Page 1 of 1

Not sure what to do or how to proceed

Posted: 30 Sep 2013, 21:57
by gregrph
Hi all,
I am trying to recover my wife's laptop hard drive (or at least the files on it) It has (had) windows 7 on it and I have it in an external enclosure on my win 8 machine. When I run testdisk and choose the drive (Toshiba 640gb) this is what I get:
snip1.PNG
snip1.PNG (15.52 KiB) Viewed 3790 times
Then I do the Quick Search, get the following screen
Snip2.PNG
Snip2.PNG (17.85 KiB) Viewed 3790 times
Then I do the deeper search
Snip3.PNG
Snip3.PNG (13.95 KiB) Viewed 3790 times
and then I run into trouble:

Re: Not sure what to do or how to proceed

Posted: 01 Oct 2013, 23:40
by Fiona
Your partition structur looks ok?
Please let me know what's your problem (maybe one partition appears as unformatted etc.. ?).
And from what partition dod you like to recover data from?

Fiona

Re: Not sure what to do or how to proceed

Posted: 02 Oct 2013, 04:36
by gregrph
Hi Fiona- Here are more screens:
Snip4.PNG
Snip4.PNG (19.45 KiB) Viewed 3774 times
snip5.PNG
snip5.PNG (17.67 KiB) Viewed 3774 times
I am runnbing testdisk again to get a last screen capture. It does not stay like this when done running. I would like to recover data from the Acer partition or fix the drive so that it can be used again. Thanks! Will post the last screeshot tomorrow night.
Greg

Re: Not sure what to do or how to proceed

Posted: 02 Oct 2013, 12:46
by gregrph
snip6.PNG
snip6.PNG (13.98 KiB) Viewed 3766 times
snip6.PNG
snip6.PNG (13.98 KiB) Viewed 3766 times
Once Testdisk finishes running, this is what I get:

and my log file:

Re: Not sure what to do or how to proceed

Posted: 02 Oct 2013, 14:25
by Fiona
Thanks for your infos!
The unrecoverable partition lies beyond the limit of your disk.
This partition has no significance, because testdisk can display partition found using any remnants or just recognize it this way.
Your Acer partition fits exactly.
So it doesn't look like, that you have any problem with your partition table but I assume your file system or bootsector.
You can try to rebuild your bootsector and have a try list your files.
Some tips;
Repeat your diagnose until you get to the menus.
But don't confirm at Analyse but Advanced.
Select your Acer partition and confirm at Boot.
Run Rebuild BS and afterwards check the menu List and have a try to list your data.
If you still receive an error message, indicates that your file system might be damaged.
In this case, you probably need datarecovery software which reads your data underlying in your sectors, ignoring your file system, like PhotoRec.
Info will follow!

Please let me know, have your been able to list your files or did you receive an error message.

Fiona

Re: Not sure what to do or how to proceed

Posted: 03 Oct 2013, 03:55
by gregrph
Ok, I selected the Acer partition then advanced and then boot. Got a message that says Boot sector status ok and backup boot sector status ok. I did the Rebuild BS and was greated with Boot Sector Status ok and Backup Boot Sector status ok. Sectors are identical. Do I need to repair MFT? When I go back to Analyze, Quick Search, the 3 partioions are highleted in green. When I press P to list files, I see the files in each partiotion. In Windows Explorer, only the PQSERVICE is readable. The other 2 partitions have drive letters assigned to them but I get an error that the file or directory is unreadable.

Re: Not sure what to do or how to proceed

Posted: 03 Oct 2013, 18:13
by Mysticstrider
Hey Fiona, would you please be kind enough to answer my posts? It looks like you are only helping those people who are decent with English and good at explaining their problems. English isn't obviously my first language, but you need to help me here...

http://forum.cgsecurity.org/phpBB3/3tb- ... t2818.html This is my post. Now I would appreciate if you may help me with my 3TB Raw Harddrive problem.