Page 1 of 1

Windows 7 Partition Recovery

Posted: 20 May 2012, 11:38
by Ajayp007
Hi,

I am a newbie to this forum. :ugeek: I am hoping you can help me with this issue I have.
I am using a Dell XPS 17 "Windows 7" laptop which has a 500gb HDD. This had a C: and D: drive.
I installed some partition software, after a reboot it came up with some errors such as BOOT MBR missing.
I tried various things before I knew about "TestDisk", and caused the problem I am now having.

I had the chance to copy the data files from the disk when using Ubuntu or linux mint, but stupidly kept on trying other commands to fix the MBR which now means I cant even see my files. :cry:
Filesystem details.
/dev/sda1 - Dell Boot util (I can access this by mounting)
/dev/sda2 - Dell Recovery (I can access this by mounting)
/dev/sda3 - Windows 7 partition (My old C: drive (NTFS) - no access to my data files)
/dev/sda5 - Data Partition (My old D: drive - (NTFS) I can access this by mounting)

I need to mount /dev/sda3 so I can copy my files, I will reinstall Windows 7 afterwards, getting the MBR fixed is a bonus but not a requirement. Getting my files off is important to me.

[img][filesystem/img]

Re: Windows 7 Partition Recovery

Posted: 20 May 2012, 13:13
by Ajayp007
I don't know how to attach my screenshots so pasting info from Testdisk.log.

Mon May 21 08:03:17 2012
Command line: TestDisk

NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
TestDisk 6.12, Data Recovery Utility, May 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.0.4-pmagic (#1 SMP Sat Sep 3 17:11:11 CDT 2011) i686
Compiler: GCC 4.5
Compilation date: 2011-05-15T12:36:01
ext2fs lib: 1.41.14, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA ST9500420AS

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ATA ST9500420AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 0/1/1
Info: size boot_sector 208781, partition 208781
FAT1 : 1-204
FAT2 : 205-408
start_rootdir : 409
Data : 441-208780
sectors : 208781
cluster_size : 4
no_of_cluster : 52085 (2 - 52086)
fat_length 204 calculated 204
NTFS at 13/0/52
Error: size boot_sector 40960000 > partition 40959999
check_part_i386 failed for partition type 07
NTFS at 31798/192/11
Error: size boot_sector 465924096 > partition 465924095
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * FAT16 >32M 0 1 1 12 254 62 208781 [DellUtility]
FAT16, 106 MB / 101 MiB
2 P HPFS - NTFS 13 0 52 2562 164 33 40959999
3 E extended LBA 31798 191 11 60801 47 45 465924158
5 L HPFS - NTFS 31798 192 11 60801 47 45 465924095
Change partition type:
3 E HPFS - NTFS 31798 191 11 60801 47 45 465924158


dir_partition inode=0
3 E HPFS - NTFS 31798 191 11 60801 47 45 465924158
exFAT: Can't read directory cluster.
Directory /

3 E HPFS - NTFS 31798 191 11 60801 47 45 465924158
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
3 E HPFS - NTFS 31798 191 11 60801 47 45 465924158
filesystem size 8386093285582598210 1
sectors_per_cluster 0 0
mft_lcn 1382969193 0
mftmirr_lcn 1132032613 0
clusters_per_mft_record 97 0
clusters_per_index_record 82 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS signature is missing.
NTFS signature is missing.


dir_partition inode=0
3 E HPFS - NTFS 31798 191 11 60801 47 45 465924158
exFAT: Can't read directory cluster.
Directory /

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 0/1/1
Info: size boot_sector 208781, partition 208781
FAT1 : 1-204
FAT2 : 205-408
start_rootdir : 409
Data : 441-208780
sectors : 208781
cluster_size : 4
no_of_cluster : 52085 (2 - 52086)
fat_length 204 calculated 204
NTFS at 13/0/52
Error: size boot_sector 40960000 > partition 40959999
check_part_i386 failed for partition type 07
NTFS at 31798/192/11
Error: size boot_sector 465924096 > partition 465924095
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * FAT16 >32M 0 1 1 12 254 62 208781 [DellUtility]
Error: size boot_sector 40960000 > partition 40959999
Invalid NTFS or EXFAT boot
2 P HPFS - NTFS 13 0 52 2562 164 33 40959999
2 P HPFS - NTFS 13 0 52 2562 164 33 40959999
3 E extended LBA 31798 191 11 60801 47 45 465924158
Error: size boot_sector 465924096 > partition 465924095
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 31798 192 11 60801 47 45 465924095
5 L HPFS - NTFS 31798 192 11 60801 47 45 465924095

Regards,

Ajay

Re: Windows 7 Partition Recovery

Posted: 20 May 2012, 19:46
by Ajayp007
Can you please advise, what to try out?

