Partition Recovery Help

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
rummeln
Posts: 2
Joined: 30 Oct 2013, 02:24

Partition Recovery Help

#1 Post by rummeln »

Hello,

I took out my internal hard drive to my desktop because the computer crashed and wouldn't restart past the blue windows screen. I purchased a hard drive usb enclosure and connected the hard drive to a laptop computer, but it won't let me open the hard drive... first it says it needs to be formatted, or it says it the drive is corrupted and unreadable, or it says I can't open it because it's read only.

I ran the testdisk program (analyzed my hard drive) and when it finished it shows a screen saying check_FAT: can't read FAT boot sector
Invalid FAT boot sector

I click continue and it takes to a screen showing all of my partitions, the rest are NTFS (see screen shot). How do I know which partition to continue with?

The 3rd partition (HPFS - NTFS 1 0 63 13056... etc) says no backup found with I choose to show files. The rest show files, or the dr-xr-xr-x...etc, but not all of the files that are supposed to be on that hard drive (it's a 1 TB hd).

So at this point what do I do? It says to press enter to continue, but do I need to do anything to the partitions before I do so, and which partition should I highlight before I click continue (does it matter).

Thanks for help!
Attachments
testdisk_NR_102913.png
testdisk_NR_102913.png (56.45 KiB) Viewed 1940 times
Top
rummeln
Posts: 2
Joined: 30 Oct 2013, 02:24

Re: Partition Recovery Help

#2 Post by rummeln »

Can someone please help me with this?

After doing analyse then deep search I get an error saying that the hard drive seems too small, and the following partition (FAT32) can't be recovered. After continue, it shows four partitions (all NTFS). What is happening here? Are any of these partitions the one which had all of my personal files?

Log is below:
Thu Nov 14 07:53:48 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=624521379840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=15294529536
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=107397448704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=108355584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=11755585536
Hard disk list
Disk \\.\PhysicalDrive0 - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 624 GB / 581 GiB - CHS 75927 255 63, sector size=512
Drive D: - 15 GB / 14 GiB - CHS 1859 255 63, sector size=512
Drive F: - 107 GB / 100 GiB - CHS 13056 255 63, sector size=512
Drive H: - 108 MB / 103 MiB - CHS 13 255 63, sector size=512
Drive N: - 11 GB / 10 GiB - CHS 1429 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 120171/228/58
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
2 P HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_IMAGE]

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 209760642
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
NTFS, blocksize=4096, 107 GB / 100 GiB
BAD_RS LBA=35532602 1717690
check_part_i386 failed for partition type 0B
FAT32 269561 38 40 341958 109 16 1163062255
This partition ends after the disk limits. (start=35532602, size=1163062255, end=1198594856, disk end=1953525168)
NTFS at 120171/228/58
filesystem size 22960128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_IMAGE]
NTFS, blocksize=4096, 11 GB / 10 GiB
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2812 GB / 2619 GiB)
The following partition can't be recovered:
FAT32 269561 38 40 341958 109 16 1163062255
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
NTFS, blocksize=4096, 107 GB / 100 GiB
P HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_IMAGE]
NTFS, blocksize=4096, 11 GB / 10 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
2 P HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_IMAGE]

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 209760642
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
NTFS, blocksize=4096, 107 GB / 100 GiB
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [SYSTEM]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [SYSTEM]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1930354688
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 120171 228 57 1930354688 [HP]
NTFS, blocksize=4096, 988 GB / 920 GiB
NTFS at 13056/254/63
filesystem size 209760642
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
NTFS found using backup sector, blocksize=4096, 107 GB / 100 GiB
BAD_RS LBA=35532602 1717690
check_part_i386 failed for partition type 0B
FAT32 269561 38 40 341958 109 16 1163062255
This partition ends after the disk limits. (start=35532602, size=1163062255, end=1198594856, disk end=1953525168)
NTFS at 120171/228/57
filesystem size 1930354688
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 120171 228 57 1930354688 [HP]
NTFS found using backup sector, blocksize=4096, 988 GB / 920 GiB
NTFS at 120171/228/58
filesystem size 22960128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_IMAGE]
NTFS, blocksize=4096, 11 GB / 10 GiB
NTFS at 121601/25/24
filesystem size 22960128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_IMAGE]
NTFS found using backup sector, blocksize=4096, 11 GB / 10 GiB
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2812 GB / 2619 GiB)
The following partition can't be recovered:
FAT32 269561 38 40 341958 109 16 1163062255
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 1 1 13056 254 63 209760642 [formatted]
NTFS, blocksize=4096, 107 GB / 100 GiB
HPFS - NTFS 0 32 33 12 223 19 204800 [SYSTEM]
NTFS, blocksize=4096, 104 MB / 100 MiB
HPFS - NTFS 12 223 20 120171 228 57 1930354688 [HP]
NTFS, blocksize=4096, 988 GB / 920 GiB
* HPFS - NTFS 120171 228 58 121601 25 24 22960128 [FACTORY_I
Top
Locked

Return to “Partition Recovery”