Need HELP w options to recover RAW partition. ***SOLVED***

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Alphonse68
Posts: 6
Joined: 04 Feb 2014, 05:55

Need HELP w options to recover RAW partition. ***SOLVED***

#1 Post by Alphonse68 »

*** To read my solution, Please scroll WAY DOWN to the end, past the EXTREMELY LONG post that someone with a kind of, sort of similar problem (but not really), left below. ***

Hello everyone,
I have a 160GB HD, formatted and partitioned by Win7, which decided to show the 2nd partition as RAW.
I ran TestDisk, but I don't know/understand the info given by TestDisk, and therefore, I don't know which choices to make. The files structure can be seen in both partitions within TestDisk, but it does not boot if installed, and Windows wants to format it if connected through USB. Unfortunatelly I do not have enough space to copy everything out, so I kind of need to recover the partition as it used to be?

Below are TestDisk "screenshots" of two 160GB HDs, the first from which I write, the second is the faulty one.
Attached is the testdisk.log file created for the faulty drive.

Can someone please help me with which options to choose or what other should I do?

TIA. Cheers,
Alphonse

*** Please scroll WAY DOWN, past the EXTREMELY LONG post that someone left below, to find my solution. ***

====================================================================
This section is submitted as a sample of another 160GB HD of different brand.
To my ignorance, the WD's geometrty seems to be the same as the Samsung's??
Both HDs were formatted (and partitioned) by the Windows 7 installation disk,
creating a 100MB partition and then the rest.

HP530 Boot Disk (WD) (in use as I write)

Disk /dev/sda - 160 GB / 149 GiB - CHS 20673 240 63
Partition Start End Size in sectors
1 * HPFS - NTFS 0 32 33 13 163 19 204800
2 P HPFS - NTFS 13 163 20 20673 36 20 312371200

Quick Search:
Partition Start End Size in sectors
* HPFS - NTFS 0 1 1 20671 239 63 312560577

DEEP SEARCH:
Partition Start End Size in sectors
> HPFS - NTFS 0 1 1 20671 239 63 312560577
HPFS - NTFS 0 32 33 13 163 19 204800
HPFS - NTFS 13 163 20 20673 36 20 312371200
Linux 1127 83 36 1632 170 42 7641088 [S]
Linux 1815 38 55 1817 209 1 40960
====================================================================

This is the bad HD.
T4-U (Samsung) *** 2nd Partition is RAW ***

Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:
Warning: number of heads/cylinder mismatches 240 (NTFS) != 255 (HD)
Partition Start End Size in sectors
1 P HPFS - NTFS 0 32 33 12 223 19 204800 This partition can be read by Windows.
2 * HPFS - NTFS 12 223 20 19457 21 20 312371200 This partition appears as RAW.

Partition Start End Size in sectors
> * HPFS - NTFS 0 1 1 19456 254 63 312576642

Quick Search:
Partition Start End Size in sectors
1 * HPFS - NTFS 0 1 1 19456 254 63 312576642

DEEP SEARCH:
Warning: number of heads/cylinder mismatches 240 (NTFS) != 255 (HD)
Partition Start End Size in sectors
HPFS - NTFS 0 1 1 19456 254 63 312576642
HPFS - NTFS 0 32 33 12 223 19 204800
HPFS - NTFS 0 32 33 12 223 19 204800
HPFS - NTFS 12 223 20 19457 21 20 312371200
====================================================================

*** THIS IS WHERE I AM. WHAT DO I DO/CHOOSE? ***

Partition Start End Size in sectors
> HPFS - NTFS 0 1 1 19456 254 63 312576642
HPFS - NTFS 0 32 33 12 223 19 204800 *** Files can be seen here (100MB sys part. Working) ***
HPFS - NTFS 12 223 20 19457 21 20 312371200 *** Files can be seen here (Win7 part. RAW) ***
Linux 9588 79 28 9590 219 37 40960

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue _
NTFS, blocksize=4096, 160 GB / 149 GiB
====================================================================
Last edited by Alphonse68 on 03 Mar 2014, 17:51, edited 1 time in total.

