harddisk seems too small / can't open filesystem

[gattofix]

Hi,

I am using Ubuntu 12.04 and Windows 8 in a dual boot configuration.

Yesterday, I tried to create a bootable version of Linux Mint on a USB stick following these directions:
http://community.linuxmint.com/tutorial/view/744

And even though it said "warning", I just copied and executed the following command:

sudo dd if=~/Desktop/linuxmint.iso of=/dev/sdb oflag=direct bs=1048576

I had adjusted the iso name. Immediately after typing "Enter", I realized my mistake: sdb was an internal 1TB NTFS partition with important data, not the USB stick!

I closed the terminal immediately, but the partition was empty, apart from the Linux Mint Image.

Then I tried testdisk. I forgot to have the program make a logfile, so I am running it again right now. But it is going to take many hours, running both quickscan and the deeper scan again, and maybe you can already give me some advice based on the screenshots I have taken.

I have attached the screenshots.

But this is what happened:

After "Analyse" Testdisk could not find any partition, at all. I had chosen "PC" partition, of course. I knew it was NTFS.

After the following QuickScan I got the message that the harddisk was too small.

I then chose the deeper scan, as I did not know what I could have done about that first message.

The result of the deeper scan - the same message that the harddisk was too small, plus the message "The following partition can't be recovered"

testdisk 1.png (53.57 KiB) Viewed 5688 times

But then testdisk did find the ntfs partition (see second screenshot): "NTFS found using backup sector", a logical partition.

testdisk 2.png (62.34 KiB) Viewed 5688 times

Listing the files with "p" did result in an error message, I then changed the partition to "primary", without effect.

When I tried out the filesystem recovery with "undelete", I just got the message "Can't open filesystem. Filesystem seems damaged."

testdisk 3.png (34.25 KiB) Viewed 5688 times

gparted shows the partition as "unallocated", no filesystem.

As I don't have a partition that can be recognized by Windows, I cannot try chkdsk /F, either.

I am going to hand in the log file later, but I'd already like to know if there is a way to
a) restore the partition or at least
b) recover the data with file names intact

Any ideas? Your help would be greatly appreciated.
Frank

[lorn10]

Hi Frank

I noticed with a Samsung 840 Pro SSD a similar issue. In my case, the Windows NTFS partition was suddenly gone.

Before I use TestDisk, the partition was detected by Microsoft diskpart as "RAW" volume. After I use TestDisk, - it is now detected by all software as "unallocated space". Only TestDisk is able to detect it as NTFS partition, but TestDisk refuse to fix it with the message "The following partitions can't be recovered". Very frustrating....

Frank, did you solve you problem somehow?

To all others, is there a chance that I can add this partition manually? Or will I make it worser?

Is there a way to force TestDisk to recover this partition even TestDisk don't wont recover it?

Thanks for any hints...

[lorn10]

AWESOME, - I solved my problem! The NTFS volume is back!!!

What I have done? As assumed I had to add the (lost) partition manually.

In my case this was not complicated. The first partition was healthy and ok, so I establish the second partition directly after the first one. TestDisk detected this automatically, so all the beginning parameters (cylinders, heads, sectors) where correct. I had only to set the correct end parameters (cylinders, heads, sectors) of my lost NTFS partition. This was also not complicated, - I simply take the maximal chs parameters 15566 255 63 which displayed TestDisk above in the "Disk string" (Disk dev/sdb ...). Then I had to set the file system type to HPFS - NTFS. After I write this changes to the partition table I rebooted my system. At last, I had to rebuild the (internal) NTFS file system boot sector BS under "Advanced - Filesystem Utils" option. TestDisk has detected also here the right parameters, in my case the amount of cylinders where wrong (to high).

After that, Windows detected again the NTFS volume! I run chkdsk c: /f /r and several errors where corrected. All data seems to be present. Note, I do not run the Repair MFT function in TestDisk, - that job has done the Microsoft checkdisk tool.

Until now it is not clear what has caused this partition lost, - I suspect the AMD AHCI (SATA) Driver. Probably there is some incompatibility with my system configuration. For me, it is not the first time that this "jinxed" driver had occurred strange reactions...

Last note, as mentioned in my situation with only two NTFS partitions this recovery was finally easy. However, in other constellations with larger number and differed type of partitions the situation can be much more complex.