NTFS partition lost on a 3TB disk with EFI/GPT partition
Posted: 23 Apr 2014, 10:48
Dear Grenier,
after trying to recover GRUB with "Boot Repair Disk", one HD (without systems partition, contaning 2 NTFS partitions) was damaged, and the GPT e and one NTFS partition could not be found anymore, until now.
I ran testdisk -> Create -> Drive E: (the missing NTFS partition) -> Proceed -> Intel / PC partition -> Analyse -> Search and Deep Search after.
I couldn't recover the NTFS partition instead.
LOG file:
Tue Apr 22 18:16:27 2014
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=16043212800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119478943744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2147483648000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=852972535808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=536661196800
filewin32_getfilesize(\\.\I:) GetFileSize err Função incorreta.
filewin32_setfilepointer(\\.\I:) SetFilePointer err Função incorreta.
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=16041115648
filewin32_getfilesize(\\.\K:) GetFileSize err Função incorreta.
filewin32_setfilepointer(\\.\K:) SetFilePointer err Função incorreta.
Warning: can't get size for \\.\K:
Hard disk list
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk \\.\PhysicalDrive5 - 16 GB / 14 GiB - CHS 1950 255 63, sector size=512
Drive C: - 119 GB / 111 GiB - CHS 14525 255 63, sector size=512
Drive D: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63, sector size=512
Drive F: - 852 GB / 794 GiB - CHS 103701 255 63, sector size=512
Drive G: - 500 GB / 465 GiB - CHS 60800 255 63, sector size=512
Drive H: - 536 GB / 499 GiB - CHS 65245 255 63, sector size=512
Drive J: - 16 GB / 14 GiB - CHS 1950 255 63, sector size=512
Partition table type (auto): None
Drive E: - 2147 GB / 2000 GiB
Partition table type: Intel
Interface Advanced
Analyse Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
BAD_RS LBA=1535450125 4028305
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 362926 178 18 555980 150 41 3101410770
This partition ends after the disk limits. (start=1535450125, size=3101410770, end=341893598, disk end=4194304000)
BAD_RS LBA=3541218466 4289729
check_part_i386 failed for partition type 01
FAT12 220430 166 59 395880 144 31 2818602837
This partition ends after the disk limits. (start=3541218466, size=2818602837, end=2064854006, disk end=4194304000)
NTFS at 261083/88/61
filesystem size 4194304000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 261083 88 61 4194304000
NTFS found using backup sector, blocksize=4096, 2147 GB / 2000 GiB
Partition not added.
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2147 GB / 2000 GiB) seems too small! (< 4573 GB / 4259 GiB)
The following partitions can't be recovered:
FAT12 220430 166 59 395880 144 31 2818602837
FAT12 362926 178 18 555980 150 41 3101410770
Results
Can't open backup.log file: No such file or directory
interface_load
interface_write()
No partition found or selected for recovery
search_part()
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
BAD_RS LBA=1535450125 4028305
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 362926 178 18 555980 150 41 3101410770
This partition ends after the disk limits. (start=1535450125, size=3101410770, end=341893598, disk end=4194304000)
BAD_RS LBA=3541218466 4289729
check_part_i386 failed for partition type 01
FAT12 220430 166 59 395880 144 31 2818602837
This partition ends after the disk limits. (start=3541218466, size=2818602837, end=2064854006, disk end=4194304000)
NTFS at 261083/88/61
filesystem size 4194304000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 261083 88 61 4194304000
NTFS found using backup sector, blocksize=4096, 2147 GB / 2000 GiB
Partition not added.
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2147 GB / 2000 GiB) seems too small! (< 4573 GB / 4259 GiB)
The following partitions can't be recovered:
FAT12 220430 166 59 395880 144 31 2818602837
FAT12 362926 178 18 555980 150 41 3101410770
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Please, i need your help to recover the partition. Sorry for the english.
Thanks.
after trying to recover GRUB with "Boot Repair Disk", one HD (without systems partition, contaning 2 NTFS partitions) was damaged, and the GPT e and one NTFS partition could not be found anymore, until now.
I ran testdisk -> Create -> Drive E: (the missing NTFS partition) -> Proceed -> Intel / PC partition -> Analyse -> Search and Deep Search after.
I couldn't recover the NTFS partition instead.
LOG file:
Tue Apr 22 18:16:27 2014
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=16043212800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119478943744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2147483648000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=852972535808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=536661196800
filewin32_getfilesize(\\.\I:) GetFileSize err Função incorreta.
filewin32_setfilepointer(\\.\I:) SetFilePointer err Função incorreta.
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=16041115648
filewin32_getfilesize(\\.\K:) GetFileSize err Função incorreta.
filewin32_setfilepointer(\\.\K:) SetFilePointer err Função incorreta.
Warning: can't get size for \\.\K:
Hard disk list
Disk \\.\PhysicalDrive0 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk \\.\PhysicalDrive5 - 16 GB / 14 GiB - CHS 1950 255 63, sector size=512
Drive C: - 119 GB / 111 GiB - CHS 14525 255 63, sector size=512
Drive D: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63, sector size=512
Drive F: - 852 GB / 794 GiB - CHS 103701 255 63, sector size=512
Drive G: - 500 GB / 465 GiB - CHS 60800 255 63, sector size=512
Drive H: - 536 GB / 499 GiB - CHS 65245 255 63, sector size=512
Drive J: - 16 GB / 14 GiB - CHS 1950 255 63, sector size=512
Partition table type (auto): None
Drive E: - 2147 GB / 2000 GiB
Partition table type: Intel
Interface Advanced
Analyse Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
BAD_RS LBA=1535450125 4028305
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 362926 178 18 555980 150 41 3101410770
This partition ends after the disk limits. (start=1535450125, size=3101410770, end=341893598, disk end=4194304000)
BAD_RS LBA=3541218466 4289729
check_part_i386 failed for partition type 01
FAT12 220430 166 59 395880 144 31 2818602837
This partition ends after the disk limits. (start=3541218466, size=2818602837, end=2064854006, disk end=4194304000)
NTFS at 261083/88/61
filesystem size 4194304000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 261083 88 61 4194304000
NTFS found using backup sector, blocksize=4096, 2147 GB / 2000 GiB
Partition not added.
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2147 GB / 2000 GiB) seems too small! (< 4573 GB / 4259 GiB)
The following partitions can't be recovered:
FAT12 220430 166 59 395880 144 31 2818602837
FAT12 362926 178 18 555980 150 41 3101410770
Results
Can't open backup.log file: No such file or directory
interface_load
interface_write()
No partition found or selected for recovery
search_part()
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
BAD_RS LBA=1535450125 4028305
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 362926 178 18 555980 150 41 3101410770
This partition ends after the disk limits. (start=1535450125, size=3101410770, end=341893598, disk end=4194304000)
BAD_RS LBA=3541218466 4289729
check_part_i386 failed for partition type 01
FAT12 220430 166 59 395880 144 31 2818602837
This partition ends after the disk limits. (start=3541218466, size=2818602837, end=2064854006, disk end=4194304000)
NTFS at 261083/88/61
filesystem size 4194304000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 261083 88 61 4194304000
NTFS found using backup sector, blocksize=4096, 2147 GB / 2000 GiB
Partition not added.
Drive E: - 2147 GB / 2000 GiB - CHS 261083 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2147 GB / 2000 GiB) seems too small! (< 4573 GB / 4259 GiB)
The following partitions can't be recovered:
FAT12 220430 166 59 395880 144 31 2818602837
FAT12 362926 178 18 555980 150 41 3101410770
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Please, i need your help to recover the partition. Sorry for the english.
Thanks.