Page 1 of 1

Attempting to restore partition

Posted: 02 May 2012, 05:42
by 0mgz
Hi,

I have a 1TB drive that initially was partitioned by windows with the 1st 1MB of space being system reserved and the rest of the hard drive used as storage. I went in attempting to delete the system reserved space as this is a secondary storage device, not the hard drive containing my OS. Needless to say, when I went to extend the partition to use the whole device my partition layout messed up and now I am unable to access any of the files on the hard drive. They should all still be there, I did not do a format, and even then that doesn't delete the actual data at first. I have been trying to recover the initial partition layout for a couple of days now with no luck. Using the testdisk tool, it was looking good at first as it recognized the partition I'm interested in (HDD1). But after the scanning finished, it proceeded to say that partition can't be recovered. I would appreciate any help anyone has to offer. Is there alternate more intense ways to try to rebuild the partition table and MFT? Or should I just give up and attempt to recover as much data off the drive as I can.

Thanks in advance,
Mat

Below is the log output from testdisk, the relevant info to that partition seems to be towards the end.



Tue May 01 20:09:22 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: May 1 2012 20:08:15
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=60022480896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=60019441664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000200994816
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000200994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512
Drive C: - 60 GB / 55 GiB - CHS 7296 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive H: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
No partition is bootable
search_vista_part: 1

search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
* HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB


dir_partition inode=5
P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 1-May-2012 03:00 .
5 dr-xr-xr-x 0 0 0 1-May-2012 03:00 ..
102 dr-xr-xr-x 0 0 0 6-Jun-2011 23:56 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 1-Jan-2002 03:16 Boot
85 -r--r--r-- 0 0 383562 13-Jul-2009 21:38 bootmgr
96 -r--r--r-- 0 0 8192 1-Jan-2002 03:16 BOOTSECT.BAK
99 -r--r--r-- 0 0 252724 15-Jul-2010 02:12 QEJTZ
97 dr-xr-xr-x 0 0 0 1-Jan-2002 03:17 System Volume Information
100 -r--r--r-- 0 0 20 15-Jul-2010 02:12 win7.ld

interface_write()
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]

search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 12/190/50
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=104857088, part_size=1000199946240, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=206848, size=1953515520, end=1953722367, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24598 176 27 27282 243 33 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB

recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24609 1 1 27293 68 7 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB

recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24609 167 7 27293 234 13 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB

recover_EXT2: s_block_group_nr=0/56, s_mnt_count=1/22, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1835008
recover_EXT2: part_size 14680064
Linux 29430 1 1 30343 202 56 14680064
ext3 blocksize=4096 Large file Sparse superblock Recover, 7516 MB / 7168 MiB
NTFS at 121600/247/55
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
NTFS, blocksize=4096, 1000 GB / 931 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB

Re: Attempting to restore partition

Posted: 02 May 2012, 08:20
by Fiona
Do you use the TestDisk 64bit version?
Its only intended on systems lacking WOW64 as some features are missing!
In your case, it's recommended to use TestDisk 6.14WIP-32bit.
I went in attempting to delete the system reserved space as this is a secondary storage device, not the hard drive containing my OS.
It was not a good idea to touch this partition.
It's your boot partition, reserved for bitlocker and contains your windows start files.
It's a normal NTFS-partition without a drive letter.
This is on purpose in order that nobody is gonna touch it!

Currently your boot partition (system reserved) uses the whole space from your disk.
If you write anything to the disk, you might overwrite underlying data and make them unrecoverable.
Analyse Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
No partition is bootable
As a boot partition, your system reserved partition should be active and bootable!

An idea to reconstruct your boot partition would be, Deeper Search found it!
Results
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
You should check it and press p to have a try to list your data.
If you see an error message that your previous boot partition is damaged, please let me know!
If you were able to list your data, please confirm it at Write and confirm at Backup BS also to recover your boot sector.
To recover this partition it's intended that you get it back exactly to the same size as before.
So you'll have space for your second windows partition.
If you're sure about the previous start and size (100 MB) you can also resize your current system reserved partition using the windows disk management console!
Important is, that you have exactly the same values like your previous one or smaller, otherwise the start of your OS-partition wouldn't fit anymore!

