cgsecurity.org

Posted: **15 Jul 2015, 15:48**

Hi.
I have followed various instructions on here regarding restoring files from my HDD.
In windows the partition that I wish to boot from & contains all of my data on is viewed as RAW.
But when I run a scan with TestDisk it see's the partition as P HPFS - NTFS.
To get the drive to boot in windows do I need to change the property to '*' (Primary Bootable) rather than 'P' (Primary).

I can view my files after I have run a deeper scan & have managed to recover some.

Any help please? I would massively appreciate it.

Posted: **16 Jul 2015, 05:54**

If you'd like to boot from any partition, it must be set to star * for primary activ.
Only 1 partition can be active.
RAW means unformatted.
Cause can be either a damaged boot sector or faulty file system.
Can you copy and paste the content of your testdisk.log into your next post?
Have you been able to list your files?

Fiona

Posted: **16 Jul 2015, 07:00**

When I return to my laptop I will post the content of the log file.

Before I start changing anything on the drive - I am cautious that I will lose my files, how do I make a full backup of the drive?

Posted: **16 Jul 2015, 11:37**

Ok, the contents of the Log file is:

Thu Jul 16 11:31:26 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=729074753536
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=15728640000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=484272267264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=20971520000
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 729 GB / 679 GiB - CHS 88638 255 63, sector size=512
Drive E: - 15 GB / 14 GiB - CHS 1912 255 63, sector size=512
Drive F: - 484 GB / 451 GiB - CHS 58876 255 63, sector size=512
Drive Y: - 20 GB / 19 GiB - CHS 2549 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 12/223/20
NTFS at 1925/27/23
Current partition structure:
1 P Dell Utility 0 32 33 12 223 19 204800
2 * HPFS - NTFS 12 223 20 1925 27 22 30720000
3 P HPFS - NTFS 1925 27 23 60801 48 31 945844272

Posted: **18 Jul 2015, 06:51**

Before I start changing anything on the drive - I am cautious that I will lose my files, how do I make a full backup of the drive?

You can clone your disk using hdd raw copy:
http://hddguru.com/software/HDD-Raw-Copy-Tool/
Please be carefull and set the right source and destination/target.
I've only got your current partition table.
There are no info about your boot sector and file system.
Can you run TestDisk / Advanced (select your affected partition and Boot?
Would need info about your boot sector and the backup of your boot sector.
Are they both OK?
Until yet, don't use Write nor RepairMFT.

Fiona

Posted: **27 Jul 2015, 15:17**

Hi.
Sorry about the late reply.
Is this what you are after?

Mon Jul 27 15:12:26 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1093120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4702208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1093120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4702208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=729074753536
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1093120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4702208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=15728640000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=484272267264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=20971520000
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512
Disk /dev/sdb - 1093 KB / 1067 KiB - 2135 sectors, sector size=512
Disk /dev/sdc - 4702 KB / 4592 KiB - 9184 sectors, sector size=512
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 729 GB / 679 GiB - CHS 88638 255 63, sector size=512
Drive G: - 15 GB / 14 GiB - CHS 1912 255 63, sector size=512
Drive H: - 484 GB / 451 GiB - CHS 58876 255 63, sector size=512
Drive Y: - 20 GB / 19 GiB - CHS 2549 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdd - 500 GB / 465 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 12/223/20
NTFS at 1925/27/23
1 P Dell Utility 0 32 33 12 223 19 204800
2 * HPFS - NTFS 12 223 20 1925 27 22 30720000
NTFS, blocksize=4096, 15 GB / 14 GiB
3 P HPFS - NTFS 1925 27 23 60801 48 31 945844272
NTFS, blocksize=4096, 484 GB / 451 GiB

ntfs_boot_sector
3 P HPFS - NTFS 1925 27 23 60801 48 31 945844272
NTFS, blocksize=4096, 484 GB / 451 GiB
NTFS at 1925/27/23
NTFS at 1925/27/23
filesystem size 945844272
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Posted: **28 Jul 2015, 05:51**

The boot sector and its backup are OK.
Di you have a try to list your files?

I can view my files after I have run a deeper scan & have managed to recover some.

Can you run another Deeper Search?
I'd like to compare the partition in your current partition table and your found partition.
Copy and paste the content of your testdisk.log again.

Can you check your disk using CrystalDiskInfo?
http://crystalmark.info/download/index-e.html
The portable version is recommeded, the installer (exe) contains adware OpenCandy.

Fiona

Posted: **28 Jul 2015, 07:03**

I can list the files & I have been able to recover most files, but the gui isn't as friendly as Windows, so I'm worried I've left something behind. So I would like to get the hdd bootable again so I can have a final hunt around before retiring the hdd.
I will get the results from the other searches & post it asap.

Thank you so much for your help!

cgsecurity.org

Recover files

Recover files

Re: Recover files

Re: Recover files

Re: Recover files

Re: Recover files

Re: Recover files

Re: Recover files

Re: Recover files