Recover a NTFS partition overwritten with XFS

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
JJMidday
Posts: 4
Joined: 01 Dec 2015, 16:30

Recover a NTFS partition overwritten with XFS

#1 Post by JJMidday »

Hi everybody! I've done a really huge error using dd on Linux because i didn't specified a file of output and it started to write on my partition sdb2, which is my NTFS partition, my root directory in XFS. I stopped in a few seconds the process.
I'm sure of photorec works but it cannot retrieve filenames so i'm trying with testdisk but it list partitions as they are Linux partitions. There is an hope?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover a NTFS partition overwritten with XFS

#2 Post by Fiona »

Did you run a complete Deeper Search (not Quick Search), searching for a backup of your boot sector?
Only Deeper Search searches additional for a backup of the boot sector.
On NTFS, the last sector of your partition is the backup of the boot sector.
If your NTFS-partition used the whole space of your disk, you must run a complete scan.
Watch the result of Deeper Search, when your NTFS-Partition was found, please select it and press p to have a try to list your files.
Please copy and paste the content of your testdisk.log into your next post.

Fiona

JJMidday
Posts: 4
Joined: 01 Dec 2015, 16:30

Re: Recover a NTFS partition overwritten with XFS

#3 Post by JJMidday »

I did a deeper search and it gave me a list of partition stated as "D" and "Linux". I tried one by one setting their type as "NTFS" and looking for the list of files but I always obtained a "damaged filesystem". I'll insert log file in next post

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover a NTFS partition overwritten with XFS

#4 Post by Fiona »

For me it's important to watch your logfile of the complete Deeper Search and the reusults.
Using Type to change partition types, is probably not helpful.
TestDisk should recognize the file system by the boot sector or it's backup automatically.
Linux can list lots of partitions through the found backup of the superblock.

Fiona

JJMidday
Posts: 4
Joined: 01 Dec 2015, 16:30

Re: Recover a NTFS partition overwritten with XFS

#5 Post by JJMidday »

Hi Fiona,
This is my log of deeper search. (It is the right one hopefully)



Tue Dec 1 16:21:49 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
filewin32_getfilesize(\\.\E:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=300101999616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2202000384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=925085204480
Hard disk list
Drive F: - 300 GB / 279 GiB - CHS 36485 255 63, sector size=512
Drive G: - 2202 MB / 2099 MiB - CHS 2099 64 32, sector size=512
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32, sector size=512

Partition table type (auto): None
Drive H: - 925 GB / 861 GiB
Partition table type: Intel

Analyse Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
file_win32_pread(512,2,buffer,1806807039(882229/63/32)) read err: read after end of file
NTFS at 882229/63/32
heads/cylinder 255 (NTFS) != 64 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 1806807040
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 112925439
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 882229 63 32 1806807040
NTFS found using backup sector, blocksize=4096, 925 GB / 861 GiB
Partition not added.
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced

Analyse Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Failed to startup volume: Invalid argument.

search_part()
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 114327 0 1 144326 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4

Results
Linux 114327 0 1 144326 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
Change partition type:
P HPFS - NTFS 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
Not an exFAT boot sector.


dir_partition inode=2
P HPFS - NTFS 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 114327 0 1 144326 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /

interface_write()
1 P HPFS - NTFS 119289 0 1 882229 63 32 1562503168
Failed to startup volume: Invalid argument.

search_part()
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=23/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 114315 2 1 144315 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 114327 0 1 144326 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 114362 2 1 144362 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 114363 0 1 144362 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 114367 2 1 144367 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/234, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 119289 0 1 149288 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 120958 0 1 883898 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=247721984, size=1562503168, end=1810225151, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 121029 1 1 883970 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=247867424, size=1562503168, end=1810370591, disk end=1806807040)

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/234, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 119289 0 1 149288 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 343

recover_EXT2: "e2fsck -b 11239424 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=343/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 729

recover_EXT2: "e2fsck -b 23887872 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=729/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 2187

recover_EXT2: "e2fsck -b 71663616 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2187/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500354 1 1 1263295 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024725024, size=1562503168, end=2587228191, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500374 1 1 1263315 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024765984, size=1562503168, end=2587269151, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500386 0 1 1263326 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024790528, size=1562503168, end=2587293695, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500387 1 1 1263328 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024792608, size=1562503168, end=2587295775, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500426 0 1 1263366 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024872448, size=1562503168, end=2587375615, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500457 2 1 1263398 1 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024936000, size=1562503168, end=2587439167, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500458 0 1 1263398 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024937984, size=1562503168, end=2587441151, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500465 1 1 1263406 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024952352, size=1562503168, end=2587455519, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500466 1 1 1263407 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024954400, size=1562503168, end=2587457567, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500469 0 1 1263409 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024960512, size=1562503168, end=2587463679, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 500471 2 1 1263412 1 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024964672, size=1562503168, end=2587467839, disk end=1806807040)

block_group_nr 3125

recover_EXT2: "e2fsck -b 102400000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3125/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
file_win32_pread(512,2,buffer,1806807039(882229/63/32)) read err: read after end of file
NTFS at 882229/63/32
heads/cylinder 255 (NTFS) != 64 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 1806807040
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 112925439
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 882229 63 32 1806807040
NTFS found using backup sector, blocksize=4096, 925 GB / 861 GiB
Partition not added.
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (925 GB / 861 GiB) seems too small! (< 1324 GB / 1233 GiB)
The following partitions can't be recovered:
Linux 120958 0 1 883898 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 121029 1 1 883970 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500354 1 1 1263295 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500374 1 1 1263315 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500386 0 1 1263326 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500387 1 1 1263328 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500426 0 1 1263366 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500457 2 1 1263398 1 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500458 0 1 1263398 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500465 1 1 1263406 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500466 1 1 1263407 0 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500469 0 1 1263409 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 500471 2 1 1263412 1 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
get_geometry_from_list_part_aux head=64 nbr=8
get_geometry_from_list_part_aux head=8 nbr=8
get_geometry_from_list_part_aux head=16 nbr=8
get_geometry_from_list_part_aux head=32 nbr=8
get_geometry_from_list_part_aux head=64 nbr=8

Results
Linux 114315 2 1 144315 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 114327 0 1 144326 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 114362 2 1 144362 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 114363 0 1 144362 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 114367 2 1 144367 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 119289 0 1 149288 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB


dir_partition inode=2
Linux 114315 2 1 144315 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 2133571387.
Directory /


dir_partition inode=2
Linux 114327 0 1 144326 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 114362 2 1 144362 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 114363 0 1 144362 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 114367 2 1 144367 1 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 119289 0 1 149288 63 32 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
P Linux 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
ext2fs_dir_iterate failed with error 1.
Directory /
Change partition type:
P HPFS - NTFS 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
Not an exFAT boot sector.


dir_partition inode=2
P HPFS - NTFS 119289 0 1 882229 63 32 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
ext2fs_dir_iterate failed with error 1.
Directory /

interface_write()
1 P HPFS - NTFS 119289 0 1 882229 63 32 1562503168
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced
New options :
Dump : No
Align partition: Yes
Expert mode : No

Analyse Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
file_win32_pread(512,2,buffer,1806807039(882229/63/32)) read err: read after end of file
NTFS at 882229/63/32
heads/cylinder 255 (NTFS) != 64 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 1806807040
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 112925439
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 882229 63 32 1806807040
NTFS found using backup sector, blocksize=4096, 925 GB / 861 GiB
Partition not added.
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Analyse Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Drive H: - 925 GB / 861 GiB - CHS 882230 64 32
file_win32_pread(512,2,buffer,1806807039(882229/63/32)) read err: read after end of file
NTFS at 882229/63/32
heads/cylinder 255 (NTFS) != 64 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 1806807040
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 112925439
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 882229 63 32 1806807040
NTFS found using backup sector, blocksize=4096, 925 GB / 861 GiB
Partition not added.
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

JJMidday
Posts: 4
Joined: 01 Dec 2015, 16:30

Re: Recover a NTFS partition overwritten with XFS

#6 Post by JJMidday »

I'm sorry. That wasn't the right log. This is the correct log after a deeper search. I tried to Load a Backup but TestDisk cannot find a backup..



Wed Dec 9 09:12:15 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
filewin32_getfilesize(\\.\E:) GetFileSize err Funzione non corretta.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Funzione non corretta.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2202000384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=925085204480
Hard disk list
Drive G: - 2202 MB / 2099 MiB - CHS 267 255 63, sector size=512
Drive H: - 925 GB / 861 GiB - CHS 112468 255 63, sector size=512

Partition table type (auto): None
Drive H: - 925 GB / 861 GiB
Partition table type: Intel

Interface Advanced
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Interface Advanced

Analyse Drive H: - 925 GB / 861 GiB - CHS 112468 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Drive H: - 925 GB / 861 GiB - CHS 112468 255 63

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 14574 164 55 18399 27 60 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

Results
Linux 14574 164 55 18399 27 60 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB


dir_partition inode=2
P Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
ext2fs_dir_iterate failed with error 1.
Directory /

interface_write()
1 P Linux 15207 54 16 112468 136 52 1562503168

search_part()
Drive H: - 925 GB / 861 GiB - CHS 112468 255 63

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 14574 164 55 18399 27 60 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/234, s_mnt_count=21/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 14579 60 10 18403 178 15 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/234, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 15207 54 16 19031 172 21 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15419 249 63 112681 77 36 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=247721984, size=1562503168, end=1810225151, disk end=1806807040)

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/234, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7680000
recover_EXT2: part_size 61440000
Linux 15207 54 16 19031 172 21 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 343

recover_EXT2: "e2fsck -b 11239424 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=343/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 729

recover_EXT2: "e2fsck -b 23887872 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=729/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 2187

recover_EXT2: "e2fsck -b 71663616 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2187/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 63790 66 21 161051 148 57 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024790528, size=1562503168, end=2587293695, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 63795 91 41 161056 174 14 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024872448, size=1562503168, end=2587375615, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 63799 111 57 161060 194 30 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024937984, size=1562503168, end=2587441151, disk end=1806807040)

recover_EXT2: s_block_group_nr=0/5960, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 63800 214 31 161062 42 4 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
This partition ends after the disk limits. (start=1024960512, size=1562503168, end=2587463679, disk end=1806807040)

block_group_nr 3125

recover_EXT2: "e2fsck -b 102400000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3125/5960, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 195312896
recover_EXT2: part_size 1562503168
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
NTFS at 112468/136/52
filesystem size 1806807040
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 112925439
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 112468 136 52 1806807040
NTFS found using backup sector, blocksize=4096, 925 GB / 861 GiB
Partition not added.
Drive H: - 925 GB / 861 GiB - CHS 112468 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (925 GB / 861 GiB) seems too small! (< 1324 GB / 1233 GiB)
The following partitions can't be recovered:
Linux 15419 249 63 112681 77 36 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 63790 66 21 161051 148 57 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 63795 91 41 161056 174 14 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 63799 111 57 161060 194 30 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB
Linux 63800 214 31 161062 42 4 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Recover, 800 GB / 745 GiB

Results
Linux 14574 164 55 18399 27 60 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 14579 60 10 18403 178 15 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
Linux 15207 54 16 19031 172 21 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load


dir_partition inode=2
Linux 14574 164 55 18399 27 60 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 14574 164 55 18399 27 60 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 14579 60 10 18403 178 15 61440000
ext4 blocksize=4096 Large_file Sparse_SB Recover, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 15207 54 16 19031 172 21 61440000
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 31 GB / 29 GiB
ext2fs_dir_iterate failed with error 1.
Directory /


dir_partition inode=2
Linux 15207 54 16 112468 136 52 1562503168
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 800 GB / 745 GiB
ext2fs_dir_iterate failed with error 1.
Directory /

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced

TestDisk exited normally.

Locked