Attempting to recover a lost partition.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ohsnap
Posts: 3
Joined: 21 Jan 2015, 22:02

Attempting to recover a lost partition.

#1 Post by ohsnap »

Greetings,

Due to a power outage at the datacenter this server is hosted at we 'lost' a partition.

Using testdisk I am able to see the partition and list the files, but I had some concerns before 'pulling the trigger' so to speak.

Here is what testdisk shows initially:

Code: Select all


TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 898 GB / 836 GiB - CHS 1036956 47 36
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Dell Utility             0   1 28    47  22  9      80262

Warning: Bad ending sector (CHS and LBA don't match)
 2 * HPFS - NTFS             48  19 21  3766  36  8    6291456
 3 P HPFS - NTFS           3766  36  9 177288  46 36  293599612
 4 E extended LBA         53344  39  5 1036954  43 28 1664268288
Space conflict between the following two partitions
 3 P HPFS - NTFS           3766  36  9 177288  46 36  293599612
 4 E extended LBA         53344  39  5 1036954  43 28 1664268288

test_logical:
Partition sector doesn't have the endmark 0xAA55


*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
>[Quick Search]  [ Backup ]

Attempting to do a quick search produces the following screen:

Code: Select all

TestDisk 7.0-WIP, Data Recovery Utility, January 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 898 GB / 836 GiB - CHS 1036956 47 36

Warning: the current number of heads per cylinder is 47
but the correct value may be 255.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
Without changing the geometry, a quick scan shows the following structure which appears to be correct (I am able to list the files on the 4th partition, everything is intact):

Code: Select all

Disk /dev/sda - 898 GB / 836 GiB - CHS 1036956 47 36
     Partition               Start        End    Size in sectors
>D FAT16 >32M               0   1 28    47  22  9      80262 [DellUtility]
 D HPFS - NTFS             48  19 21  3766  36  8    6291456
 D HPFS - NTFS           3766  36  9 177289  46 12  293601280
 D HPFS - NTFS          177289  46 13 1036953  33 32 1454551040
My main concern here is that the initial partition listing from testdisk has-
Partition 1: Primary (dell utility)
Partition 2: Bootable
Partition 3: Primary
Partition 4: Extended

Inside of windows diskmgmt.msc reports this:
Partition 1: OEM partition (primary?)
Partition 2: Primary (recovery)
Partition 3: Bootable (windows)
Partition 4: "free space", outlined in green, looks like an extended partition

I would assume that the partitions should be all primary except the 3rd partition, which should be primary/bootable.

But if that is the case why does the initial testdisk output have the 2nd (recovery) partition as bootable and the 3rd (windows) partition simply as primary?

Trying to resolve this problem remotely, would be a very long drive to the datacenter. Any help or insight would be very appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Attempting to recover a lost partition.

#2 Post by cgrenier »

In Geometry, set 255 heads and 63 sectors, Try again Analyse, Quick Search and please post the new testdisk.log content.

ohsnap
Posts: 3
Joined: 21 Jan 2015, 22:02

Re: Attempting to recover a lost partition.

#3 Post by ohsnap »

Thank you for the reply.

This was a 'we need this up and running as soon as possible' sort of situation with a worst case scenario of driving to the datacenter which is a handful of hours away.

I had assumed the odd reported geometry like number of heads was correct (it is on a PERC RAID 5) because the only partition lost was the 4th one and everything else was intact (it was loaded in Win Server 2012, was running testdisk inside of windows remotely, testdisk and other partition tools reported the same bizarre geometry for all partitions) and because leaving the default geometry I was able to 'list files' in testdisk on the 4th partition and everything was intact, using the assumed odd geometry.

So I wrote the changes to disk as:
1 - changed partition type to "de", primary
2 - left as NTFS, primary
3 - left as NTFS, bootable/primary
4 - left as NTFS, primary

Upon reboot the datacenter people said it is displaying something similar to 'boot configuration missing'.

It looks like I'll be heading out there today or tomorrow, any additional feedback would be extremely appreciated in the mean time. Trying to put together a plan that doesn't involve a reinstall/repair install before we get there.

ohsnap
Posts: 3
Joined: 21 Jan 2015, 22:02

Re: Attempting to recover a lost partition.

#4 Post by ohsnap »

Situation resolved. An update for anyone else that encounters this-

After writing the aforementioned changes via testdisk, windows server 2102 refused to boot. Booting with the oem installation dvd we were able to get to console.

We were able to verify using the diskpart utility that all of the changes made via testdisk were committed to the disk fine (the 4th partition was no longer seen by windows as raw volume, it was correctly identified as a ntfs volume with everything intact including drive letter, volume name, and all data).

We ran the following commands and everything is fine again.

bootrec /fixboot
bootrec /fixmbr
bootrec /rebuildbcd
bcdboot c:\Windows /s c:

Locked