cgsecurity.org

Hi,

I believe that a virus manipulated somehow the partitioning of my disk. I am able to use testdisk to analyze the disk and find a partition that allows the expected file list to be displayed. I simply can't figure out how to use testdisk to fix the disk.

After selecting the disk in testdisk ...

Partition Table Type [None] [Analyse] shows
P Linux md 0.9 RAID 0 0 1 60800 253 63 976768002 [md0]

[Quick Search] shows
>P NTFS 0 0 1 60800 253 63 976768002

And 'list files' shows me the files. That looks promising. Except I can't write the MBR with this info.

Partition Table Type [Intel] [Analyse] shows
No partition
[Quick Search] shows
>* NTFS 0 0 1 60799 254 63 976751937

And 'list files' does NOT return a list of files.

I have read a couple of past posts but have been unable to figure out from them if I can recover from the situation I am in.

Any help would be appreciated. I'll be happy to provide more information.

Thank you,

Jason

Hi,
I don't know what options you have available in TestDisk once it reads the partitions, but after a Deep Search I had these:

Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue _

where I tried "P" and was able to access my files. I then got myself a large HD, installed Win7 and TestDisk in it, and copied EveryThing into it. (It took a long time, but it was well worth it.)
Once I recovered everything, I simply re-installed the drive in the laptop and re-installed Win7, erasing ALL partitions first and then letting Win re-partition the drive as it needed. Now my old drive is back into action, and my new large capacity drive, with bare Win7 installed, is my backup drive.
Hope this works for you.
Cheers.