Please Help Me Rebuild/Recover Partition or Recover Data?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#21 Post by cgrenier »

It's always a good idea to keep the testdisk.log file as it contains the current partition table settings.
When you see your DATA partition, press "p" to list your files. If it's ok, rewriting the partition table is safe.

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#22 Post by Nairb »

I think I had mentioned in my first attempted post which didn't get posted that (I think this was in the previous step) I pressed P but didn't see a huge list of files, only a number indicating the size of the data which was about 5.8gb I think when I should have had 1.8TB or so.

Is there a way I can go back a step to recheck if the files are there? I think I saw instructions for doing so by going back to the main menu and choosing "advanced" rather than "analyze" and proceeding from there.

The process of starting this whole recovery was a little confusing so I quit and restarted at one point after reading elsewhere that instead of running testdisk all I needed to do was reassign the drive letter in disk management the do chkdsk /f, which I began, then got freaked out when it was "deleting orphan file directories" at an alarming rate, so I reset the computer to stop it, went back to testdisk and I believe ovelooked the step to save the .log file. It isn't in the photorec/testdisk folder that I can see anyway, and I forgot to take a screenshot after pressing P to see the files unfortunately.

So anyway, can I go back to see the files again? and if so, how?

Thanks again for so much help, it's really appreciated.

ostrichsak
Posts: 25
Joined: 18 Apr 2014, 01:46

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#23 Post by ostrichsak »

Now this guy is getting help in my thread and I can't even get help? What gives?

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#24 Post by Nairb »

Oh Joy of Joy's! So I ended up quitting instead of writing, and did the start quick search > stop > series of steps to be able to list my files.

Got the boot sector is bad message, though the backup bootsector is OK

And from there eventually got the exact same error message as the OP that "the file system seems broken" or is broken when I tried to list my files.

So my backup boot sector is good, but I could not list my files.

so I quit testdisk to move on to cloning my bad drive to a new drive using Knoppix. So now I'm in even more over my head.

can't find GNU parted in knoppix

found a thread posting about using gddrescue, couldn't find it in knoppix either, so following the thread did a "sudo -s apt-get install gddrescue" which got me:

Reading package lists... done
Building dependency tree
Reading state information... done
gddrescue is already newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded

So it seems gddrescue is already on the live cd I'm using, but I haven't a clue how to open it/use it, then looking on the Testdisk instructions under Damaged Hard Disk > Disk Duplication, it reads as though dd is actually something to rescue data rather than cloning a disk. I was under the impression I'd be cloning the bad disk to a spare drive, then using Testdisk on the cloned drive to try and recover the partition by using the backup boot sector to rebuild the BS on the cloned disk instead of the broken original disk.

What am I missing here? I can't even seem to find ddrescue or gddrescue or dd or whatever it's called in Knoppix...

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#25 Post by Nairb »

I just realized that when I was manually entering the end sector number (5860532223) that the entry that resulted was similar to if not exactly the same as yours ostrichsak. In that I entered 5860532223 but upon pressing enter, the value that appears is 1565564927 (seen in your screen shot on pg 2 where it shows both the boot sector and backup bootsector as being bad). I didn't take a screenshot of this, but just tried entering it again. After pressing A the start sector does get entered correctly, but the end becomes 1565564927 when I'd actually entered 5860532223 (the numbers that came out at the end of the quick search and the deep search)

I'm pretty certain that I'm using the 32 bit version, but I'll reinstall now just to make sure. It sure seems like this is some kind of error though.

Just went out for dinner, so no luck figuring out how to best clone my bad drive so I feel more comfortable "experimenting" by being able to click "write" without fear of overwriting my valuable data.

Brian

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#26 Post by Nairb »

Ok, so after checking manual values entered again, (knowing them to be wrong) doing MS DATA > NTFS , on the next page where you select P to list files, at the bottom under "Enter: to continue__" it's showing "801GB/746 GiB"

which is the size the drive showed up as the first time I'd tried to use Testdisk after the 2.2tb motherboard/windows failure had it showing up as a Raw drive. Once I'd updated the driver to Intel RST, Testdisk showed the drive as 3000GB/2794GiB
TD_801 746.jpg
TD_801 746.jpg (74.27 KiB) Viewed 3506 times
after pressing P, I get this:
TD_showfiles.jpg
TD_showfiles.jpg (49.31 KiB) Viewed 3506 times
As you can see, the end values are not what I had input initially before pressing enter, and it seems the same occurred for ostrichsak...

So perhaps there's some error occuring when manually entering. These are the numbers I got right after the deep scan when I was afraid to write (as I wasn't working on a clone of my bad drive but the bad drive itself):
TD_deepFinDATA.jpg
TD_deepFinDATA.jpg (62.41 KiB) Viewed 3506 times

EDIT: AS I'M TRYING THE DIFFERENT OPTIONS, I FIND THAT I ONLY GET THESE WRONG NUMBERS WHEN I STOP THE ANALYSE PHASE. IF IN THE BEGINNING, I CHOOSE THE DRIVE > EFI/GPT > ADVANCED >

I get this: See next post. limit of 3 atachments

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#27 Post by Nairb »

from ADVANCED:
TD_advanced.jpg
TD_advanced.jpg (61.97 KiB) Viewed 3506 times
msdata > ntfs gets me these numbers (same as after deep search without my drive name of DATA [i'd named the drive this when first setting up the drives. confusing now I know])
TD_type_msdata.jpg
TD_type_msdata.jpg (66 KiB) Viewed 3506 times
with unfortunately the same result:
TD_list__.jpg
TD_list__.jpg (52 KiB) Viewed 3506 times
Unfortunately, I never took a screen shot of what files were listed after doing the deep search. I don't recall getting this error message, I thought it just showed a size of the data, but I could be wrong. There certainly wasn't any long list of files though. I suppose I could wait another 4 days for a deeper search to complete again. But right now I would really rather get onto cloning this bad drive so I have no fear of clicking on "write" at any time. As of now I fear to.

EDIT: I'VE JUST CONFIRMED THAT I DO HAVE TESTDISK 32 BIT INSTALLED. I'M USING WINDOWS 7 PRO 64BIT AND UPON STOPPING THE ANALYSE AND INPUTTING THE SECTOR START AND END NUMBERS, THE END NUMBERS DO NOT ENTER CORRECTLY.

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#28 Post by Nairb »

Up till midnight last night and back at it a 5 this morning, mostly trying to understand and figure out how to run ddrescue. It wasn't too clear until I really got into it that it is just doing a bit for bit copy/clone. Most of the writing about it refers to file repairing and looking for errors on drives that are beginning to show errors on their way to failure. So the program it seems was developed to copy the failing drive to a good one to then recover the data before it corrupts further in recovery attempts. I'm almost 5 hours into cloning now, and upon completion I suspect I'll have to start testdisk searching and deep searching all the way through unless someone can confirm to me that I can skip the search > stop > enter start and end numbers (which enter wrong) and I can just go right to advanced upon opening testdisk and chose my drive and write to it. Hopefully I don't have to go through another 4 days of searching and deeper searching to get to that point at which my drive which I'd initially labelled as "DATA" shows up again.

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#29 Post by Nairb »

So I've had some partial progress, but still a failure. I successfully cloned my drive which took 10 hours.

But then this is where I may have messed up as i was on the phone talking to my linux knowledgable cousin.

In windows, the drive showed up as raw automatically assigned the letter f:

I went into Testdisk > advanced > chose the partition with the correct start and end numbers of 264192 5860532223, and this is where memory gets a little muddy, I might have tried to list files and got the "can't open file system, file system seems damaged" warning. at this point I think I chose "write" then got the BS as bad, and Backup BS as good, but because I didn't go back and read the instructions chose "rebuild BS" instead of "backup BS" which might have been my second screwup after chosing the advanced path rather than the "quick search > stop>" process.

after this when listing the partition, 3 showed up instead of two. Presumable two BS's and the other was again my ms data partition of 5.8gb (not corresponding to the data I originally had on the drive) on which I could not read the files.

Sooo, I quit Testdisk (by the way, I've not yet been able to locate the logfile which I did chose to create this time), rebooted (as TD had said I'd have to for the rebuilt BS to take effect). CHKDSK attempted to start, I stopped it, got into windows and the drive showed at D: (but was unlabelled) and I got the following error in attempting to access it:

D:\ is not accessible.

The file or directory is corrupted and unreadable.

Sooo, at this point I figured I'd screwed up in testdisk by being on the phone, so decided before I format and re-clone to start over that I'd reboot and let CHKDSK run it's course. It started deleting a tonne of "orphan file record segments" from about #5000 to 119000, then started repairing or retrieving or rebuilding some stuff (was going super fast), I started seeing a bunch of my photo files being listed, .NEF's, Tiff's, jpeg's not a tonne, but at least 100 or so. Then in the end it rebuilt the MFT and finished.

Upon entering windows, it now carried the label I'd originally assigned to the original messed up drive of " DATA (D:) " which was a great sign, however upon trying to open it, I got:

D:\ is not accessible.

Access is denied.

A little different then before CHKDSK. Under properties, it has a size of 0bytes by the way. 0 bytes used, 0bytes unused.

So I guess l'm going back to re cloning and then trying to follow either the correct steps in Testdisk or letting it do another full quick search and deeper search.

Unless cgrenier, you have any ideas that might save me some time.

PS oh I went back into testdisk after doing the CHKDSK and doing QUICK SEARCH > STOP > PRIMARY > LIST FILES at this point when listing the files, 7 show up, all but one apparently empty.
post chkdsk files.jpg
post chkdsk files.jpg (91.8 KiB) Viewed 3485 times

Nairb
Posts: 10
Joined: 07 Nov 2014, 15:48

Re: Please Help Me Rebuild/Recover Partition or Recover Data

#30 Post by Nairb »

So I've re cloned the drive and am back at attempting to recover it.

I got into testdisk, did the standard steps to get to the analyse page (chose the 3000gb drive > gpt > analyse etc), started the quick search, stopped it, chose A to enter partition manually, and entered the start and end numbers of:

264192 and 5860532223, but once again upon pressing enter when the numbers have been input, they show up incorrectly with the incorrect drive size of 801GB/746GiB at the very bottom, and then upon listing files, get the "file system seems broken" warning.
TD_enterednumswrong.jpg
TD_enterednumswrong.jpg (51.94 KiB) Viewed 3467 times
TD_wrongnum_801_746gib.jpg
TD_wrongnum_801_746gib.jpg (67.93 KiB) Viewed 3467 times
After this page, the files do not get listed. So I'm thinking that in order to have the correct numbers in here do I have to actually let the quick search and the deep search run???? That will be another 4 - 6 days like it was last time....

As very few of the threads on this board regarding the 3tb drive becomes raw problem ever seem to be resolved, I'm going to wait for a reply from cgrenier or fiona.

In the meantime, I think I will try the only thing that someone says worked for them since it will only mean taking another 11 hours to again re-clone if this fails. That is, the raw drive shows up with the incorrect drive letter (f: instead of d: initially for me [though after this cloning it shows as D: without a label], and it did for this one guy too, so he learned through much searching that all you need do is go to disk management, reassign the correct drive letter (without any formatting), then run chkdsk on the raw drive now with the correct drive letter.

So this is what I'm going to try this time. Just running chkdsk. yesterdays failure of chkdsk for my could have been because I had first rebuilt the BS in Testdisk. This time I'll only let CHKDSK try to do it's thing. Failing this, I guess I'll be back at Testdisk tomorrow after recloning overnight.

Please cgrenier or fiona, if you have any idea as to why I'm getting the wrong numbers when I enter the correct ones, can you fill me in?

Locked