DtaBSe
Posts: 1
Joined: 14 Feb 2014, 13:52

Re: Need HELP w options to recover RAW partition.

#2 Post by DtaBSe »

I am a newbie trying to figure out how to decipher the log file and what actions to take. :!: :?:

Firstly, what I can presume most probable at this point is corrupt file system, no partition table, MBR & MFT ??
and bad sectors (logical). RAW and error 0xc000000f; necessary device not available. What I could not find any info. on is why, in Windows 7 recovery mode, prior to getting to the menu of 'tools', searches for a Windows installation, finds it, but is listed showing O MB (my drive is 581 GB) - so it's not seeing Windows ..

I have a 640gb Windows 7 x64 Gateway NV series notebook that is only 2 years old. I dropped it by accident while several windows and tabs were open and running programs (such as Audacity). It was slow to close and I powered it off - big mistake! When I tried to boot back up I got some kind of disk error occurred press CTRL ALT DEL to restart - failed to start. I have not been able to boot the system back up.

For some reason it seems to me that there is a rather simple solution, but I am just not experienced enough to know what to look for in this situation. Using our friend Google I have read a gazillion different articles researching all angles about how to get Windows back up (a big problem when you have a drive as large as I do with no backup) -- I've figured out one thing - when you're at the stage I am it really takes someone like yourself to help tackle something like this. I've heard nothing but good things about TestDisk, but I remain confused as to what to do.

I'm thinking it's more of a file system corruption (not physical damage; no noise, humming or signs of anything physically wrong) it has to be the files (zeros and ones that got 'jumbled' in the drop) .. and what I may have done
incorrectly to revive it, save as Microsoft has not provided a thorough diagnostic and repair implementation to do so (as far as I'm concerned.)

Any help and advice you can give me with would be dearly appreciated! .. and I can only assume would also go to help many more poor souls like me out there. Thank you in advance for your time and efforts on my behalf.

------------------------------------------ here we go --------------------------------------

My HDD has 3 partitions (or volumes) 15GB PQ Service, 100MB System Reserved and the C: (Windows 7 and User data; of 581gb used of 640GB WD Scorpio Blue 2.5 serial ATA [WDC WD64 00BPVT-22HXZT1]

I created a LIVE CD (Knoppix 7.2) and recovered a large portion of my data to an external hdd of 500gb

Knoppix can no longer mount my HDD

USING TESTDISK
The last two recovery options I tried was to connect the drive to a working hp laptop via external USB to SATA cable. /device/sdd

Windows Explorer Listed Drives:
(G:) My Gateway (asking if I wanted to format; and hit 'cancel')
(H:) SYSTEM RESERVED 70.3mb free of 99.9mb

o bytes free, o bytes used (RAW)

[all i managed to do with TestDisk at this time (log pasted below) was to change the active partition from the PQ Service (15gb) to the 100mb System Reserved partition and not knowing what else to do hit write and exited.

Hence, when Windows Explorer / Disk Management next saw my drive as:
(E:) PQ Service - 5.40gb free of 14.9gb and
(G:) My Gateway - (format? NO)
(H:) SYSTEM RESERVED - 70.3MBFREE OF 99.9MB. (active)

(C:) hp laptop used to connect the drive
(D:) no media
(F:) no media SD/MMC
(I:) a new 1TB toshiba external hard drive for using to correct problems, backup, etc.

