cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Recovering Windows 7 partition on a DELL Laptop

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=3788

Page 1 of 1

Recovering Windows 7 partition on a DELL Laptop

Posted: 20 May 2014, 18:50
by Budykiller
Hi everybody,

I'm struggling against an HDD issue on a DELL Precision M6700 Laptop.
Hard drive is 500Gb.

At boot, message : "invalid partition table!". When plugged in my computer with an USB to Sata cable, i could see the "DATA" partition and backup the file, but the C drive was missing. Only 1 letter was available. This ends me try to use Testdisk.

I didn't made a backup at first, and i should... Anyway, as i remember, Testdisk could see the "DATA" partition.
With a deeper search, it found a "DellUtility" partition, and a list of 4 to 5 partitions. I tried to restore 3 partition :
- DELL
- C
- Data
I wrote the change but now it still doesn't work, and i can't see the DATA files anymore.

What i'm sure of, is the DATA partition was 162GB in Windows 7 (i checked it during the backup transfer).
So now, i need some help tryin to find what was there before (maybe tomorrow i could get my hands on a similar computer so i can check how is it).
I think the DELL partition is fine, i know the last partition should be fine too. At least, at the beginning... because the size was 162BG in Testdisk, like in Windows. So i made changes to have the NTFS partition of 302 GB for the C drive.

302 + 162 is 465GB, like detected by Testdisk. I thought it should work but it didn't. What should i do know ? Here's the last attempt with a deep search :

Code: Select all


Tue May 20 16:51:18 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-18T18:44:06
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104855837184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=395249379840
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=174194947584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=325869174784
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKX-001CA0, S/N:2020202057202d44435759414455384d31323431, FW:15.01H15
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS 725050A7E630

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - HGST HTS 725050A7E630
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
check_part_i386 failed for partition type 07
NTFS at 39623/1/1
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5
Current partition structure:
 1 P Dell Utility             0   1  1     4 254 63      80262
Invalid NTFS or EXFAT boot
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
 3 E extended LBA         39623   0 63 60800 254 63  340224508
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79

FAT16 at 0/1/1
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 39623/1/1
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 39623/0/1,lba=636543495

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
check_part_i386 failed for partition type 07
NTFS at 39623/1/1
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5
 1 P Dell Utility             0   1  1     4 254 63      80262
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
 3 E extended LBA         39623   0 63 60800 254 63  340224508
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB

ntfs_boot_sector
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
filesystem size           1
sectors_per_cluster       0
mft_lcn                   0
mftmirr_lcn               0
clusters_per_mft_record   0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 6213179
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: mft_record_size     1024

Search mft stopped:   91750400/636463232
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
filesystem size           1
sectors_per_cluster       0
mft_lcn                   0
mftmirr_lcn               0
clusters_per_mft_record   0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
Not an exFAT boot sector.

 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Can't open filesystem. Filesystem seems damaged.

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
check_part_i386 failed for partition type 07
NTFS at 39623/1/1
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5
Current partition structure:
 1 P Dell Utility             0   1  1     4 254 63      80262
Invalid NTFS or EXFAT boot
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
 2 * HPFS - NTFS              5   0  1 39623   0 62  636463232
 3 E extended LBA         39623   0 63 60800 254 63  340224508
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79

FAT16 at 0/1/1
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 39623/1/1
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Change partition type:
   * Dell Utility             0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * Dell Utility             0   1  1     4 254 63      80262 [DellUtility]
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 39623/0/1,lba=636543495
You will have to reboot for the change to take effect.

TestDisk exited normally.



Tue May 20 17:47:48 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-18T18:44:06
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104855837184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=395249379840
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=174194947584
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKX-001CA0, S/N:2020202057202d44435759414455384d31323431, FW:15.01H15
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS 725050A7E630

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - HGST HTS 725050A7E630
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 39623/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
 1 * Dell Utility             0   1  1     4 254 63      80262
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79

FAT16 at 0/1/1
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 39623/1/1
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Not an exFAT boot sector.

   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Can't open filesystem. Filesystem seems damaged.
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
Thank you very much.

Re: Recovering Windows 7 partition on a DELL Laptop

Posted: 20 May 2014, 19:19
by Budykiller
Sorry, the last Deeper search is not in the log. Please find it attached below.
It founds 2 Boot sector, in a partition of 291GB and in the 4th but it seems logical as it use almost all the drive size.

It is weird though, i didn't remember the first deeper search were like this. So what i've done is try to restore the 302GB partition but maybe it is not the good one ?

However, the others are not starting at the good spot. I thought it should began just after the DELL partition.
Thanks.

Re: Recovering Windows 7 partition on a DELL Laptop

Posted: 20 May 2014, 19:24
by cgrenier
Get the new 7.0-WIP from today (There was a problem with the ntfs libary in the previous win32 version since the weekend) and try to list the content of each partition. Set the partition you want to keep to P(rimary) or L(ogical) using the arrow keys.

