Vista home contents of sda1 = 582 GB of 750 GB disappeared

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
halfbrain
Posts: 10
Joined: 28 Jan 2013, 01:28
Location: Metropolregion Stuttgart, dort wo der Stuttgart21-Halbschrägtief-Lügenbahnhof gebaut werden soll

Vista home contents of sda1 = 582 GB of 750 GB disappeared

#1 Post by halfbrain »

[this is being wrote on my emergency-win98-pc from 1997 - win98 lives!]

Hello all together,

I promise openly: I will donate, if possible by paypal, if help will help ;) .

Well, my problem started one morning, when on my HP Pavilion with Vista home (32bit) on it's first, the original system-750GB-drive an automatic-win-vista-update ran.

After the update and reboot of the system, the system no longer ran.

Than after somehow muddling with the HP repair console, the system still wouldn't restart again.

Whereas an important part of my data is still accessible on sdb1 to sdb7 (2TB) it is not including extremely import emails and special bank-access-data, that are on the first 750GB-drive, because I had not yet changed the path to have both of them as well on the 2TB-Drive.

So, my problems seems to be on sda1 (582 GB). Meanwhile I secured this 582 GB bit by bit as iso on a 3TB-disk with ddrescue by Antonio in a 7h session.

The data from sda2 and sda3 seem still to be one the 750-gb-system-drive.

Here is the latest testdisk.log:

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.9.6 (#25 SMP PREEMPT Sat Jun 15 15:27:01 CEST 2013) i686
Compiler: GCC 4.7
Compilation date: 2012-12-16T16:55:56
ext2fs lib: 1.41.12, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.4, ewf lib: 20100226
User is not root!
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD3G4RL, FW:3.CHN
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD7HR83, FW:CC3C
Disk /dev/sr1 - 4111 MB / 3921 MiB - 2007568 sectors (RO), sector size=2048 - TSSTcorpDVD-ROM TS-H353B, FW:HP06

Partition table type (auto): Intel
Disk /dev/sda - 750 GB / 698 GiB - ST3750640AS
Partition table type: Intel

Analyse Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 70760/185/18
NTFS at 89883/0/1
Info: size boot_sector 21173669, partition 21173670
get_geometry_from_list_part_aux head=255 nbr=3
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=3
Current partition structure:
1 P HPFS - NTFS 0 1 1 70760 174 29 1136770328
2 P HPFS - NTFS 70760 185 18 89882 233 15 307197952 [erziehungswiss]
3 * HPFS - NTFS 89883 0 1 91200 254 63 21173670 [sysschutz]

search_part()
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63

NTFS at 0/1/1
filesystem size 1136770328
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 71048145
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 70760 174 29 1136770328
NTFS, blocksize=4096, 582 GB / 542 GiB

NTFS at 70760/185/18
filesystem size 307197952
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 19199871
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 70760 185 18 89882 233 15 307197952 [erziehungswiss]
NTFS, blocksize=4096, 157 GB / 146 GiB

NTFS at 89883/0/1
filesystem size 21173669
sectors_per_cluster 8
mft_lcn 170152
mftmirr_lcn 255229
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 89883 0 1 91200 254 62 21173669 [sysschutz]
NTFS, blocksize=4096, 10 GB / 10 GiB

NTFS at 91201/0/1
filesystem size 5087
sectors_per_cluster 8
mft_lcn 317
mftmirr_lcn 607
clusters_per_mft_record -10
clusters_per_index_record 1

NTFS: Can't read MFT
HPFS - NTFS 91201 0 1 91201 80 47 5087
NTFS, blocksize=4096, 2604 KB / 2543 KiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
HPFS - NTFS 0 1 1 70760 254 63 1136775402
NTFS, blocksize=4096, 582 GB / 542 GiB
HPFS - NTFS 70760 185 18 89882 233 15 307197952 [erziehungswiss]
NTFS, blocksize=4096, 157 GB / 146 GiB
* HPFS - NTFS 89883 0 1 91200 254 63 21173670 [sysschutz]
NTFS, blocksize=4096, 10 GB / 10 GiB
P HPFS - NTFS 91201 0 1 91201 254 63 16065
NTFS, blocksize=4096, 8225 KB / 8032 KiB
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.

