per_cluster 8
mft_lcn 2239842
mftmirr_lcn 66
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS, blocksize=4096, 107 GB / 100 GiB
file_pread(7,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(7,1,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(7,15,buffer,312582145(19457/86/23)) lseek err Invalid argument
file_pread(7,3,buffer,312582160(19457/86/38)) lseek err Invalid argument
file_pread(7,3,buffer,312582207(19457/87/22)) lseek err Invalid argument
file_pread(7,8,buffer,312582223(19457/87/38)) lseek err Invalid argument
file_pread(7,11,buffer,312582270(19457/88/22)) lseek err Invalid argument
file_pread(7,2,buffer,312584192(19457/118/54)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=2
Warning: the current number of heads per cylinder is 255 but the correct value may be 240.

Results
* HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS, blocksize=4096, 46 GB / 43 GiB
L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS, blocksize=4096, 107 GB / 100 GiB


dir_partition inode=5
* HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS, blocksize=4096, 46 GB / 43 GiB
Directory /
5 dr-xr-xr-x 0 0 0 26-Aug-2012 12:08 .
5 dr-xr-xr-x 0 0 0 26-Aug-2012 12:08 ..
7419 -r--r--r-- 0 0 0 15-Aug-2012 12:26 AUTOEXEC.BAT
19896 dr-xr-xr-x 0 0 0 15-Aug-2012 19:04 BM2005
24305 -r--r--r-- 0 0 211 18-Aug-2012 17:18 boot.bak
3521 -r--r--r-- 0 0 213 18-Aug-2012 18:41 boot.ini
1862 -r--r--r-- 0 0 4952 14-Apr-2008 14:00 Bootfont.bin
19415 dr-xr-xr-x 0 0 0 25-Aug-2012 15:30 Config.Msi
7418 -r--r--r-- 0 0 0 15-Aug-2012 12:26 CONFIG.SYS
3533 dr-xr-xr-x 0 0 0 15-Aug-2012 15:00 Documents and Settings
7420 -r--r--r-- 0 0 0 15-Aug-2012 12:26 IO.SYS
7421 -r--r--r-- 0 0 0 15-Aug-2012 12:26 MSDOS.SYS
3493 -r--r--r-- 0 0 47564 14-Apr-2008 14:00 NTDETECT.COM
3489 -r--r--r-- 0 0 251600 14-Apr-2008 14:00 ntldr
14188 -r--r--r-- 0 0 2145386496 26-Aug-2012 12:46 pagefile.sys
4006 dr-xr-xr-x 0 0 0 19-Aug-2012 19:24 Programmi
3524 dr-xr-xr-x 0 0 0 29-Oct-2012 18:55 RECYCLER
3522 dr-xr-xr-x 0 0 0 15-Aug-2012 14:55 System Volume Information
28 dr-xr-xr-x 0 0 0 26-Aug-2012 12:10 WINDOWS


dir_partition inode=5
L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS, blocksize=4096, 107 GB / 100 GiB
Directory /
5 dr-xr-xr-x 0 0 0 25-Aug-2012 15:30 .
5 dr-xr-xr-x 0 0 0 25-Aug-2012 15:30 ..
17 dr-xr-xr-x 0 0 0 19-Aug-2012 19:15 found.000
27 dr-xr-xr-x 0 0 0 21-Aug-2012 18:24 RECYCLER
24 dr-xr-xr-x 0 0 0 19-Aug-2012 19:16 System Volume Information
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 1 1 5648 254 63 90751122
2 E extended LBA 6373 0 1 19455 254 63 210178395
5 L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]

search_part()
Disk /dev/sdh - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/1/1
filesystem size 90751122
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 5671945
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS, blocksize=4096, 46 GB / 43 GiB
NTFS at 5648/254/63
filesystem size 90751122
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 5671945
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS found using backup sector, blocksize=4096, 46 GB / 43 GiB
NTFS at 6373/166/1
filesystem size 210167937
sectors_per_cluster 8
mft_lcn 2239842
mftmirr_lcn 66
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS, blocksize=4096, 107 GB / 100 GiB
NTFS at 19455/254/63
filesystem size 210167937
sectors_per_cluster 8
mft_lcn 2239842
mftmirr_lcn 66
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS found using backup sector, blocksize=4096, 107 GB / 100 GiB
file_pread(7,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(7,1,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(7,1,buffer,312582143(19457/86/21)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=2
Warning: the current number of heads per cylinder is 255 but the correct value may be 240.

Results
* HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS, blocksize=4096, 46 GB / 43 GiB
L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS, blocksize=4096, 107 GB / 100 GiB


dir_partition inode=5
* HPFS - NTFS 0 1 1 5648 254 63 90751122
NTFS, blocksize=4096, 46 GB / 43 GiB
Directory /
5 dr-xr-xr-x 0 0 0 26-Aug-2012 12:08 .
5 dr-xr-xr-x 0 0 0 26-Aug-2012 12:08 ..
7419 -r--r--r-- 0 0 0 15-Aug-2012 12:26 AUTOEXEC.BAT
19896 dr-xr-xr-x 0 0 0 15-Aug-2012 19:04 BM2005
24305 -r--r--r-- 0 0 211 18-Aug-2012 17:18 boot.bak
3521 -r--r--r-- 0 0 213 18-Aug-2012 18:41 boot.ini
1862 -r--r--r-- 0 0 4952 14-Apr-2008 14:00 Bootfont.bin
19415 dr-xr-xr-x 0 0 0 25-Aug-2012 15:30 Config.Msi
7418 -r--r--r-- 0 0 0 15-Aug-2012 12:26 CONFIG.SYS
3533 dr-xr-xr-x 0 0 0 15-Aug-2012 15:00 Documents and Settings
7420 -r--r--r-- 0 0 0 15-Aug-2012 12:26 IO.SYS
7421 -r--r--r-- 0 0 0 15-Aug-2012 12:26 MSDOS.SYS
3493 -r--r--r-- 0 0 47564 14-Apr-2008 14:00 NTDETECT.COM
3489 -r--r--r-- 0 0 251600 14-Apr-2008 14:00 ntldr
14188 -r--r--r-- 0 0 2145386496 26-Aug-2012 12:46 pagefile.sys
4006 dr-xr-xr-x 0 0 0 19-Aug-2012 19:24 Programmi
3524 dr-xr-xr-x 0 0 0 29-Oct-2012 18:55 RECYCLER
3522 dr-xr-xr-x 0 0 0 15-Aug-2012 14:55 System Volume Information
28 dr-xr-xr-x 0 0 0 26-Aug-2012 12:10 WINDOWS


dir_partition inode=5
L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
NTFS, blocksize=4096, 107 GB / 100 GiB
Directory /
5 dr-xr-xr-x 0 0 0 25-Aug-2012 15:30 .
5 dr-xr-xr-x 0 0 0 25-Aug-2012 15:30 ..
17 dr-xr-xr-x 0 0 0 19-Aug-2012 19:15 found.000
27 dr-xr-xr-x 0 0 0 21-Aug-2012 18:24 RECYCLER
24 dr-xr-xr-x 0 0 0 19-Aug-2012 19:16 System Volume Information
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 1 1 5648 254 63 90751122
2 E extended LBA 6373 0 1 19455 254 63 210178395
5 L HPFS - NTFS 6373 166 1 19455 254 63 210167937 [DATI]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 6373/0/1,lba=102382245

TestDisk exited normally.

Locked