I have another 1tb disk that I am now going to stick into the 2nd bay of the laptop which I will use to copy the old Windows 7 NTFs partition over. Hopefully this will provide me with some thing i can work with. I will then install Windows 7 again to get me back up and running again.

PS: I have screenshots of various Testdisk tests but not sure how to upload. It ignores every attempt for me to attach jpg or png files. Any help in doing this would be great.

Regards,

Ajay

Re: Windows 7 Partition Recovery (SOLVED)

Posted: 21 May 2012, 21:12
by Ajayp007
I looked into my boot partition and found some backups of the old mbr in a *.img format which were taken orginally prior to my loss of data partition, I use ubuntu to restore this mbr.img, which made my filessystem look slightl different, so I think the cylinder, heads and sectors got modifed.

I then used test disk, Analysys, and then Advanced, this found the bad parition, which still didnt list my files.
I then ran RebuildBS, this showed some filesystem information then I never saw before and when I then went to Boot, I was able to list all of my old C: partition. Hooray..... so then I "write" to the system. :mrgreen:
I used "hirens" boot disk, this lets you use "Mini XP" which contains so excellent partition programs to copy data across.

I backed all of my files today. :D

Now i am just correcting my boot partition for Windows 7. But at aleast I have my data.
I recommend "Testdisk" to anyone, but as I have read in this forum, dont give up, but tread carefully, do not format your disk or mess about with "chkdsk".
Good luck and thanks again for an excellent product. :ugeek:

Re: Windows 7 Partition Recovery

Posted: 22 May 2012, 19:18
by Fiona
1 * FAT16 >32M 0 1 1 12 254 62 208781 [DellUtility]
FAT16, 106 MB / 101 MiB
2 P HPFS - NTFS 13 0 52 2562 164 33 40959999
3 E extended LBA 31798 191 11 60801 47 45 465924158
5 L HPFS - NTFS 31798 192 11 60801 47 45 465924095
Change partition type:
3 E HPFS - NTFS 31798 191 11 60801 47 45 465924158
There is something to watch like described in this post about Dell computers to get your system bootable;
http://forum.cgsecurity.org/phpBB3/post ... dell#p2580
Especially that your crrent Dell Utility-Partition is bootable and not your OS.
2 P HPFS - NTFS 13 0 52 2562 164 33 40959999
3 E extended LBA 31798 191 11 60801 47 45 465924158
5 L HPFS - NTFS 31798 192 11 60801 47 45 465924095
You have free space between both partition, is it normal?
Also you were diagnosing your boot sector using exFAT.
ExFAT is normally only intended to external devices.
Did you have any reason for?

Fiona

Re: Windows 7 Partition Recovery

Posted: 22 May 2012, 20:35
by Ajayp007
Thanks Fiona.

After I wrote my last post, running Windows 7 repair got me back into the system.
Question about the space between partitions, the deepscan fixed this and correctly sorted out the numbers, which is why it then let me see all of my data.

But the funny thing was that it booted up the backup partion I took and not the original one. It had the boot folder and bootmgr file in there when I was messing about a while back so it made it a Primary boot partition.

Thanks for the info about Dell utitlity. I need to change the Type to "de", no wonder its not being read correctly.

To anwser your question about why exfat, I was trying various things, thats why it appeared in the log.

I have a couple of choices now. Use my new 1tb disk which has a working boot and os(copy) or fix the original disk.
I am actually trying the latter... I dont want to give up yet. Retrieving data is not the issue now as I have backups.

So i now have 2 disks.

sda - 500gb - <dell utility>, <recovery>, <OS>, <Data>
sdb - 1tb <OS Backup>, <Data backup>, <spare>, <spare>

Regards,

Ajay

Re: Windows 7 Partition Recovery

Posted: 21 Jun 2012, 20:58
by Fiona
There is an example about Dell recovery;
http://forum.cgsecurity.org/phpBB3/post ... dell#p2580
Your first partition should be partition type "Dell Utility" and primary only.
Your second recovery partition should probably primary also.
Your third partition might be your system partition and should be *Star for primary active.

Fiona