Lost NTFS Paritition after creating NTFS and EXT4 partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Dhabud
Posts: 2
Joined: 02 Dec 2013, 18:01

Lost NTFS Paritition after creating NTFS and EXT4 partitions

#1 Post by Dhabud »

Hello Experts

I had following paritions on my 320GB HDD.
100 MB I guess boot
20 GB System reserved
300GB Windows 7

I wanted to install windows 7 and Ubuntu Side by side. So I created following paritions using Gparted(See ImageA)
ImageA
ImageA
ImageA.jpg (138.88 KiB) Viewed 1854 times
New Paritions
32GB NTFS (for Win7OS)
32GB EXT4 (For UbuntuOS)
4GB Linux SWAP
10GB Ext4 (For UbuntuHOME)
242GB NTFS (For Data)

I did not format them before or after creating them. I than installed Win7 on the above partition(32GB). When I went to restore the Documents and things, I found my backup did not have any files(long story). I lost almost 200GB of personal docs, music, pictures videos. I logged in Win7OS about 3-4 times (some updates went thro'). I have not installed Ubuntu yet and data partion is not used yet.
So I figure there is data there. I tried recovering using testdisk and photorec ddrescue as follows
ddrescue to create the image of whole 320GB HDD to an external HDD.
From image(.dd file) I recovered files using photrec. But the files have no path and names. Hard to find/sort the files I am looking for from the pile.
So next step I used testdisk to recover partition.
testdisk /dev/sda, Quick Search found all the partions in my list above

I did deeper search and I think it found the Orignal Win7 Partion(looking at the size)
But I dont get option to list the file and I got following message. See ImageB
ImageB
ImageB
ImageB.jpg (91.93 KiB) Viewed 1837 times
I read the forums and Fiona suggested to someone about overlapping partions and mark it as delete.
I am in process of doing it on the actual HDD not the image.
Am I in the right direction. Any suggestions on how to recover the full partition.


Thank you in advance.
Dhabud

Dhabud
Posts: 2
Joined: 02 Dec 2013, 18:01

Re: Lost NTFS Paritition after creating NTFS and EXT4 partit

#2 Post by Dhabud »

I tried deleting all but one partition shown in Image B and Ran deeper search and still see the same message. It found the partition but does not allow me option to list files.

Log
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 10182/193/60
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 4177 85 4 66902016
3 E extended 4177 85 5 38913 70 5 558032896
5 L Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
X extended 8354 202 41 8877 22 41 8390656
6 L Linux Swap 8354 235 10 8877 22 41 8388608
X extended 8877 22 42 10182 161 27 20973568
7 L Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
X extended 10182 161 28 38913 70 5 461557760
8 L HPFS - NTFS 10182 193 60 38913 70 5 461555712 [Data]

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 66902016
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 4177 85 4 66902016
NTFS, blocksize=4096, 34 GB / 31 GiB

recover_EXT2: s_block_group_nr=0/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock, 34 GB / 32 GiB
Linux Swap 8354 235 10 8877 22 25 8388592
SWAP2 version 1, pagesize=4096, 4294 MB / 4095 MiB

recover_EXT2: s_block_group_nr=0/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock, 10 GB / 10 GiB
NTFS at 10182/193/60
filesystem size 461555712
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 28847231
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 10182 193 60 38913 70 5 461555712 [Data]
NTFS, blocksize=4096, 236 GB / 220 GiB

Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 4177 85 4 66902016
NTFS, blocksize=4096, 34 GB / 31 GiB
P Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock, 34 GB / 32 GiB
L Linux Swap 8354 235 10 8877 22 41 8388608
SWAP2 version 1, pagesize=4096, 4294 MB / 4096 MiB
L Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock, 10 GB / 10 GiB
L HPFS - NTFS 10182 193 60 38913 70 5 461555712 [Data]
NTFS, blocksize=4096, 236 GB / 220 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 66902016
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 4177 85 4 66902016
NTFS, blocksize=4096, 34 GB / 31 GiB
NTFS at 4177/85/4
filesystem size 66902016
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 4177 85 4 66902016
NTFS found using backup sector, blocksize=4096, 34 GB / 31 GiB

recover_EXT2: s_block_group_nr=0/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock, 34 GB / 32 GiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/256, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 8388608
recover_EXT2: part_size 67108864
Linux 4177 117 37 8354 202 40 67108864 [UbuntuOS]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 34 GB / 32 GiB
Linux Swap 8354 235 10 8877 22 25 8388592
SWAP2 version 1, pagesize=4096, 4294 MB / 4095 MiB

recover_EXT2: s_block_group_nr=0/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock, 10 GB / 10 GiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/80, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
Linux 8877 55 11 10182 161 27 20971520 [UbuntuHome]
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 10 GB / 10 GiB
NTFS at 10182/193/60
filesystem size 461555712
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 28847231
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 10182 193 60 38913 70 5 461555712 [Data]
NTFS, blocksize=4096, 236 GB / 220 GiB
NTFS at 20880/237/30
filesystem size 603966128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 20880 237 30 58476 21 25 603966128
NTFS, blocksize=4096, 309 GB / 287 GiB
This partition ends after the disk limits. (start=335452160, size=603966128, end=939418287, disk end=625153410)
BAD_RS LBA=2299115458 7674398
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 143113 81 11 190034 166 38 753791248
This partition ends after the disk limits. (start=2299115458, size=753791248, end=3052906705, disk end=625153410)
NTFS at 38913/70/5
filesystem size 461555712
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 28847231
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 10182 193 60 38913 70 5 461555712 [Data]
NTFS found using backup sector, blocksize=4096, 236 GB / 220 GiB
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 1563 GB / 1455 GiB)
The following partitions can't be recovered:
HPFS - NTFS 20880 237 30 58476 21 25 603966128
NTFS, blocksize=4096, 309 GB / 287 GiB
FAT32 LBA 143113 81 11 190034 166 38 753791248
Dhabud

Locked