Page 1 of 1

USB Hard Disk Partition Recovery

Posted: 15 Oct 2015, 23:51
by gordian
Hi all,
I hope somebody here can help me with a partition problem on a 320GB usb external hard disk.
Originally the drive had two partitions, both with NTFS filesystem. The first partition was the largest and held all the data, the second was only 16 GB and was empty.
By mistake the disk was used to create a windows recovery media: a 32 GB FAT32 partition was created at the beginning of the disk leaving the rest unreadable.

TestDisk in quick scan and in deeper scan detects the 16 GB partition but not the first one (the one I need to recover...). It also detects a 104 GB partition from the backup boot which (I think) is a leftover of an old configuration.
Here is the log:

Code: Select all

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.0-54-generic (#81~precise1-Ubuntu SMP Tue Jul 15 04:02:22 UTC 2014) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       1250263728 sectors
/dev/sda: user_max   1250263728 sectors
/dev/sda: native_max 1250263728 sectors
/dev/sda: dco        1250263728 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - Hitachi HDT721064SLA360, S/N:STHDD7MG1XYG8Y, FW:STDOA31B
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HTS543232L9A300

Partition table type (auto): Intel
Disk /dev/sdd - 320 GB / 298 GiB - Hitachi HTS543232L9A300
Partition table type: Intel
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Analyse Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/32/33
Info: size boot_sector 67108864, partition 67108864
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
Current partition structure:
 1 * FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]

search_part()
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/32/33
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190

FAT32 at 0/32/33
     FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]
     FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 36745/210/10
filesystem size           34816000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS, blocksize=4096, 17 GB / 16 GiB

Results
   * FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]
     FAT32, blocksize=32768, 34 GB / 32 GiB
   P HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS, blocksize=4096, 17 GB / 16 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 67108864 linear /dev/sdd 2048" | dmsetup create test0
echo "0 34816000 linear /dev/sdd 590321664" | dmsetup create test1
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_ucstoutf8: iconv_open failed


dir_partition inode=5
   P HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS, blocksize=4096, 17 GB / 16 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 11-Oct-2015 12:34 .
       5 dr-xr-xr-x     0      0         0 11-Oct-2015 12:34 ..
      35 dr-xr-xr-x     0      0         0 11-Oct-2015 12:34 System Volume Information

interface_write()
 1 P HPFS - NTFS          36745 210 10 38913   5  4   34816000
ntfs_mst_post_read_fixup_warn: magic: 0x032886f4  size: 1024   usa_ofs: 4362  usa_count: 5015: Invalid argument
Record 0 has no FILE magic (0x32886f4)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x032886f4  size: 1024   usa_ofs: 4362  usa_count: 5015: Invalid argument
Record 0 has no FILE magic (0x32886f4)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x032886f4  size: 1024   usa_ofs: 4362  usa_count: 5015: Invalid argument
Record 0 has no FILE magic (0x32886f4)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x032886f4  size: 1024   usa_ofs: 4362  usa_count: 5015: Invalid argument
Record 0 has no FILE magic (0x32886f4)
Failed to load $MFT: Input/output error

search_part()
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/32/33
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190

FAT32 at 0/32/33
     FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]
     FAT32, blocksize=32768, 34 GB / 32 GiB
FAT32 at 0/32/39
FAT1 : 8196-16385
FAT2 : 16386-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-67108863
sectors : 67108864
cluster_size : 64
no_of_cluster : 1048192 (2 - 1048193)
fat_length 8190 calculated 8190
set_FAT_info: name from BS used

FAT32 at 0/32/39
     FAT32 LBA                0  32 33  4177 117 36   67108864 [NO NAME]
     FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 36745/210/10
filesystem size           34816000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS, blocksize=4096, 17 GB / 16 GiB
NTFS at 38912/254/63
filesystem size           205037595
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               12814849
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          26150   0  1 38912 254 63  205037595
     NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
NTFS at 38912/254/63
filesystem size           205037595
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               12814849
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          38912 254 63 51675 254 62  205037595
     NTFS, blocksize=4096, 104 GB / 97 GiB
This partition ends after the disk limits. (start=625137344, size=205037595, end=830174938, disk end=625142448)
NTFS at 38913/5/4
filesystem size           34816000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS found using backup sector, blocksize=4096, 17 GB / 16 GiB
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 425 GB / 395 GiB)
The following partition can't be recovered:
     HPFS - NTFS          38912 254 63 51675 254 62  205037595
     NTFS, blocksize=4096, 104 GB / 97 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]
     FAT32, blocksize=32768, 34 GB / 32 GiB
     HPFS - NTFS          26150   0  1 38912 254 63  205037595
     NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
     HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS, blocksize=4096, 17 GB / 16 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 67108864 linear /dev/sdd 2048" | dmsetup create test0
echo "0 205037595 linear /dev/sdd 420099750" | dmsetup create test1
echo "0 34816000 linear /dev/sdd 590321664" | dmsetup create test2
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_ucstoutf8: iconv_open failed


dir_partition inode=5
     HPFS - NTFS          36745 210 10 38913   5  4   34816000
     NTFS, blocksize=4096, 17 GB / 16 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 11-Oct-2015 12:34 .
       5 dr-xr-xr-x     0      0         0 11-Oct-2015 12:34 ..
      35 dr-xr-xr-x     0      0         0 11-Oct-2015 12:34 System Volume Information
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

     HPFS - NTFS          26150   0  1 38912 254 63  205037595
     NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
   * FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]
     FAT32, blocksize=32768, 34 GB / 32 GiB
FAT: cluster=2(0x2), pos=26624
Directory /
       3 drwxr-xr-x     0      0         0 11-Oct-2015 12:35 EFI
      55 -rwxr-xr-x     0      0    404250 14-Jun-2014 12:46 BOOTMGR
      68 drwxr-xr-x     0      0         0 11-Oct-2015 12:35 BOOT
      79 -rwxr-xr-x     0      0   1614168 14-Jun-2014 14:00 BOOTMGR.EFI
    1076 drwxr-xr-x     0      0         0 11-Oct-2015 12:35 SOURCES
    9362 drwxr-xr-x     0      0         0 11-Oct-2015 12:35 System Volume Information
  983072 -rwxr-xr-x     0      0      1090 11-Oct-2015 05:15 REAGENT.XML
  983142 drwxr-xr-x     0      0         0 12-Oct-2015 11:37 $RECYCLE.BIN
X    105 drwxr-xr-x     0      0     32768 12-Oct-2015 13:32 _168187_
X    105 drwxr-xr-x     0      0     32768 12-Oct-2015 15:11 MSId3986.tmp
X    105 drwxr-xr-x     0      0     32768 13-Oct-2015 13:10 MSI3c337.tmp

interface_write()
 1 * FAT32 LBA                0  32 33  4177 117 36   67108864 [RIPRISTINO]
 2 P HPFS - NTFS          26150   0  1 38912 254 63  205037595
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
I made an image of the entire disk with dd and, on this image, tried to modify the partition table and rebuild the BS. I did not succeed, probably because of an incorrect setting on my side.

I was able to recover something with qphotorec, but most of the important data was not recovered so I would like to try to fix the partition table if possible.
Any ideas on how I could try to fix the drive? :cry: