Page 1 of 3

Partition table mismatch External drive 1TB-WD10

Posted: 18 Dec 2014, 12:00
by europanorama
IMG_0896WD10toosmall.jpg
IMG_0896WD10toosmall.jpg (102.29 KiB) Viewed 3915 times
IMG_0894WD10_headcylindersectorsmismatch.jpg
IMG_0894WD10_headcylindersectorsmismatch.jpg (84.61 KiB) Viewed 3915 times
IMG_0899WD10_two_partitiontables.jpg
IMG_0899WD10_two_partitiontables.jpg (125.69 KiB) Viewed 3915 times
-------------------------------------------------------------


Thu Dec 18 09:05:23 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-11-13T18:59:50
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=38724585984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=51457319424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=409915054080
filewin32_getfilesize(\\.\M:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\M:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=1000200994816
filewin32_getfilesize(\\.\Q:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\Q:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\Q:
filewin32_getfilesize(\\.\T:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\T:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\T:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - SATA WDC WD50
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SATA WDC WD10

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - SATA WDC WD10
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094847
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094847
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 39 41 121600 254 63 1953517568
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094847
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,1024,buffer,1959814592(121992/208/9)) lseek err Invalid argument
file_pread(5,1,buffer,1959814592(121992/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 243201 215 22 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953520064, size=1953517568, end=3907037631, disk end=1953525168)
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525313(121601/83/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525441(121601/85/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525569(121601/87/24)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,1953525697(121601/89/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
HPFS - NTFS 121600 254 63 243201 215 22 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 0 39 41 121600 254 63 1953517568
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
------------------------
This partitiontable shows data but not the other one
HPFS - NTFS 0 32 33 121600 247 55 1953517568
what should be done? changing geometry pls explain the procedure. is there a manual for that?
I changed the first one to P and tried to write and reboot, did not work. i simply dont understand what must be done.
btw: desaster began when i forgot to switch docking-station form usb to esata(orico 6515 series) after cloning a different drive which has overlapping problem on first and second partition.
so i had external drive on usb3.0(pc has usb 2.0 only). when i saw no data later i panicked attached it accidentally as first drive(both sata-cables have same color....) could have used the third slower channel.. so autochk(run almost 2hrs) messed up partition table.
pls fiona delete or dont start my german thread. i will stay here.

Re: Partition table mismatch External drive 1TB-WD10

Posted: 19 Dec 2014, 08:10
by cgrenier
The partition table contains a single NTFS partition that match the disk size.
Run Testdisk, Advanced, select the NTFS partition, choose Boot, RebuildBS, List.
If you see your files, choose Write, confirm, Quit

Re: Partition table mismatch External drive 1TB-WD10

Posted: 20 Dec 2014, 10:15
by europanorama
After listing the files i dont see "Write".
used dos-version. drive attached as usb. as sata(second channel) did not work. cannot go through recognition on P4.
Will now try from hirens boot-cd.
How about offering an iso to create boot-cd?

Re: Partition table mismatch External drive 1TB-WD10

Posted: 20 Dec 2014, 12:36
by europanorama
I tried everything, change external case, from docking-station to enclosure. maybe i must use simple usb-sata-adapter?

Tried to write after going back from listing to analyze etc. NOTHING HELPED.
Instructions are unclear. there is no write after listing data.
What will be done with this writing? writing partition table?
maybe i can use a different tool.
Thank you very much for clarifications. i have been spending almost 2 months with this an my other two-booting-drives. one is a clone. people from sysopt.com forum could not help

Re: Partition table mismatch External drive 1TB-WD10

Posted: 23 Dec 2014, 02:40
by europanorama
Christophe, what must be done?
Have now a cloned drive.
Have another systemdrive(winxp) with messed up partition table on partition D. Drive is booting correctly.
will clone that too.
Thank you very much.

Re: Partition table mismatch External drive 1TB-WD10

Posted: 23 Dec 2014, 20:16
by europanorama
your instruction:
"The partition table contains a single NTFS partition that match the disk size.
Run Testdisk, Advanced, select the NTFS partition, choose Boot, RebuildBS, List.
If you see your files, choose Write, confirm, Quit"
If i see three partitions all marked D(deleted) what must be done then with them
mark the one with folders as P-primary? what next, display files with p?
I think my clone is now messed up all over, will do a new clean one.

Re: Partition table mismatch External drive 1TB-WD10

Posted: 23 Dec 2014, 20:24
by europanorama
I see testdisk version 6.14 on your site but i have found version 7.0 and i am puzzled. which one should i use?

Re: Partition table mismatch External drive 1TB-WD10

Posted: 24 Dec 2014, 00:04
by europanorama
Does this instruction referr to a bootdrive or also external-drive without GPT like mine?
The partition table contains a single NTFS partition that match the disk size.
Run Testdisk, Advanced, select the NTFS partition, choose Boot, RebuildBS, List.
If you see your files, choose Write, confirm, Quit"
- i will now go through all instructions here:
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
-----
Sorry if i have confused you.
I not only switched the drives but changings were also made on clone using both tools...
its about WD10EZRX(clone)

Re: Partition table mismatch External drive 1TB-WD10

Posted: 24 Dec 2014, 08:07
by europanorama
Did a fresh scan in windows with newest testdisk 7.0
Did what was in the instructions plus what you have told. boot, rebuildbs, List
" If you see your files, choose write, confirm, Quit
After seeing the files here too.
i dont see confirm only quit.
here you can see:
IMG_0930testdisk7_WD10EARS_FILES.jpg
IMG_0930testdisk7_WD10EARS_FILES.jpg (76.04 KiB) Viewed 3849 times

Re: Partition table mismatch External drive 1TB-WD10

Posted: 24 Dec 2014, 09:27
by Fiona
If you cannot run a diagnose under windows, you can you use a Live-CD like Knoppix?
DOS doesn't support long file names, NTFS support to copy data etc..
Might be possible that you get better results!
Knoppix already contain testdisk.
Open the start menu, select Knoppix and root terminal.
Type in su testdisk and repeat your diagnose!

Fiona