Code: Select all

HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
Your OS-partition is another different case!
It ends about 100 MB beyond your disk limit.
To get it back, would be only a try and you must be a kind of tricky.
Before you go to have a try to recover your OS-partition, you should use the menu geometry to increase the size of your disk beyond the disk limit, so that your HDD1-partition would be displayed for recovery.
Please not, that you increase the size of your disk.
This space is only virtual.
Any access to, would cause read errors.
But this should be ignored, because the main thing is, that you get your partition accessible in TestDisk and windows.
Your system reserved partition should be already recovered to the previous size and functional, also bootable.
Confirm in TestDisk through until you see the menu Analyse.
Don't confirm at Analyse but geometry.
Change the value of Cylinder from 121601 to 121614.
Use Quick and in case Deeper Search to get your Partition HDD1 displayed.
Should look like this one;
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
If TestDisk displays your partition for recovery please check it and press p to list your files.
I recommend that you copy/backup important files first using TestDisk.
At the bottom of the screen you'll find the commands.
Using your arrow keys, you can go into a folder or if you mark that 2 dots and press enter will change directories.
Standard path is your testdisk folder were testdisk will copy files to.
Please let me know, were you able to list your data and copy your important ones?

Next step would be another trick, to write the increased size to the partition table.
Your partition should appear in your disk management console, right click on it and choose decrease volume would be the trick, to have a try to get your partition smaller and make it accessible in windows.
But afterwards it's very important to set the disk size back to the physically size.
Please only diagnose your data partition and have a try to copy your data to another intact disk/partition.
Further information will follow.

Fiona

Re: Attempting to restore partition

Posted: 02 May 2012, 18:04
by 0mgz
Fiona,

Thanks for all the info. I have made some progress and just wanted to fill you in as to what I have done, so if others have this problem.

1) The partition below is the 100MB partition system reserved space windows initially created. First I copied all of the files from this to a temporary location just in case I corrupted them or lost them. Next I proceeded to restore this partition and selected "Backup BS" to correct the boot sector error. Restarted the computer and when Windows came back up the disk had the 100MB partition with the rest of the space unallocated.

HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB

2) Re-opened testdisk and checked to see if the (HDD1) partition was available, which at this time it was not. So I proceeded to change the geometry of the disk as you suggested, cylinders from 121601 to 161614, and analyzed the disk again. Guess what? I was able to select and view all of the files on that partition now!!!! Currently I am backing up all 300GB of data on that partition, once that is completed I will attempt to restore it back to its original state.

I can't thank you enough. This is a wonderful tool, and your advice has been much appreciated. Once I get the partition back or at least all of my data, I will respond back and close this thread.

Thanks again for all of the help,
Mat

Re: Attempting to restore partition

Posted: 02 May 2012, 18:16
by Fiona
I've made a little mistake!
Amount of cylinder should be 121614 and not 161614 (it's already edited in my post)!
But it's not something to be afraid of!
So I increased only your disk size more than necessary!
If you don't use Write, after copying your data and you're closing TestDisk, your disk size will be back to its physically size.

Fiona

Re: Attempting to restore partition

Posted: 03 May 2012, 18:04
by 0mgz
Fiona,

Just thought I would let you know that I have successfully recovered all my data. After adjusting the disk geometry I was able to access that deleted partition, backed up all of the data and wrote the new partition layout to the disk. After the reboot everything is back to normal.

I have a quick question though. When adjusting the geometry of the disk using TestDisk, is that only for the program's use?

Thanks again for all of the help,
Mat

Re: Attempting to restore partition

Posted: 03 May 2012, 18:55
by Fiona
When adjusting the geometry of the disk using TestDisk, is that only for the program's use?
It's just as long as you don't write the geometry at Write.
If you use Write in TestDisk you'll register the geometry in your partition table also.
If you changed the amount of your cylinders and wrote it to your partition table, then you should set it back to default 121601 using the menu Geometry and Write.

Fiona

Re: Attempting to restore partition

Posted: 04 May 2012, 17:26
by 0mgz
TestDisk is reporting the correct disk geometry, so I think all is back to normal.

Thanks for the explanation and all the help,
Mat

Re: Attempting to restore partition

Posted: 05 May 2012, 08:13
by Fiona
Thanks for your feedback! :)
I'll set your topic as solved!

Fiona