SAGEM DTR67250

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: SAGEM DTR67250

#21 Post by remy »

there's only your sagem. I need full feedback about sfdisk to differenciate your ubuntu disk and your spare disk for copy.

daystrom
Posts: 19
Joined: 17 Apr 2012, 02:58

Re: SAGEM DTR67250

#22 Post by daystrom »

full details are as follows

Disk /dev/sda: 30401 cylinders, 255 heads, 63 sectors/track

sfdisk: ERROR: sector 0 does not have an MSDOS signature
/dev/sda: unrecognised partition table type
No partitions found

Disk /dev/sdb: 60801 cylinders, 255 heads, 63 sectors/track
Warning: extended partition does not start at a cylinder boundary.
DOS and Linux will interpret the contents differently.
Units = sectors of 512 bytes, counting from 0

Device Boot Start End #sectors Id System
/dev/sdb1 * 2048 974741503 974739456 83 Linux
/dev/sdb2 974743550 976771071 2027522 5 Extended
/dev/sdb3 0 - 0 0 Empty
/dev/sdb4 0 - 0 0 Empty
/dev/sdb5 974743552 976771071 2027520 82 Linux swap / Solaris

Disk /dev/sdc: 1015 cylinders, 16 heads, 62 sectors/track
Units = sectors of 512 bytes, counting from 0

Device Boot Start End #sectors Id System
/dev/sdc1 2 1006879 1006878 b W95 FAT32
/dev/sdc2 0 - 0 0 Empty
/dev/sdc3 0 - 0 0 Empty
/dev/sdc4 0 - 0 0 Empty

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: SAGEM DTR67250

#23 Post by remy »

There is your sagem (sda,250G), another disk with a linux install (sdb, 500G) and your usb-key (sdc).

Do you have enough place on you linux partition ?
If yes, give result of :

Code: Select all

mount


to verify it's mountpoint

daystrom
Posts: 19
Joined: 17 Apr 2012, 02:58

Re: SAGEM DTR67250

#24 Post by daystrom »

mount results are as follows

dev/sdb1 on / type ext4 (rw,errors=remount-ro,commit=0)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
udev on /dev type devtmpfs (rw,mode=0755)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755)
none on /run/lock type tmpfs (rw,noexec,nosuid,nodev,size=5242880)
none on /run/shm type tmpfs (rw,nosuid,nodev)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
gvfs-fuse-daemon on /home/daystrom/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=daystrom)
/dev/sdc1 on /media/50E0-BC04 type vfat (rw,nosuid,nodev,uid=1000,gid=1000,shortname=mixed,dmask=0077,utf8=1,showexec,flush,uhelper=udisks)


I've also used dd to create an image, so I'm ready to make writes to the disk.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: SAGEM DTR67250

#25 Post by remy »

did you use option conv=swab in your dd copy ? did you make it from disk to disk or from disk to image ?
I don't want to make writtings on your disk, I want to create an image with dd, bu with conversion. It's like if we were trying to access amiga disk with pc :P

daystrom
Posts: 19
Joined: 17 Apr 2012, 02:58

Re: SAGEM DTR67250

#26 Post by daystrom »

Will do that now.

Shall I use the command
sudo mount -t vfat -o loop,offset=32256,ro,noexec SAGEM.IMG /mnt/part1
to mount the image?
Not sure about what all the options mean, but I presume the offset needs to be change according to the start address that is provided by sfdisk.
But, if sfdisk shows an error, I should post the output here.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: SAGEM DTR67250

#27 Post by remy »

Did you make your image with conv=swab ? You won't be able to mount something if not. Then, scan the image made with conv=swab with testdisk, and you'll find offset.

daystrom
Posts: 19
Joined: 17 Apr 2012, 02:58

Re: SAGEM DTR67250

#28 Post by daystrom »

The scan with testdisk gave these results

Disk sagem.img - 250 GB / 232 GiB - CHS 30402 255 63
Current partition structure:
Partition Start End Size in sectors

check_FAT: Read error
1 * FAT16 LBA 39798 100 18 258070 75 13 3506538101
1 * FAT16 LBA 39798 100 18 258070 75 13 3506538101

Bad sector count


The Cylinder is now 30402 (with conv=swab), while testdisk and sfdisk has Cyclinder as 30401 on the actual device.
I used the offset 39798 to mount the disk image and the result is

mount: wrong fs type, bad option, bad superblock on /dev/loop0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: SAGEM DTR67250

#29 Post by remy »

Hi,

sorry for delay, but I need precise answer, because I can't understand what you've done, and I think you want to do things to fast.

First, did you make your image with dd conv=swab ? If yes, what was exactely the command line you used ? What was your source, your destination ? Did you use other conv option (notrunc, noerror) ?

Then, when trying to mount, you are in the wrong way : you use a cylinder quantity for an offset in bytes.
If partition begins at position C/H/S, then LBA is C*255*63+H*63+S-1, and offest is LBA*512.

Please, understand that my english is quite bad, and that datarecovery need precsion. I can't guess what you have done if you don't tell me.

I give again the steps and the aim :
1/ Your disk as byte order inverted
2/ Doing a copy with dd, and good conv options, will make a copy with bytes reordered.
3/ Check on your copy that MBR is good, with endmark in the good order
4/ Scan the copy with testdisk and give results (Quicksearch and Deepersearch) to find your data partition
5/ test these partitions (depending on filesystem) with "P" to try listing files
6/ If good, else write the new MBR with testdisk on the copy, else mount in read-only with loopdevice.

I can help you in all these steps if you take some times. Else, be very carrefull and don't corrupt the source disk.

daystrom
Posts: 19
Joined: 17 Apr 2012, 02:58

Re: SAGEM DTR67250

#30 Post by daystrom »

I used

dd conv=swab if=/dev/sda of=~/sagem.img

Using Bless (hex editor), I can confirm byte ordering has been swapped. We now have 0x55 0xAA on sector 0, rather than the other way around. All other values on the this sector have also swapped.

I used the value 39798 as the offset because I didn't think that it was a cylinder value, since its bigger than 30402 that sfdisk states for the drive.
Should I conclude from this that the testdisk result ,"Current partition structure:" is wrong?
After all, it does say "check_FAT: Read error" and "Bad sector count" on the results.

I'm currently doing a "Quick Search", will post result later today. Then do a "Deep Search" if nothing was found.

Locked