File Recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

File Recovery

#1 Post by khairun »

Hi Everyone, Fionna and Remmy...

Thank you for letting me join the forum.
I have a problem with my external drive and could not access it but then I found this wonderful software that I believe could help me.
I managed to get this part (see attached) and still going for deeper search..
Previously I try to get the listed files and I can see some of folders and files ae there but I found some of them is not accessible,or it was saying no file found or system damage. Sound scary to me...
So I went to deepr search to get any better result or solution that software can offer...
While I'm waiting for the results.. there something that I need to pay attention on this data corruption here?

I attached my log to see if you guys can help to find any clue what was going wrong with my hard drive so I can check and investigates further...

Thank You!
Attachments
deeper-search.jpg
deeper-search.jpg (68.65 KiB) Viewed 5223 times

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#2 Post by khairun »

Hi I have another files that I would like to show you show you will know what i should do next to get all the data safely. Thank You!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: File Recovery

#3 Post by Fiona »

Your disk geometry looks wrong!
The value is 32 but should be 63.
You can use the geometry menu to change the value.
Confirm in testdisk through until you get to Analyse.
Don't confirm at Analyse.
Mark the menu geometry.
Mark Sectors and change it from 32 to 63.
Confirm with OK to leave the menu geometry.
Repeat your diagnose and copy and paste the content of your testdisk.log.
You'll find your testdisk.log in your testdisk folder.
This can improve your results.

Fiona

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#4 Post by khairun »

Hi Fiona,

Thank you for you prompt reply...
I changed the sector to 63. Now I'm doing analysis and do the quick search...
While waiting... here'e the first shot of anlyses..

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 484506 64 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 E extended LBA             0   0 33 484504   3  3 1953520288

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD)
 5 L FAT32 LBA                0   1  2 484503  62 62 1953520000 [SPRITES]

Warning: Bad ending head (CHS and LBA don't match)

*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
>[Quick Search]  [ Backup ]
                            Try to locate partition

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#5 Post by khairun »

Hi Fiona, here the log file result ...

Code: Select all

ue Oct  1 14:59:51 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=395142234112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=160039240704
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=1000202240000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=784902144
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500418AS, S/N:2020202020202020202020205635484d44365744, FW:CC38
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST3160815AS, S/N:202020202020202020202020523641413831374d, FW:4.AAB
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 953869 64 32, sector size=512 - StoreJet Transcend, S/N:524201DG9J6S2S
Drive K: - 784 MB / 748 MiB - CHS 187 64 32, sector size=2048

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - StoreJet Transcend
Partition table type: Intel
New geometry
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 484506 64 63 sector_size=512

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 484506 64 63
Geometry from i386 MBR: head=255 sector=32
BAD_RS LBA=32 63
BAD_RS LBA=64 126
FAT32 at 0/1/2
Info: size boot_sector 1953520000, partition 1953520000
FAT1 : 32-238447
FAT2 : 238448-476863
start_rootdir : 476864 root cluster : 2
Data : 476864-1953519999
sectors : 1953520000
cluster_size : 64
no_of_cluster : 30516299 (2 - 30516300)
fat_length 238416 calculated 238409
file_pread(6,16,buffer,238513(59/9/59)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,238513(59/9/59)) ReadFile Data error (cyclic redundancy check).

comp_FAT: can't read FAT2
heads/cylinder 255 (FAT) != 64 (HD)
Current partition structure:
 1 E extended LBA             0   0 33 484504   3  3 1953520288

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD)
 5 L FAT32 LBA                0   1  2 484503  62 62 1953520000 [SPRITES]

Warning: Bad ending head (CHS and LBA don't match)

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 484506 64 63
BAD_RS LBA=64 126
file_pread(6,14,buffer,238514(59/9/60)) ReadFile Data error (cyclic redundancy check).

comp_FAT: can't read FAT2
heads/cylinder 255 (FAT) != 64 (HD)
comp_FAT: can't read FAT2
heads/cylinder 255 (FAT) != 64 (HD)
FAT32 at 0/1/2
FAT1 : 32-238447
FAT2 : 238448-476863
start_rootdir : 476864 root cluster : 2
Data : 476864-1953519999
sectors : 1953520000
cluster_size : 64
no_of_cluster : 30516299 (2 - 30516300)
fat_length 238416 calculated 238409
file_pread(6,16,buffer,238512(59/9/58)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,238512(59/9/58)) ReadFile Data error (cyclic redundancy check).

comp_FAT: can't read FAT2
heads/cylinder 255 (FAT) != 64 (HD)