I exited the program, installed the HDD back into the laptop
-----
I'll make mention at this time I did use EaseUs Data Recovery; the drive was listed as RAW and saved 39.9gb listed as Gateway 581.07gb (NTFS1) - RAW files (26) saved to (I:) [Intelligent Searching]

Partition Table: 0
Fat Boot Records: 0
Fat Folders: 0
Fat Folder Parts: 748
NTFS Boot Records: 1
NTFS File Records: 2048
Files Identifies: 4012
Total files found: 7272
---------------------------------------------------------------------------
"LOG FILE COPIED FROM LAST ACTION: TESTDISK (appended) Feb. 13th, 2014"
-----
Thu Feb 13 07:21:51 2014
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52

ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=640135026688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=640135026688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=159934930944
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000096367104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=623921594368
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=104857600

Hard disk list

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - Hitachi HTS725016A9A364, S/N:3031343032304350424b30304e56474735364a33, FW:PCBOC72E
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 -
TOSHIBA External USB 3.0, S/N:F37881061213102

Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD64 00BPVT-22HXZT1, S/N:WD-WX81A31Y9828, FW:0016

Partition table type (auto): Intel
Disk /dev/sdd - 640 GB / 596 GiB - WDC WD64 00BPVT-22HXZT1
Partition table type: Intel

Analyse Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 27: no test
NTFS at 1958/64/27
NTFS at 1971/0/14
Current partition structure:
1 P Windows RE(store) 0 32 33 1958 64 26 31457280
2 * HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]

search_part()
Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
NTFS at 0/32/33
filesystem size 31457280
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
NTFS at 1958/64/27
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 1971/0/14
filesystem size 1218596864
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB
file_pread(6,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1250263936(77825/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1250264064(77825/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1250264192(77825/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,1250264320(77825/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1250264448(77825/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,1250264576(77825/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,1250264704(77825/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,1250264832(77825/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,1250264960(77825/100/36)) lseek err Invalid argument
file_pread(6,1,buffer,1250265087(77825/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,1250265103(77825/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,1250265150(77825/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,1250265166(77825/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,1250265213(77825/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,1250267135(77825/135/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
2 P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 27: no test
NTFS at 1958/64/27
NTFS at 1971/0/14
Current partition structure:
1 P Windows RE(store) 0 32 33 1958 64 26 31457280
2 * HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]

search_part()
Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
NTFS at 0/32/33
filesystem size 31457280
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
NTFS at 1958/64/27
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 1971/0/14
filesystem size 1218596864
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB
file_pread(6,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1250263936(77825/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1250264064(77825/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1250264192(77825/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,1250264320(77825/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1250264448(77825/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,1250264576(77825/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,1250264704(77825/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,1250264832(77825/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,1250264960(77825/100/36)) lseek err Invalid argument
file_pread(6,1,buffer,1250265087(77825/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,1250265103(77825/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,1250265150(77825/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,1250265166(77825/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,1250265213(77825/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,1250267135(77825/135/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
2 P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 27: no test
NTFS at 1958/64/27
NTFS at 1971/0/14
Current partition structure:
1 P Windows RE(store) 0 32 33 1958 64 26 31457280
2 * HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]

search_part()
Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
NTFS at 0/32/33
filesystem size 31457280
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
NTFS at 1958/64/27
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 1971/0/14
filesystem size 1218596864
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB
file_pread(6,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1250263936(77825/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1250264064(77825/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1250264192(77825/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,1250264320(77825/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1250264448(77825/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,1250264576(77825/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,1250264704(77825/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,1250264832(77825/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,1250264960(77825/100/36)) lseek err Invalid argument
file_pread(6,1,buffer,1250265087(77825/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,1250265103(77825/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,1250265150(77825/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,1250265166(77825/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,1250265213(77825/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,1250267135(77825/135/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
2 P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]

search_part()
Disk /dev/sdd - 640 GB / 596 GiB - CHS 77825 255 63
NTFS at 0/32/33
filesystem size 31457280
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
NTFS at 1958/64/27
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 1971/0/14
filesystem size 1218596864
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB
file_pread(6,1,buffer,1250265087(77825/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,1250265103(77825/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,1250265150(77825/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,1250265166(77825/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,1250265213(77825/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,1250267135(77825/135/6)) lseek err Invalid argument
Search for partition aborted