Re: Recovering Windows 7 partition on a DELL Laptop

Posted: 21 May 2014, 09:38
by Budykiller
Thank you very Much Christophe.

With the latest version i ran it again and this time i could open the DATA partition filesystem. So i selected it and put it as a logical partition. I applied the changes and after a reboot of my HDD, i could see the DATA partition again with all the files. ;) I am now back to where i was before using Testdisk.

I am now tryin to restore the C: partition with Windows 7 on it.
For your help, i have the partition structure of another M6700 that is only 5months younger than mine.
Here is a snapshot after a simple analyse :

Code: Select all

     DellUtility -> 0 1 1                      4 254 63
* HPFS-NTFS -> 5 25 21                   1603 249 54
P NTFS         -> 1603 249 55            39171 254 63
E Extended   -> 39172 16 13            60801 47 46
L HPFS-NTFS-> 39172 48 45            60801 47 46
The last partition on this Drive is "Data" too. The size is not the same on my HDD but it's normal : DELL drives came with only a C partition, and i split it everytime to create a DATA partition with EaseUS partition Master, that's why from one drive to another it can vary a bit (EaseUs uses a slide cursor to increase / decrease the size, i move it quickly to perform the job, i don't care if it's 170GB or 165GB).

So, we are ok to say that the last 2 partition, plus the DELL one seems to be fine on my HDD, if we compare it to the drive above.
If my HDD is the same as the other M6700, i need 2 others partition. Problem is Testdisk is showing a bad structure on mine. For example the partition with a NTFS boot sector is ending at 39623 24 17, it is overlapping the extended partition.

Please find the last log : (i am runnig a quick search again right now, as now the DATA partition is fine).

Code: Select all


Wed May 21 09:00:01 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104855837184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=395249379840
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=174194947584
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKX-001CA0, S/N:2020202057202d44435759414455384d31323431, FW:15.01H15
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS 725050A7E630

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - HGST HTS 725050A7E630
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 39623/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
 1 * Dell Utility             0   1  1     4 254 63      80262
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79

FAT16 at 0/1/1
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 39623/1/1
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
NTFS Volume is dirty.


dir_partition inode=5
   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
ntfs_readdir failed for cluster 5
Directory /
       5 dr-xr-xr-x     0      0         0  9-May-2014 15:22 .
       5 dr-xr-xr-x     0      0         0  9-May-2014 15:22 ..


dir_partition inode=0
   * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
Directory /
       2 -rwxr-xr-x     0      0     57389 13-Aug-2008 16:19 COMMAND.COM
      31 -r-xr-xr-x     0      0     23856 13-Aug-2008 16:19 DELLBIO.BIN
      43 -r-xr-xr-x     0      0     30978 13-Aug-2008 16:19 DELLRMK.BIN
X     59 drwxr-xr-x     0      0      6144  4-Apr-2013 16:23 _FGMEDIA
      59 -rwxr-xr-x     0      0         7 12-Apr-2013 14:22 OOBEDONE.FLG
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79

FAT16 at 0/1/1
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 0/32/33
filesystem size           636540928
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 39622 246 48  636540928
     NTFS, blocksize=4096, 325 GB / 303 GiB
NTFS at 39622/246/48
filesystem size           636540928
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 39622 246 48  636540928
     NTFS found using backup sector, blocksize=4096, 325 GB / 303 GiB
NTFS at 39622/254/63
filesystem size           610976263
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS           1591 124  6 39622 254 63  610976263
     NTFS found using backup sector, blocksize=4096, 312 GB / 291 GiB
NTFS at 39623/1/1
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
NTFS at 39623/24/18
filesystem size           340224000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623  24 18 60801  15 14  340224000
     NTFS, blocksize=4096, 174 GB / 162 GiB
NTFS at 60800/254/63
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS found using backup sector, blocksize=4096, 174 GB / 162 GiB
NTFS at 60800/254/63
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          60800 254 63 81978 253 62  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
This partition ends after the disk limits. (start=976768064, size=340224507, end=1316992570, disk end=976773168)
file_pread(5,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,1,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(5,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(5,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(5,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(5,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(5,2,buffer,976777215(60801/145/16)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 674 GB / 627 GiB)
The following partition can't be recovered:
     HPFS - NTFS          60800 254 63 81978 253 62  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
     HPFS - NTFS              0  32 33 39622 246 48  636540928
     NTFS, blocksize=4096, 325 GB / 303 GiB
     HPFS - NTFS           1591 124  6 39623  24 17  610977792
     NTFS found using backup sector, blocksize=4096, 312 GB / 291 GiB
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
     HPFS - NTFS          39623  24 18 60801  15 14  340224000
     NTFS, blocksize=4096, 174 GB / 162 GiB
Change partition type:
     Dell Utility             0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
Not an exFAT boot sector.