dir_partition inode=5
HPFS - NTFS 0 1 1 70760 254 63 1136775402
NTFS, blocksize=4096, 582 GB / 542 GiB
Directory /
5 dr-xr-xr-x 0 0 0 16-May-2013 11:29 .
5 dr-xr-xr-x 0 0 0 16-May-2013 11:29 ..

interface_write()
1 * HPFS - NTFS 89883 0 1 91200 254 63 21173670 [sysschutz]
2 P HPFS - NTFS 91201 0 1 91201 254 63 16065

search_part()
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63

NTFS at 0/1/1
filesystem size 1136770328
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 71048145
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 70760 174 29 1136770328
NTFS, blocksize=4096, 582 GB / 542 GiB

NTFS at 70760/185/18
filesystem size 307197952
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 19199871
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 70760 185 18 89882 233 15 307197952 [erziehungswiss]
NTFS, blocksize=4096, 157 GB / 146 GiB
BAD_RS LBA=4186989146 15539560
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 260628 5 12 310751 35 61 805227935
This partition ends after the disk limits. (start=4186989146, size=805227935, end=697249784, disk end=1465149168)

NTFS at 89882/233/15
filesystem size 307197952
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 19199871
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 70760 185 18 89882 233 15 307197952 [erziehungswiss]
NTFS found using backup sector, blocksize=4096, 157 GB / 146 GiB

NTFS at 89882/254/63
filesystem size 1443970332
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 6555520
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 89882 254 63 1443970332
NTFS found using backup sector, blocksize=4096, 739 GB / 688 GiB

NTFS at 89883/0/1
filesystem size 21173669
sectors_per_cluster 8
mft_lcn 170152
mftmirr_lcn 255229
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 89883 0 1 91200 254 62 21173669 [sysschutz]
NTFS, blocksize=4096, 10 GB / 10 GiB

NTFS at 91201/0/1
filesystem size 5087
sectors_per_cluster 8
mft_lcn 317
mftmirr_lcn 607
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 91201 0 1 91201 80 47 5087
NTFS, blocksize=4096, 2604 KB / 2543 KiB
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (750 GB / 698 GiB) seems too small! (< 2556 GB / 2380 GiB)
The following partition can't be recovered:
FAT16 <32M 260628 5 12 310751 35 61 805227935
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=6

Results
HPFS - NTFS 0 1 1 70760 254 63 1136775402
NTFS, blocksize=4096, 582 GB / 542 GiB

HPFS - NTFS 0 1 1 89882 254 63 1443970332
NTFS found using backup sector, blocksize=4096, 739 GB / 688 GiB

HPFS - NTFS 70760 185 18 89882 233 15 307197952 [erziehungswiss]
NTFS, blocksize=4096, 157 GB / 146 GiB

* HPFS - NTFS 89883 0 1 91200 254 63 21173670 [sysschutz]
NTFS, blocksize=4096, 10 GB / 10 GiB

P HPFS - NTFS 91201 0 1 91201 254 63 16065
NTFS, blocksize=4096, 8225 KB / 8032 KiB

ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.

dir_partition inode=5
HPFS - NTFS 0 1 1 70760 254 63 1136775402
NTFS, blocksize=4096, 582 GB / 542 GiB
Directory /
5 dr-xr-xr-x 0 0 0 16-May-2013 11:29 .
5 dr-xr-xr-x 0 0 0 16-May-2013 11:29 ..
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


dir_partition inode=5
HPFS - NTFS 0 1 1 89882 254 63 1443970332
NTFS found using backup sector, blocksize=4096, 739 GB / 688 GiB
Directory /
5 dr-xr-xr-x 0 0 0 16-May-2013 11:29 .
5 dr-xr-xr-x 0 0 0 16-May-2013 11:29 ..

interface_write()
1 * HPFS - NTFS 89883 0 1 91200 254 63 21173670 [sysschutz]
2 P HPFS - NTFS 91201 0 1 91201 254 63 16065

TestDisk exited normally .

By the way, I changed absolutely nothing on the pc since the system crash!

Has any of you guys out there in the wild wild world any hints or ideas, how I could get the system again running recuperating my disappeared data and programms on C:\ = 750-gb-system-drive?

Life can be so hard

Best regards

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Vista home contents of sda1 = 582 GB of 750 GB disappear

#2 Post by cgrenier »

Try TestDisk, Advanced, select the NTFS partition,Undelete. If it failed to recover your files, you can always try PhotoRec. Be careful to not store the recovered files on this partition.

Locked