Results
* HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
P HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB


dir_partition inode=5
* HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
Directory /
5 dr-xr-xr-x 0 0 0 31-May-2011 06:55 .
5 dr-xr-xr-x 0 0 0 31-May-2011 06:55 ..
35 dr-xr-xr-x 0 0 0 31-May-2011 07:48 Boot
96 dr-xr-xr-x 0 0 0 15-Jul-2011 20:01 System Volume Information
85 -r--r--r-- 0 0 383786 20-Nov-2010 19:23 bootmgr


dir_partition inode=5
P HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
NTFS, blocksize=4096, 16 GB / 15 GiB
Directory /
5 dr-xr-xr-x 0 0 0 28-Jan-2014 08:53 .
5 dr-xr-xr-x 0 0 0 28-Jan-2014 08:53 ..
109 dr-xr-xr-x 0 0 0 30-May-2011 15:28 ACERBOOT
99 dr-xr-xr-x 0 0 0 31-May-2011 07:38 BOOT
42 dr-xr-xr-x 0 0 0 30-May-2011 15:28 D2D
89 dr-xr-xr-x 0 0 0 30-May-2011 15:28 EFI
358 dr-xr-xr-x 0 0 0 31-May-2011 07:53 FACTORY
35 dr-xr-xr-x 0 0 0 31-May-2011 07:52 RyTools
87 dr-xr-xr-x 0 0 0 30-May-2011 15:27 SOURCES
396 dr-xr-xr-x 0 0 0 15-Jul-2011 20:01 System Volume Information
36 -r--r--r-- 0 0 0 1-Jan-2008 18:37 100_CR.DAT
40 -r--r--r-- 0 0 333203 18-Jan-2008 07:45 BOOTMGR
37 -r--r--r-- 0 0 540 27-Apr-2009 21:14 Flag.log
367 -r--r--r-- 0 0 165 31-May-2011 07:49 ImageInfo.dat
379 -r--r--r-- 0 0 620 12-Feb-2011 21:03 LPCD.DAT
38 -r--r--r-- 0 0 66 3-Mar-2011 04:48 NAPP.DAT
364 -r--r--r-- 0 0 95933 28-Jan-2014 08:54 Napp7.log
39 -r--r--r-- 0 0 437 21-Apr-2011 03:17 RCD.DAT
363 -r--r--r-- 0 0 0 28-Jan-2014 08:53 Restore.dat
41 -r--r--r-- 0 0 1179 21-Apr-2011 06:00 SYSTEMCD.DAT
NTFS Volume is dirty.


dir_partition inode=5
P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
NTFS, blocksize=4096, 623 GB / 581 GiB
ntfs_readdir failed for cluster 5
Directory /
5 dr-xr-xr-x 0 0 0 2-Sep-2013 23:45 .
5 dr-xr-xr-x 0 0 0 2-Sep-2013 23:45 ..
74498 -r--r--r-- 0 0 3104722944 25-Aug-2013 22:56 hiberfil.sys


dir_partition inode=5
* HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
NTFS, blocksize=4096, 104 MB / 100 MiB
Directory /
5 dr-xr-xr-x 0 0 0 31-May-2011 06:55 .
5 dr-xr-xr-x 0 0 0 31-May-2011 06:55 ..
35 dr-xr-xr-x 0 0 0 31-May-2011 07:48 Boot
96 dr-xr-xr-x 0 0 0 15-Jul-2011 20:01 System Volume Information
85 -r--r--r-- 0 0 383786 20-Nov-2010 19:23 bootmgr
Can't open backup.log file: No such file or directory
interface_load

interface_write()
1 P HPFS - NTFS 0 32 33 1958 64 26 31457280 [PQSERVICE]
2 * HPFS - NTFS 1958 64 27 1971 0 13 204800 [SYSTEM RESERVED]
3 P HPFS - NTFS 1971 0 14 77825 37 36 1218596864 [Gateway]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

-----------------------------------------------------------------------

I put the hard drive back in my laptop, changed the BIOS to boot normally and only get the EMS or Memory check option. Hit ESC and f8 as it loops back, I tried last known good configuration and the screen reports back with error 0xc00000f - necessary device is not available.