FAT32 at 0/1/2
     FAT32 LBA                0   1  2 484503  62 62 1953520000 [SPRITES]
     FAT32, blocksize=32768, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(484505/25/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(484505/25/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953526207(484505/32/32)) lseek err Invalid argument
file_pread(6,1,buffer,1953526207(484505/32/32)) lseek err Invalid argument
file_pread(6,2,buffer,1953526208(484505/32/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953526271(484505/33/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953526271(484505/33/33)) lseek err Invalid argument
file_pread(6,8,buffer,1953525184(484505/16/17)) lseek err Invalid argument
file_pread(6,1,buffer,1953525184(484505/16/17)) lseek err Invalid argument
file_pread(6,8,buffer,1953525312(484505/18/19)) lseek err Invalid argument
file_pread(6,8,buffer,1953525440(484505/20/21)) lseek err Invalid argument
file_pread(6,8,buffer,1953525568(484505/22/23)) lseek err Invalid argument
file_pread(6,8,buffer,1953525696(484505/24/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(484505/25/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525762(484505/25/28)) lseek err Invalid argument
file_pread(6,3,buffer,1953525776(484505/25/42)) lseek err Invalid argument
file_pread(6,3,buffer,1953525823(484505/26/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525839(484505/26/42)) lseek err Invalid argument
file_pread(6,11,buffer,1953525886(484505/27/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953527808(484505/57/58)) lseek err Invalid argument
Warning: the current number of heads per cylinder is 64 but the correct value may be 255.

Results
   L FAT32 LBA                0   1  2 484503  62 62 1953520000 [SPRITES]
     FAT32, blocksize=32768, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA             0   1  1 484503  63 63 1953520065
 5 L FAT32 LBA                0   1  2 484503  62 62 1953520000 [SPRITES]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=63

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 484506 64 63
Geometry from i386 MBR: head=255 sector=32
BAD_RS LBA=32 63
BAD_RS LBA=64 126
FAT32 at 0/1/2
Info: size boot_sector 1953520000, partition 1953520000
FAT1 : 32-238447
FAT2 : 238448-476863
start_rootdir : 476864 root cluster : 2
Data : 476864-1953519999
sectors : 1953520000
cluster_size : 64
no_of_cluster : 30516299 (2 - 30516300)
fat_length 238416 calculated 238409
file_pread(6,16,buffer,238512(59/9/58)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,238512(59/9/58)) ReadFile Data error (cyclic redundancy check).

comp_FAT: can't read FAT2
heads/cylinder 255 (FAT) != 64 (HD)
Current partition structure:
 1 E extended LBA             0   0 33 484504   3  3 1953520288

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD)
 5 L FAT32 LBA                0   1  2 484503  62 62 1953520000 [SPRITES]

Warning: Bad ending head (CHS and LBA don't match)
Thanks for your assistance...

I like your avatar, somehow it gave me secure feeling that I'm on the right forum.. :)

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#6 Post by khairun »

Hi Per analyses suggestion I also change the head to 255 and continue with next loop for analyses...

And here my result...

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 E extended LBA             0   0 33 121601   4  3 1953520288

Bad relative sector.
No partition is bootable
 5 L FAT32 LBA                0   1  2 121600 254 62 1953520000 [SPRITES]

Bad relative sector.

Any recommendation and suggestion is welcome...

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#7 Post by khairun »

Further info...

Please let me know what to do next...
Attachments
after-analyses.jpg
after-analyses.jpg (73.39 KiB) Viewed 5210 times

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#8 Post by khairun »

I try to look one of the folder that I'm thinking should exist several files but i found an error messages...

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
   L FAT32 LBA                0   1  2 121600 254 62 1953520000 [SPRITES]
Directory /SOME FOLDERS/PHOTO

No file found, filesystem may be damaged.

Use Left arrow to go back, Right to change directory, h to unhide deleted fi
    q to quit, : to select the current file, a to select all files
    C to copy the selected files, c to copy the current file

khairun
Posts: 11
Joined: 01 Oct 2013, 05:08

Re: File Recovery

#9 Post by khairun »

Some more info...
I hope admin wont mark me flooding the forum with this information...
I have to keep it going with deeper search...while waiting Fiona next advice.. :)
Thanks..

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121604 255 63

     Partition                  Start        End    Size in sectors

 1 E extended LBA             0   1  1 121600 254 63 1953520002
 5 L FAT32 LBA                0   1  2 121600 254 62 1953520000 [SPRITES]


 [  Quit  ] >[Deeper Search]  [ Write  ]  [Extd Part]
                          Try to find more partitions

Last edited by khairun on 01 Oct 2013, 09:14, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: File Recovery

#10 Post by Fiona »

Your partition values don't match.
L FAT32 LBA 0 1 2 121600 254 62 1953520000 [SPRITES]
The values 2 and 62 are not Intel standard.
In your case I'd suggest to copy your files to another disk or healthy partition.
If you list your files you can copy them to another disk/partition.
At the bottom of the screen you'll find the copy commands.
To choose another directory, you can mark these to dots on the upper area of the screen and press enter, until you get to your disk selection.
You can select another disk or partition where you'd like to copy your data to.
To copy your data into a folder you can mark an appropriate folder and enter it by pressing the right arrow key.

If you'd like to recover your partition.
Only if you were able to list your data!
It means your screenshot here;
http://forum.cgsecurity.org/phpBB3/down ... hp?id=1801
you should set it from L for logical to P for primary using your left or right arrow key on your keyboard.
Otherwise you can't recover your partition, because it doesn't match.
Then, press enter to get to tzhe next screen.
Mark "Write" and confirm with enter.
If there would be a message about your boot sector, you can confirm it with backup bs.
But only in case.
Quit TestDisk and restart your PC.

Fiona

Locked