Help recovering Win7 NTFS partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
oigroig
Posts: 2
Joined: 26 Jul 2014, 12:05

Help recovering Win7 NTFS partition

#1 Post by oigroig »

Hallo everybody,
i'm going to post here my request for help I've already posted into another forum hoping someone could help me in solving this issue.

=====Original post============
I'd like to have some help in recovering data from the Win7 ntfs partition I have configured into my laptop (HP Elitebook 8460p), after installing LM17 xfce 64.
I'll try now to make the long story short.

Introduction:
- Win7 is originally installed into this laptop
- under win7 I previously resized the partition in order to create a free space of around 60gb for installing linux
- I used to work with LM, but this time I tried to install debian testing via netinst
- everything worked fine with debian until it installed grub since it didn't recognize the presence of win7, but I was informed i should have been able to fix it later.
- unfortunately I din't find the correct way to do it so under debian i was only able to boot into linux

Present situation:
- so I decided to go back to LM installing the latest xfce 64 version, hoping it could recover win7 someway automatically, but it didn't since I found there's a problem regarding NTFS signature that is missing
Below I'm coping everything I tried to do up to now, following what I found suggested in internet.
As you can read below I also tried to use the testdisk tool but "Rebuild BS" didn't worked in fixing the issue.

Conclusion:
My optimal goal is obviously to have a working dual boot system but I can also be happy with being able to access the ntfs partion so I can save some data i really need to have.

Do you have any idea of what I can do now?


Thanks a lot

gico

Code: Select all

sudo fdisk -l /dev/sda

Disk /dev/sda: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0a25c191

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048   365514751   182756352    7  HPFS/NTFS/exFAT
/dev/sda2       365516798   488396799    61440001    5  Extended
/dev/sda5       483323904   488396799     2536448   82  Linux swap / Solaris
/dev/sda6       365516800   483323903    58903552   83  Linux
------------

sudo mount -t ntfs-3g /dev/sda1 /mnt/windows/
NTFS signature is missing.
Failed to mount '/dev/sda1': Invalid argument
The device '/dev/sda1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
------------

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
     Partition                  Start        End    Size in sectors
 1 * HPFS - NTFS              0  32 33 22752  61 29  365512704

Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.


Note:
"Rebuild BS" didn't worked
----------------

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63

Warning: the current number of heads per cylinder is 255
but the correct value may be 128.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
----------------

sudo ntfsfix /dev/sda1
[sudo] password for giorgio: 
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.
----------------
============================================

Into this situation, the status of both "Boot sector" and "Backup boot sector" is Bad.
Is there a proper way to operate with TestDisk when both of them are bad? till now I've not found anything related to this situation into the TD documentation.

I was also suggested to try and use the tool "Minitool Partition Wizard boot CD" but unfortunately it didn't work to recover the lost win7 partition.

Thanks in advance of any support you can provide me.

ciao
g

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help recovering Win7 NTFS partition

#2 Post by Fiona »

Did you already run Deeper Search?

Fiona

oigroig
Posts: 2
Joined: 26 Jul 2014, 12:05

Re: Help recovering Win7 NTFS partition

#3 Post by oigroig »

this is the result after running deeper search:

Code: Select all

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63

The harddisk (250 GB / 232 GiB) seems too small! (< 3277 GB / 3052 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  Linux                26426  70 13 33759 109 14  117807104
   Linux                26426 135 14 33759 174 15  117807104
   Linux                26429  20 24 33762  59 25  117807104
   Linux                26433   8  8 33766  47  9  117807104
   Linux                26434  78 13 33767 117 14  117807104
   Linux                26435 213 19 33768 252 20  117807104
   FAT32                166745  34 54 398514   4 46 3723367088

[ Continue ]
ext4 blocksize=4096 Large file Sparse superblock Recover, 60 GB / 56 GiB
and then

Code: Select all

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63

Warning: the current number of heads per cylinder is 255
but the correct value may be 128.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
and then the situation is as shown into the pic annexed.

I don't understand why it mentions some linux partitions that seem not be recoverable (booting into linux works fine), and the fat32 partiton since i'm looking for a ntfs partiton instead..

Should i use the geometry menu now? Could it harm the data recovery? Do I run the risk of loosing my data?

thanks again

g
Attachments
after-quick-and-deeper-search.png
after-quick-and-deeper-search.png (56.7 KiB) Viewed 2500 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help recovering Win7 NTFS partition

#4 Post by Fiona »

Something to try would be 240 heads.
You can use the menu geometry to change the value head from 255 to 240.
Don't change anything else and repeat your diagnose.
As long as you don't use the menu Write, nothing would be changed
Some older laptops used this value.


Fiona

Locked