------------------------------------------------------------------------------------------------
----------------

Brief HISTORY of what I have done:
Originally (I have kept notes) ...

The very first system start-up repair & try to fix automatically reported:
root cause found: system volume on disk is corrupt
... attempting repairs
completed successfully error code= 0x0
restart your computer to complete the repairs
3% completed 93992 of 27852 ended (restart) then at 9400 of 27--
restarted- did not restart correctly

----------------

(using SFC /scannow /off bootdir= d:\ /off windir= d: \windows\
got error message; cannot complete access denied windows resource protection windows modules installer service; TrustedInstaller.exe
----------------
echo diskpart
volume
o F repair disk UDF DVD/Rom
1 C system Rese NTFS Partition 100mb
2 D Partition 581gb
3 E PQ servicee NTFS Partition 15GB

disk 0 465 GB
disk 1 7441 MB

----------------
Automatic System Repair attempts in Windows; ERROR Windows boot manager oxcooooof; Boot system is not working correctly. The system cannot read the BCD store (backed up the system reserved partition to a thumb drive)
----------------
Used Knoppix to recover my data off of the drive to external hard drive (500gb/full) documents, videos, pictures,
----------------
Used command prompts in windows: bootrec.exe /fixboot, /fixMbr, scanoss, etc
----------------
Not knowing what I was doing used hiren's boot cd - used Gparted; health status and TestDisk - I remember that I did make a write change regarding MBR and MFT & mirror and did so without running a scan (started getting read errors and hung a long time in scan deeper, so i quit)
----------------
Used Knoppix to attempt to do a manual system restore manipulating the 5 Registry Files:
Sam
System
Software
Security
Default

Windows/system32/config/
- [backup is ...Windows/system32/config/temp (made new folder "temp") all files were dated 9/5/2013 (except for System which was dated 8/26?/2013

Windows/system32/config/RegBack
- [backup is /Windows/system32/config/RegBack/backup (folder with the 5 files dated 9/1/2013)

------------------------------------------------------------------------------------------

That's all that I remember (if any of this helps you)??
Once again, thank you so much !!

:idea:
Isn't there anyway to just replace the 'system corrupt version of windows' and rebuild a partition/MFT with shadow copies or 'safe backup(s); before they've been overwritten by boot attempts, etc. .. at least enough to salvage the system with a repair install? I don't want to loose much of my data that isn't backed up and go through setting everything back up - Also the expensive applications that I no longer have access to in order to replace.

as the story goes - backup your ass 'ets

Alphonse68
Posts: 6
Joined: 04 Feb 2014, 05:55

Re: Need HELP w options to recover RAW partition.

#3 Post by Alphonse68 »

Hi,
I finally solved my problem.

THANK YOU, CGSECURITY FOR TESTDISK!!! THANK YOU, THANK YOU, THANK YOU!!!

Using TestDisk, once it reads the partitions after a Deep Search I had these options at the bottom of the screen:

Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue _

where I tried "P" and was able to access my files. I then got myself a large HD, installed Win7 and TestDisk in it, and copied EveryThing into it.

I copied the entire drive because I wanted to also recover things like settings files and bookmarks stored in UserProfile/AppData, some in ProgFiles, etc. It took a long time to recover and later search and sift, but it was well worth it. This is the price that one pays for being lazy and not keeping a current backup of the entire system.

Once I recovered everything, I simply re-installed the drive in the laptop and re-installed Win7, erasing ALL partitions first and then letting Win re-partition the drive as it needed. Now my old drive is back into action, and my new large capacity drive, with bare Win7 installed, is my backup drive.

Hope this works for you too.

Cheers.

PS - How do I mark this post *SOLVED*?

Locked