It seems I'm lost.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
whitmell
Posts: 5
Joined: 05 Nov 2015, 05:40

It seems I'm lost.

#1 Post by whitmell »

I have a laptop hard drive that was running Windows 8 and suddenly stopped working. I hooked it up to a couple different Windows computers using both internal sata connection and an external enclosure, and in both cases the computers slow to a crawl when the hard drive is attached. The disk will show in My Computer but appears to be unformatted, and I can't get any additional info about the drive. I started trying to troubleshoot it using TestDisk and this is what I was getting for a partition table:

Code: Select all

Current partition structure:
 1 P EFI System                  2048    1026047    1024000 [EFI system partition]
 2 P Unknown                  1026048    1107967      81920 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
 4 P Unknown                  1370112    2394111    1024000 [Basic data partition]
 5 P MS Data                  2394112  959852543  957458432 [Basic data partition]
 6 P Unknown                959852544  960774143     921600
 7 P Unknown                960774144  976771119   15996976 [Microsoft recovery partition]
When I tried to view files on partition 5 (the main data partition) I would get an error about the filesystem being damaged or something to that effect, however I could view the files on the other small partitions. At some point I must have done a "Write" on this partition table and since then I cannot get teskdisk to read any partitions at all. I tried using PhotoRecovery since the only thing I care about recovering is photos, but after scanning for 77 hours nothing was found and it was telling me it had almost 1500 hours remaining.

I have a feeling this was something that could have been fixed relatively easy but now I've screwed myself over. Can anyone guide me in the right direction? Unfortunately I didn't have the foresight to save all my logs, but I do have a logfile from one of the times I ran it before writing over the partition table that may provide some insight. One thing I do remember is that I was getting the "The harddisk seems too small!" message that also showed a partition that couldn't be recovered that I believe was way outside the bounds of the disk size. From what I remember it was around the same size as partition 5, but I can't remember exact numbers.

Any help would be very much appreciated. Thank you.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: It seems I'm lost.

#2 Post by cgrenier »

Bad sectors can explain why the computer is very slow when this disk is connected.
You should clone the disk to a new empty one (same size or bigger) using gnu ddrescue.
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk
Once the copy is done, remove the original disk and try to access the data from the clone

whitmell
Posts: 5
Joined: 05 Nov 2015, 05:40

Re: It seems I'm lost.

#3 Post by whitmell »

I will try this, thank you. I am currently running a quick search on the drive and it's about 4% completed (after an hour or so), is it worth letting that finish or should I kill it and go ahead and clone the drive? Thanks.

whitmell
Posts: 5
Joined: 05 Nov 2015, 05:40

Re: It seems I'm lost.

#4 Post by whitmell »

So the results of running ddrescue are looking promising, it's been running for 2.5 days and here's where it's sitting:
Image

It's a 500gb hard drive and as you can see, the vast majority of it has been recovered. That took less than 12 hours. Since then I'm assuming it's been trying to recover the bad sectors, and has slowed to an extreme crawl. My question is, given the high percentage of recovered data, do you think it's worth interrupting ddrescue and attempting to run teskdisk now? At this rate it could grind another week on those last few sectors that I probably don't care about. As I understand it, ddrescue can be resumed from where it left off if you use the same logfile.

I realize this isn't a ddrescue help forum, but any help would be much appreciated, as I am an absolute novice at recovering hard drives. Thanks.

whitmell
Posts: 5
Joined: 05 Nov 2015, 05:40

Re: It seems I'm lost.

#5 Post by whitmell »

So I finally finished up with ddrescue and now I'm running Testdisk on the image. The results I'm getting are kind of odd and I really don't know what to make of them. Here's what it found after a quick scan:

Image

and then after a deep scan:

Image

Because I'm lost and have no idea what I'm doing, I'm currently running Photorecovery to see if I can at least grab JPG images off the image, but I need to figure out how to make the partition readable again so I can also retrieve all the Camera raw (CR2) photos, as well as a couple of other files.

Given the info above, any advice on next steps? Thanks.

Locked