     HPFS - NTFS           1591 124  6 39623  24 17  610977792
     NTFS found using backup sector, blocksize=4096, 312 GB / 291 GiB
Can't open filesystem. Filesystem seems damaged.
NTFS Volume is dirty.


dir_partition inode=5
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
ntfs_readdir failed for cluster 5
Directory /
       5 dr-xr-xr-x     0      0         0  9-May-2014 15:22 .
       5 dr-xr-xr-x     0      0         0  9-May-2014 15:22 ..


dir_partition inode=5
     HPFS - NTFS          39623  24 18 60801  15 14  340224000
     NTFS, blocksize=4096, 174 GB / 162 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 10-May-2014 15:26 .
       5 dr-xr-xr-x     0      0         0 10-May-2014 15:26 ..
     318 dr-xr-xr-x     0      0         0 10-May-2014 14:28 $RECYCLE.BIN
     322 dr-xr-xr-x     0      0         0  9-May-2014 15:09 AFFAIRES
   56532 dr-xr-xr-x     0      0         0  7-May-2014 08:10 DA SILVA
   56533 dr-xr-xr-x     0      0         0 10-May-2014 15:26 G2M
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         39622 246 49 60801  15 14  340226048
 5 L HPFS - NTFS          39623  24 18 60801  15 14  340224000
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 39622/246/49,lba=636542976
You will have to reboot for the change to take effect.

TestDisk exited normally.
Thanks again.

Re: Recovering Windows 7 partition on a DELL Laptop

Posted: 21 May 2014, 09:56
by Budykiller
Quick search ended. Partitions found are not beginning and ending at the same point, strange. I'm now doing a deeper search because no partition were found for the Windows 7 files.

Code: Select all

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 39623/24/18
Current partition structure:
 1 E extended LBA         39622 246 49 60801  15 14  340226048
No partition is bootable
 5 L HPFS - NTFS          39623  24 18 60801  15 14  340224000

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79

FAT16 at 0/1/1
     FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 39623/1/1
filesystem size           340224507
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               21264031
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,8,buffer,976773190(60801/81/23)) lseek err Invalid argument
file_pread(5,8,buffer,976773318(60801/83/25)) lseek err Invalid argument
file_pread(5,8,buffer,976773446(60801/85/27)) lseek err Invalid argument
file_pread(5,8,buffer,976773574(60801/87/29)) lseek err Invalid argument
file_pread(5,8,buffer,976773702(60801/89/31)) lseek err Invalid argument
file_pread(5,8,buffer,976773830(60801/91/33)) lseek err Invalid argument
file_pread(5,8,buffer,976773958(60801/93/35)) lseek err Invalid argument
file_pread(5,8,buffer,976774086(60801/95/37)) lseek err Invalid argument
file_pread(5,8,buffer,976774214(60801/97/39)) lseek err Invalid argument
file_pread(5,8,buffer,976774342(60801/99/41)) lseek err Invalid argument
file_pread(5,8,buffer,976774470(60801/101/43)) lseek err Invalid argument
file_pread(5,8,buffer,976774598(60801/103/45)) lseek err Invalid argument
file_pread(5,8,buffer,976774726(60801/105/47)) lseek err Invalid argument
file_pread(5,8,buffer,976774854(60801/107/49)) lseek err Invalid argument
file_pread(5,8,buffer,976774982(60801/109/51)) lseek err Invalid argument
file_pread(5,8,buffer,976775110(60801/111/53)) lseek err Invalid argument
file_pread(5,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,1,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(5,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(5,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(5,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(5,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(5,2,buffer,976777215(60801/145/16)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
   L HPFS - NTFS          39623   1  1 60800 254 63  340224507
     NTFS, blocksize=4096, 174 GB / 162 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * FAT16 >32M               0   1  1     4 254 63      80262 [DellUtility]
 2 E extended LBA         39623   0  1 60800 254 63  340224570
 5 L HPFS - NTFS          39623   1  1 60800 254 63  340224507

Re: Recovering Windows 7 partition on a DELL Laptop

Posted: 21 May 2014, 10:45
by Budykiller
The Deeper Search is still running but after 30700 i know there are no other partition.

So what should i do now ? The DATA partition is actually working fine on the disk.
Thank you

Re: Recovering Windows 7 partition on a DELL Laptop

Posted: 21 May 2014, 13:58
by Budykiller
Well... i'm going to giving up on this.
I am now trying to rebuild BS...

I have add manually all kind of partition. Like the one on the other computer (5 25 21 -> 1603 249 54) and so on but can't open filesystem whatsoever.

What a pitty, i'm sure something could be done. Anyway, i'll let you know if Rebuild BS did something. For this purpose, i've created a partition just after the DellUtility partition and before the DATA one.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited