Recover Partition endmark 0xAA55, fail to recover

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pirateskiller
Posts: 2
Joined: 23 Apr 2014, 14:09

Recover Partition endmark 0xAA55, fail to recover

#1 Post by pirateskiller »

Hi there,

I wondering any way to recover this pendrive.. I'd tried photorec but some files were recovered some were not.. is there any way to recover its partitions?

Errors I got were:-
1) endmark 0xAA55
2) the harddisk seems to small


here I attach the teskdisk.log

Code: Select all


Wed Apr 23 21:10:45 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000365289472
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=4007624704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=199229440000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=300323700736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500073234432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000364240896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000364240896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=4007624704
filewin32_getfilesize(\\.\Z:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\Z:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\Z:
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB - CHS 487 255 63, sector size=512
Drive C: - 199 GB / 185 GiB - CHS 24221 255 63, sector size=512
Drive D: - 300 GB / 279 GiB - CHS 36512 255 63, sector size=512
Drive E: - 500 GB / 465 GiB - CHS 976705536 1 1, sector size=512
Drive F: - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512

Partition table type default to Intel
Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB - CHS 487 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB - CHS 487 255 63
FAT32 at 1/135/7
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 1/135/7
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=24576, size=7827392, end=7851967, disk end=7827392)
FAT32 at 100/246/19
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 100/246/19
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=1622016, size=7827392, end=9449407, disk end=7827392)
Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB - CHS 487 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4007 MB / 3821 MiB) seems too small! (< 4838 MB / 4613 MiB)
The following partitions can't be recovered:
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB - CHS 487 255 63
FAT32 at 1/135/7
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 1/135/7
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=24576, size=7827392, end=7851967, disk end=7827392)
FAT32 at 1/135/13
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 1/135/13
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=24576, size=7827392, end=7851967, disk end=7827392)
FAT32 at 100/246/19
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 100/246/19
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=1622016, size=7827392, end=9449407, disk end=7827392)
FAT32 at 100/246/25
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 100/246/25
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=1622016, size=7827392, end=9449407, disk end=7827392)
Disk \\.\PhysicalDrive4 - 4007 MB / 3821 MiB - CHS 487 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4007 MB / 3821 MiB) seems too small! (< 4838 MB / 4613 MiB)
The following partitions can't be recovered:
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Thanks...

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover Partition endmark 0xAA55, fail to recover

#2 Post by cgrenier »

Run TestDisk, use the Geometry menu to set 500 cylinders, Analyse, Quick Search, Deeper Search, try to list the files of your partition. If it works,
- set this partition as *(bootable) or P(rimary)
- on next screen, choose Write, confirm.
- if asked, choose BackupBS and confirm
- Quit

pirateskiller
Posts: 2
Joined: 23 Apr 2014, 14:09

Re: Recover Partition endmark 0xAA55, fail to recover

#3 Post by pirateskiller »

thanks for your reply..

Seems like I cannot list the files, it turned out program stop working..
I did changed to 500 and write it.. but I had drives as attached picture..
seems like it didnt show to backupBS.. did I did something wrong? :o
Capture2.PNG
Capture2.PNG (74.81 KiB) Viewed 6295 times
Code after I reboot my system..

Code: Select all


Thu Apr 24 00:35:52 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4007624704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=199229440000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=300323700736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000364240896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000364240896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=4007657472
filewin32_getfilesize(\\.\Z:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\Z:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\Z:
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB - CHS 487 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 199 GB / 185 GiB - CHS 24221 255 63, sector size=512
Drive D: - 300 GB / 279 GiB - CHS 36512 255 63, sector size=512
Drive E: - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive H: - 4007 MB / 3822 MiB - CHS 487 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB - CHS 487 255 63
Geometry from i386 MBR: head=196 sector=27
FAT32 at 1/135/7
Info: size boot_sector 7827392, partition 7827456
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used
Current partition structure:
 1 * FAT32                    1 135  7   488 195 27    7827456 [NO NAME]

Warning: Bad ending cylinder (CHS and LBA don't match)

search_part()
Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB - CHS 487 255 63
FAT32 at 1/135/7
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 1/135/7
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=24576, size=7827392, end=7851967, disk end=7827392)
FAT32 at 100/246/19
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 100/246/19
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=1622016, size=7827392, end=9449407, disk end=7827392)
Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB - CHS 487 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4007 MB / 3821 MiB) seems too small! (< 4838 MB / 4613 MiB)
The following partitions can't be recovered:
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB - CHS 487 255 63
FAT32 at 1/135/7
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 1/135/7
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=24576, size=7827392, end=7851967, disk end=7827392)
FAT32 at 1/135/13
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 1/135/13
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=24576, size=7827392, end=7851967, disk end=7827392)
FAT32 at 100/246/19
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 100/246/19
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=1622016, size=7827392, end=9449407, disk end=7827392)
FAT32 at 100/246/25
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used

FAT32 at 100/246/25
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
This partition ends after the disk limits. (start=1622016, size=7827392, end=9449407, disk end=7827392)
Disk \\.\PhysicalDrive1 - 4007 MB / 3821 MiB - CHS 487 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (4007 MB / 3821 MiB) seems too small! (< 4838 MB / 4613 MiB)
The following partitions can't be recovered:
     FAT32                    1 135  7   488 194 26    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB
     FAT32                  100 246 19   588  50 38    7827392 [NO NAME]
     FAT32, blocksize=4096, 4007 MB / 3821 MiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New geometry
Disk \\.\PhysicalDrive1 - 4112 MB / 3922 MiB - CHS 500 255 63 sector_size=512

Analyse Disk \\.\PhysicalDrive1 - 4112 MB / 3922 MiB - CHS 500 255 63
Geometry from i386 MBR: head=196 sector=27
FAT32 at 1/135/7
Info: size boot_sector 7827392, partition 7827456
FAT1 : 1128-8755
FAT2 : 8756-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-7827391
sectors : 7827392
cluster_size : 8
no_of_cluster : 976376 (2 - 976377)
fat_length 7628 calculated 7628
FAT differs, FAT sectors=0-16/7628
set_FAT_info: name from BS used
Current partition structure:
 1 * FAT32                    1 135  7   488 195 27    7827456 [NO NAME]
Debug error
debug.PNG
debug.PNG (7.52 KiB) Viewed 6291 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover Partition endmark 0xAA55, fail to recover

#4 Post by cgrenier »

Lets try something else. Run PhotoRec, select Whole Disk and start a recovery. Original filenames won't be recovered but at least you should have your data back.

Locked