Attempting to restore partition
Posted: 02 May 2012, 05:42
Hi,
I have a 1TB drive that initially was partitioned by windows with the 1st 1MB of space being system reserved and the rest of the hard drive used as storage. I went in attempting to delete the system reserved space as this is a secondary storage device, not the hard drive containing my OS. Needless to say, when I went to extend the partition to use the whole device my partition layout messed up and now I am unable to access any of the files on the hard drive. They should all still be there, I did not do a format, and even then that doesn't delete the actual data at first. I have been trying to recover the initial partition layout for a couple of days now with no luck. Using the testdisk tool, it was looking good at first as it recognized the partition I'm interested in (HDD1). But after the scanning finished, it proceeded to say that partition can't be recovered. I would appreciate any help anyone has to offer. Is there alternate more intense ways to try to rebuild the partition table and MFT? Or should I just give up and attempt to recover as much data off the drive as I can.
Thanks in advance,
Mat
Below is the log output from testdisk, the relevant info to that partition seems to be towards the end.
Tue May 01 20:09:22 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: May 1 2012 20:08:15
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=60022480896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=60019441664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000200994816
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000200994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512
Drive C: - 60 GB / 55 GiB - CHS 7296 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive H: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
No partition is bootable
search_vista_part: 1
search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
* HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
dir_partition inode=5
P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 1-May-2012 03:00 .
5 dr-xr-xr-x 0 0 0 1-May-2012 03:00 ..
102 dr-xr-xr-x 0 0 0 6-Jun-2011 23:56 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 1-Jan-2002 03:16 Boot
85 -r--r--r-- 0 0 383562 13-Jul-2009 21:38 bootmgr
96 -r--r--r-- 0 0 8192 1-Jan-2002 03:16 BOOTSECT.BAK
99 -r--r--r-- 0 0 252724 15-Jul-2010 02:12 QEJTZ
97 dr-xr-xr-x 0 0 0 1-Jan-2002 03:17 System Volume Information
100 -r--r--r-- 0 0 20 15-Jul-2010 02:12 win7.ld
interface_write()
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 12/190/50
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=104857088, part_size=1000199946240, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=206848, size=1953515520, end=1953722367, disk end=1953525168)
recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24598 176 27 27282 243 33 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB
recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24609 1 1 27293 68 7 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB
recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24609 167 7 27293 234 13 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB
recover_EXT2: s_block_group_nr=0/56, s_mnt_count=1/22, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1835008
recover_EXT2: part_size 14680064
Linux 29430 1 1 30343 202 56 14680064
ext3 blocksize=4096 Large file Sparse superblock Recover, 7516 MB / 7168 MiB
NTFS at 121600/247/55
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
NTFS, blocksize=4096, 1000 GB / 931 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
I have a 1TB drive that initially was partitioned by windows with the 1st 1MB of space being system reserved and the rest of the hard drive used as storage. I went in attempting to delete the system reserved space as this is a secondary storage device, not the hard drive containing my OS. Needless to say, when I went to extend the partition to use the whole device my partition layout messed up and now I am unable to access any of the files on the hard drive. They should all still be there, I did not do a format, and even then that doesn't delete the actual data at first. I have been trying to recover the initial partition layout for a couple of days now with no luck. Using the testdisk tool, it was looking good at first as it recognized the partition I'm interested in (HDD1). But after the scanning finished, it proceeded to say that partition can't be recovered. I would appreciate any help anyone has to offer. Is there alternate more intense ways to try to rebuild the partition table and MFT? Or should I just give up and attempt to recover as much data off the drive as I can.
Thanks in advance,
Mat
Below is the log output from testdisk, the relevant info to that partition seems to be towards the end.
Tue May 01 20:09:22 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: May 1 2012 20:08:15
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=60022480896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=60019441664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000200994816
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000200994816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512
Drive C: - 60 GB / 55 GiB - CHS 7296 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive H: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
No partition is bootable
search_vista_part: 1
search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
* HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
dir_partition inode=5
P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 1-May-2012 03:00 .
5 dr-xr-xr-x 0 0 0 1-May-2012 03:00 ..
102 dr-xr-xr-x 0 0 0 6-Jun-2011 23:56 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 1-Jan-2002 03:16 Boot
85 -r--r--r-- 0 0 383562 13-Jul-2009 21:38 bootmgr
96 -r--r--r-- 0 0 8192 1-Jan-2002 03:16 BOOTSECT.BAK
99 -r--r--r-- 0 0 252724 15-Jul-2010 02:12 QEJTZ
97 dr-xr-xr-x 0 0 0 1-Jan-2002 03:17 System Volume Information
100 -r--r--r-- 0 0 20 15-Jul-2010 02:12 win7.ld
interface_write()
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 12/190/50
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=104857088, part_size=1000199946240, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953515520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=206848, size=1953515520, end=1953722367, disk end=1953525168)
recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24598 176 27 27282 243 33 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB
recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24609 1 1 27293 68 7 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB
recover_EXT2: s_block_group_nr=0/164, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5390336
recover_EXT2: part_size 43122688
Linux 24609 167 7 27293 234 13 43122688 [_Fedora-16-x86_6]
ext4 blocksize=4096 Large file Sparse superblock Recover, 22 GB / 20 GiB
recover_EXT2: s_block_group_nr=0/56, s_mnt_count=1/22, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1835008
recover_EXT2: part_size 14680064
Linux 29430 1 1 30343 202 56 14680064
ext3 blocksize=4096 Large file Sparse superblock Recover, 7516 MB / 7168 MiB
NTFS at 121600/247/55
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568 [System Reserved]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 12 223 20 121613 151 10 1953515520 [HDD1]
NTFS, blocksize=4096, 1000 GB / 931 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB