RAW recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
tripko82
Posts: 1
Joined: 02 Jun 2014, 09:04

RAW recovery

#1 Post by tripko82 »

Hi

I had success using test disk few times in history, but now i can't seem to fix this drive.
its a 1 gb WD with 2 partitions, and it was not a system disk, just for data...
I belive it was just a power failure...

I tried using both 7.0 and 6.14 versions

here is a log file

Mon Jun 2 10:00:09 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=157286400000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=28237103104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=314580140032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=999292928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=524287540224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=475914700800
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EACS-00C7B0, S/N:2020202057202d4443575341324a303033393432, FW:01.01B01
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA DT01ACA050, S/N:2020202020202020202031204d345a4838375347, FW:MS1OA750
Drive F: - 999 MB / 953 MiB - CHS 238 64 32, sector size=2048 - DTSOFT BDROM, FW:1.05

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EACS-00C7B0
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 63741/0/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
NTFS at 63741/0/1
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525181(121601/81/14)) lseek err Invalid argument
file_pread(4,1,buffer,1953525181(121601/81/14)) lseek err Invalid argument
file_pread(4,8,buffer,1953525309(121601/83/16)) lseek err Invalid argument
file_pread(4,8,buffer,1953525437(121601/85/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525565(121601/87/20)) lseek err Invalid argument
file_pread(4,8,buffer,1953525693(121601/89/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
P HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
NTFS at 63741/0/1
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
NTFS at 121600/254/63
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS found using backup sector, blocksize=4096, 475 GB / 443 GiB
NTFS at 121600/254/63
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,4096,buffer,1959811520(121992/159/24)) lseek err Invalid argument
file_pread(4,1,buffer,1959811520(121992/159/24)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 179460 254 62 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
This partition ends after the disk limits. (start=1953520064, size=929520900, end=2883040963, disk end=1953525168)
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1476 GB / 1374 GiB)
The following partition can't be recovered:
HPFS - NTFS 121600 254 63 179460 254 62 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
P HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900

in 64 bit version i also tried analyzing the logical drive not the physical disk and here are some errors


Analyse Drive G: - 524 GB / 488 GiB - CHS 63740 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410

Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724

Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724

Analyse Drive G: - 524 GB / 488 GiB - CHS 63740 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410

Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724

Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: RAW recovery

#2 Post by Fiona »

in 64 bit version i also tried analyzing the logical drive not the physical disk and here are some errors
There is no necessity to use the 64bit version.
As long as your OS supports WOW64 (32bit emulation) you can use the 32bit-version.
It's recommended to select your physically disk, instead of a drive.

TestDisk displays your partition table containing 2 partitions.
They're Intel standard.
Would it be possible that your partition/s appear as RAW (unformatted)?
Perhaps a problem with your boot sector or file system?

Can you list your data by marking a partition and pressing p?

Fiona

Locked