Page 1 of 1

messy partition recovery

Posted: 14 May 2014, 17:30
by RascalHoudi
Hello. First off, great looking tool. Love it.. just need to get a better understanding of it, so here's my case.
I'm not sure how to proceed with the tool, so I'm asking what I need to do next.

I have managed to mess up 2 drives, but will keep the focus of this post to one drive only (/dev/sdb)

There are 2 partitions that I wish to recover - 1 NTFS Windows partition [goodwin, approx 100 MB], and one NTFS data partition [BIG_data, approx 1061 MB]. There are also a number of deleted partitions. BIG_data was within an extended partition, but I'm only worried about recovering it if possible.

If I remember correctly, the disk is laid out like this.

--freespace from deleted partitions--
-[goodwin]
--possible freespace from deleted primary
-extended partition for final 1061(?) MB
-[BIG_data] fully utilizing all space in extended partition


Here's what I did:
-start testdisk
-select /dev/sdb (2000GB / 1863 GiB - ST32000542AS
-select Intel/PC partition
-select Analyse
-select Quick Search
-select Deeper Search
-select P to print * HPFS-NTFS goodwin partition
-get Segmentation fault (core dump)

Analyse Output:
What I think I see:
1. What does the 65271 under start indicate? starting sector #?
2. #3 P Linux starts on 78530 (right after [goodwin] ends. Not worried about recoving this partition, but curious as to why there are 2 listings for the same partition.
3. #2 Extended LBA and #5 [BIG_data] both end at the same spot, and the NTFS partition starts a little bit after the extended one. i think this is to be expected and is good.
4. [goodwin] and [BIG_data] are both recognized, so that's gotta be good.
Current partition structure:
Partition Start End Size in sectors

1 P HPFS - NTFS 65271 23 33 78529 254 63 213004354 [goodwin]
2 E extended LBA 104637 144 20 243201 254 63 2226037634
No ext2, JFS, Reiser, cramfs or XFS marker
3 P Linux 78530 0 1 91796 254 63 213134355
3 P Linux 78530 0 1 91796 254 63 213134355
No partition is bootable
5 L HPFS - NTFS 104637 176 52 243201 254 63 2226035586 [BIG_data]



Quick Search Output:
What I think I see.
1. An NTFS and four Linux partitions that I don't care about recovering.
2. No seperate line for the extended partition
3. an unexplained NTFS partition between [goodwin] and [bigdata]


Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Partition Start End Size in sectors
> HPFS - NTFS 0 1 1 1274 254 63 20482812
Linux 1436 54 27 2645 64 43 19423232
Linux 3065 175 55 3874 176 14 12996608
Linux 5092 69 34 6301 79 50 19423232
Linux 6752 0 1 7387 254 63 10217340
HPFS - NTFS 65271 23 33 78529 58 57 212992000 [goodwin]
HPFS - NTFS 78529 58 58 104637 144 19 419430400
HPFS - NTFS 104637 176 52 243201 45 44 2226022400 [BIG_data]
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, blocksize=4096, 10487 MB / 10001 MiB
[enter]
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Partition Start End Size in sectors
No partition found or selected for recovery



Deeper Search Output:
What I think I see:
1. Holy crap.. there's a whole lot more output here.
2. FAT32 [EMPTYE] ?? No idea what that is
3. A group of 3 NTFS partitions where [goodwin] starts, 2 of which have the partition name, one of these with an *
I expect that the first [goodwin] entry with the * is suspected to be the correct one.
4. 'Linux' entries all over the place. Not worried about recovering any of them. Are they from previous partitions that may have been created and then overwritten?
5. No indication of Extended partition. Not worried about that.
6. [BIG_data] is listed, but has lots of Linux entries in it's space.


Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Partition Start End Size in sectors
> HPFS - NTFS 0 1 1 1274 254 63 20482812
FAT32 LBA 0 32 33 65270 245 63 1048576000 [EMPTYE]
Linux 1436 54 27 2645 64 43 19423232
Linux 1438 162 5 2647 172 21 19423232
Linux 1443 219 57 2652 230 10 19423232
Linux 1445 165 1 2654 175 17 19423232
Linux 1666 48 47 2875 58 63 19423232
Linux 3065 175 55 3874 176 14 12996608
Linux 5092 69 34 6301 79 50 19423232
Linux 5114 148 27 6323 158 43 19423232
Linux 6752 0 1 7387 254 63 10217340
* HPFS - NTFS 65271 23 33 78529 58 57 212992000 [goodwin]
HPFS - NTFS 78529 58 58 104637 144 19 419430400
HPFS - NTFS 78530 0 1 91796 254 63 213134355 [goodwin]
Linux 84098 235 42 84734 237 47 10217472
Linux 85084 189 34 86851 229 34 28389376
Linux 85108 181 2 86875 221 2 28389376
Linux 89181 97 5 90390 107 21 19423232
Linux 89849 33 41 91058 43 57 19423232
Linux 91055 223 49 92264 234 2 19423232
Linux 91102 104 11 92311 114 27 19423232
Linux 92175 75 61 93384 86 14 19423232
Linux 92632 211 60 93841 222 13 19423232
Linux 92775 253 23 93985 8 39 19423232
Linux 92784 168 57 93993 179 10 19423232
Linux 93015 135 49 93095 53 14 1280000
Linux 93345 51 19 94506 143 37 18657280
Linux 93505 81 17 94714 91 33 19423232
Linux 93561 1 1 93822 254 63 4208967 [/export/data3]
Linux 93751 254 8 94913 91 26 18657280
Linux 93802 122 17 94963 214 35 18657280
Linux 93813 80 28 94974 172 46 18657280
HPFS - NTFS 104637 176 52 243201 45 44 2226022400 [BIG_data]
Linux 111770 15 54 112979 26 7 19423232
Linux 111781 39 3 112990 49 19 19423232
Linux 112005 100 32 113214 110 48 19423232
Linux 112039 77 39 113248 87 55 19423232
Linux 190138 137 16 190947 137 38 12996608
Linux 190896 0 1 192104 254 63 19422585
Linux 192250 38 45 193459 48 61 19423232
Linux 192252 211 24 193461 221 40 19423232
Linux 192265 1 1 193474 254 63 19438587
Linux 192282 135 46 192345 162 9 1013760
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,

Re: messy partition recovery

Posted: 16 May 2014, 07:31
by cgrenier
As the 2 partitions you want to recover are already listed in the current partition table, there is no need to search for the partitions. Go in the Advanced menu and try to list the content of each NTFS partition.

Re: messy partition recovery

Posted: 16 May 2014, 21:35
by RascalHoudi
cgrenier wrote:As the 2 partitions you want to recover are already listed in the current partition table, there is no need to search for the partitions. Go in the Advanced menu and try to list the content of each NTFS partition.
Thanks so much for taking the time to reply.

I was actually able to recover the partition on this disk (Partition Outside of Disk error) as well as the issues on my other disk that I hadn't posted yet (Overlapping partitions) with some help from http://gparted.org/h2-fix-msdos-pt.php.

I am however quite impressed with the testdisk tool, community and help forums here. Great work everybody. I am going to take some unimportant disks and start messing them up so that I can learn how testdisk really works- that way when the day comes again that I need it, this will be time well spent.

Thanks again.