Structure: Bad when trying to recover a logical NTFS Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
sozable
Posts: 2
Joined: 07 May 2012, 04:35

Structure: Bad when trying to recover a logical NTFS

#1 Post by sozable »

I am having some difficulty using TestDisk to restore a logical partition which was deleted at the same time as I intentionally deleted a primary partition. I am very happy to see that my data still exists and seems to be recoverable, but I need some help.

After getting rid of the last PC I built, I kept the hard drive (a 1 TB SATA HDD) from it and have it currently connected in a less powerful desktop PC by HP. The hard drive had 15 GiB for a primary NTFS partition with Windows XP Professional installed on it (no volume label), and an extended partition which I never used fully: 40 GiB for another NTFS partition for programs (volume label "XP_Progs"), 100 GiB NTFS partition for data (volume label "XP_Data"), and perhaps 200 or 300 GiB left unused within that extended partition. A large portion was unallocated.

I can and still do boot up the copy of XP Professional, but I decided to start trying out BSD and Linux distros, recently. The 1 TB drive has more than enough room to do so. After installing Debian most recently, I noticed the unused space which was within the extended partition was gone, shrinking it to something only large enough for my logical partitions (XP_Progs and XP_Data). While using Windows XP Home (booted from the PC's original HDD) I made a FAT32 partition (volume label "stuff") on the 1 TiB drive which came directly after XP_Data. I realized later FAT32 was not going to be sufficient, and then used XP Home's disk management to delete "stuff." This act took out XP_Data along with it.

I downloaded TestDisk 6.14-WIP late last night and have been attempting to recreate that partition, but I cannot resolve the "Structure: Bad" and "Invalid partition structure" messages. For whatever reason, after I finish a quick scan or deeper scan, TestDisk sets the primary NTFS partition with XP Professional installed upon it as well as XP_Progs to "deleted." If I attempt to set "XP_Progs" back to a logical partition (or anything but deleted), that's when "Structure: Bad" appears, even though I cannot spot a conflict.

Granted, just because I can not see a conflict in starting and ending locations of partitions does not mean that one is not there. Maybe I need the extended partition back. Maybe there's some trick with starting and ending locations. Whatever the case, I appreciate any help I can get, here.

A few other details which may be worth noting. First, I do receive warnings that TestDisk thinks I should have a different drive geometry with 255 heads, but I know what the real capacity of this HDD is, and it does not exceed 1 TB, much less 2 TiB, as the program's suggestion claimed in one of my deeper scans. If I understand correctly, my most recent partition for Debian is triggering that message. Second, I have attempted to "Read The Manual" before posting here, but I can find no such manual on the documentation wiki; the closest thing was the step-by-step.

Here is a copy of my most recent TestDisk log of a quick scan.
Attachments
sozableTestDiskLog.zip
(2.27 KiB) Downloaded 519 times
Last edited by sozable on 07 May 2012, 23:45, edited 3 times in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Structure: Bad when trying to recover a logical NTFS

#2 Post by Fiona »

Would it be possible to repeat your diagnose using another geometry?
Reason is, normally motherboard controller converting disk geometry of 16 heads per cylinder to 255 heads.
But not in your case.
Example from your log;
Current partition structure:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 16 (HD)
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 1938021 16 63
You can change it, when you see the menu Analyse in TestDisk, don't confirm at Analyse but Geometry.
Change the value at Heads from 16 to 255.
Leave the menu Geomtry at Ok and repeat your diagnose.
Have another try to set your partitions for recovery.

Fiona

sozable
Posts: 2
Joined: 07 May 2012, 04:35

Re: Structure: Bad when trying to recover a logical NTFS

#3 Post by sozable »

Thank you, I was able to recover my data partition after changing TestDisk to use 255 heads for the geometry. It did not try to make the drive "bigger" as I had thought it would. I understand now that the warning for using 255 heads was separate from the message saying the drive seemed too small.

While TestDisk was using the 16 head geometry reported to it, the ext4 partition on which I had installed Debian was still visible (though unrecoverable, which is fine for my purposes). That partition, however, would have ended beyond the last sector of my drive. Therefore, the message that my disk seemed too small.

When I changed TestDisk to use 255 heads, that ext4 partition was no longer visible even after a deeper search, but all of my partitions were aligned with cylinder boundaries as documented here. I understand that Microsoft has broken with that practice since Windows Vista, but my partitions created by Windows XP should not have been skewed, as they had been while TestDisk was using the perspective of 16 heads for the hard drive geometry.

I'm not quite sure as to why 16 heads were reported, though I suspect the cause was related to my hardware. This SATA drive was originally connected to a PC which had SATA ports on the motherboard, but the current PC's motherboard does not. Instead, it's currently connected through a PCI card with a chip which supports SATA 1.0. I don't recall right now whether AHCI is in use, but perhaps if it is using IDE emulation that could be the cause. I'm not sure how I would still be able to use the full capacity of the drive in that case, but I suppose that's something I should worry about later.

Once again, thanks for your help. Also, I have stricken my earlier post of the note about extended partitions, as I now have seen a little bit of how TestDisk deals with them.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Structure: Bad when trying to recover a logical NTFS

#4 Post by Fiona »

Often Linux uses 16 heads per cylinder.
So sometimes it's depend on OS also.
Some additional information about geomerty;
http://www.cgsecurity.org/wiki/Menu_Geometry
I assume that your topic is solved. :)

Fiona

Locked