Page 1 of 1

Partition mess and 3TB turns to 5TB

Posted: 01 Feb 2016, 20:16
by PIXIP
Hello. first post, don't know where to start.
Background: just changed 3TB to GPT, and then tried to merge the two partitions and the unallocated one to one big partition.

log to follow, but anyway analyzing was done as "Intel-PC" partition and all the log contains a lot of references to FAT16/32 and 5TB so i got totally confused...
any ideas?

Mon Feb 01 11:13:10 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=240054764032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3000590852608
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 387601 240 63, sector size=512
Drive C: - 240 GB / 223 GiB - CHS 29184 255 63, sector size=512
Drive F: - 3000 GB / 2794 GiB - CHS 387601 240 63, sector size=512

Partition table type (auto): None
Drive F: - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Drive F: - 3000 GB / 2794 GiB - CHS 387601 240 63
Geometry from i386 MBR: head=102 sector=52
BAD_RS LBA=1920221984 1210428
check_part_i386 1 type 72: no test
BAD_RS LBA=1936028192 5400552
check_part_i386 2 type 6C: no test
Current partition structure:
1 P Sys=72 126998 194 3 247118 128 44 1816210284

Bad relative sector.
2 * Sys=6C 128044 46 15 257254 13 1 1953653108

Bad relative sector.
Space conflict between the following two partitions
1 P Sys=72 126998 194 3 247118 128 44 1816210284
2 * Sys=6C 128044 46 15 257254 13 1 1953653108

search_part()
Drive F: - 3000 GB / 2794 GiB - CHS 387601 240 63
BAD_RS LBA=643825696 63
heads/cylinder 128 (FAT) != 240 (HD)
sect/track 32 (FAT) != 63 (HD)
BAD_RS LBA=643981344 63
heads/cylinder 64 (FAT) != 240 (HD)
sect/track 32 (FAT) != 63 (HD)
BAD_RS LBA=2053419264 14
check_part_i386 failed for partition type 04
FAT16 <32M 135808 36 37 408790 137 50 4127494217
This partition ends after the disk limits. (start=2053419264, size=4127494217, end=6180913480, disk end=5860529009)

LVM magic value at 61175/0/1
BAD_RS LBA=2962920079 13026681
check_part_i386 failed for partition type 0E
FAT16 LBA 195960 77 29 433832 71 43 3596624277
This partition ends after the disk limits. (start=2962920079, size=3596624277, end=6559544355, disk end=5860529009)
BAD_RS LBA=2076035550 318600
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
FAT16 LBA 421362 149 20 507984 3 24 1309715447
This partition ends after the disk limits. (start=6371002846, size=1309715447, end=7680718292, disk end=5860529009)
BAD_RS LBA=2969290001 1579704
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 480440 71 25 762765 177 40 4268760694
This partition ends after the disk limits. (start=7264257297, size=4268760694, end=11533017990, disk end=5860529009)
Drive F: - 3000 GB / 2794 GiB - CHS 387601 240 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 5904 GB / 5499 GiB)
The following partitions can't be recovered:
FAT16 <32M 135808 36 37 408790 137 50 4127494217
FAT16 LBA 195960 77 29 433832 71 43 3596624277
FAT16 LBA 421362 149 20 507984 3 24 1309715447
FAT16 >32M 480440 71 25 762765 177 40 4268760694

Re: Partition mess and 3TB turns to 5TB

Posted: 02 Feb 2016, 09:29
by cgrenier
Select Disk \\.\PhysicalDrive1 instead of F:

Re: Partition mess and 3TB turns to 5TB

Posted: 02 Feb 2016, 12:03
by PIXIP
Done. it is recognized (correctly i guess) as GPT.
Quick search finds a single MS data partition
a Deeper Search takes two and a half days (currently at 5%)... and finds many partitions. by the way i had to restart this long long process twice already because of some bug, when i maximize the window all the text disappears...

the log as of now, it is incomplete because it is very long. the full log is here: https://www.dropbox.com/s/l8ot13il4vm76 ... k.log?dl=0

Tue Feb 02 09:26:45 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=240054764032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000590852608
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 387601 240 63, sector size=512
Drive C: - 240 GB / 223 GiB - CHS 29184 255 63, sector size=512
Drive D: - 3000 GB / 2794 GiB - CHS 387601 240 63, sector size=512

Partition table type (auto): None
Drive D: - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Analyse Drive D: - 3000 GB / 2794 GiB - CHS 387601 240 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Drive D: - 3000 GB / 2794 GiB - CHS 387601 240 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 387601 240 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 240 (HD)
1 P MS Data 63 5860529071 5860529009 [3TB]

search_part()
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 387601 240 63
NTFS at 0/1/1
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size 5860529009
sectors_per_cluster 1
mft_lcn 6918448
mftmirr_lcn 305264
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS part_offset=32256, part_size=3000590852608, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/1/1
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size 5860529009
sectors_per_cluster 1
mft_lcn 6918448
mftmirr_lcn 305264
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 63 5860529071 5860529009 [3TB]
NTFS, blocksize=512, 3000 GB / 2794 GiB
file_win32_pread(176,11,buffer,1565565866(387601/95/58)) read err: read after end of file
file_win32_pread(176,8,buffer,1565565869(387601/95/61)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565860(387601/95/52)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565861(387601/95/53)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565862(387601/95/54)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565863(387601/95/55)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565864(387601/95/56)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565866(387601/95/58)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565868(387601/95/60)) read err: read after end of file
file_win32_pread(176,14,buffer,1565565870(387601/95/62)) read err: read after end of file

Results
P MS Data 63 5860529071 5860529009 [3TB]
NTFS, blocksize=512, 3000 GB / 2794 GiB

interface_write()
1 P MS Data 63 5860529071 5860529009 [3TB]

search_part()
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 387601 240 63
NTFS at 0/1/1
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size 5860529009
sectors_per_cluster 1
mft_lcn 6918448
mftmirr_lcn 305264
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS part_offset=32256, part_size=3000590852608, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/1/1
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size 5860529009
sectors_per_cluster 1
mft_lcn 6918448
mftmirr_lcn 305264
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 63 5860529071 5860529009 [3TB]
NTFS, blocksize=512, 3000 GB / 2794 GiB
NTFS at 142/190/42
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size 1250258562
sectors_per_cluster 1
mft_lcn 6918448
mftmirr_lcn 305264
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS part_offset=1105434112, part_size=640132383744, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 142/190/42
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size 1250258562
sectors_per_cluster 1
mft_lcn 6918448
mftmirr_lcn 305264
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 2159051 1252417612 1250258562
NTFS, blocksize=512, 640 GB / 596 GiB

LVM magic value at 202/97/58
FAT12 at 417/213/16
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 417/213/16
MS Data 6318474 6321353 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 445/155/8
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 445/155/8
MS Data 6738172 6741051 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 448/205/29
heads/cylinder 16 (NTFS) != 240 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 6780530 6786703 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 448/205/29
heads/cylinder 16 (NTFS) != 240 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 6786703 6792876 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT12 at 1288/180/35
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 1288/180/35
MS Data 19485934 19488813 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 1495/0/48
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 1495/0/48
MS Data 22604447 22607326 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 1624/151/55
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 1624/151/55
MS Data 24564447 24567326 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 1632/28/18
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 1632/28/18
MS Data 24677621 24680500 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 2662/48/16
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 2662/48/16
MS Data 40252479 40255358 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 2848/22/16
Bad root_cluster
FAT12 at 2848/22/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 240 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 2848/22/17
MS Data 43063162 43066041 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT12 at 3151/161/26
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 240 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 3151/161/26
MS Data 47653288 47674026 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Unusual, only one FAT
FAT32 at 3151/161/27
check_FAT: Bad number of entries in root dir
FAT12 at 3180/211/28
check_FAT: Unusual number of reserved sectors 8 (FAT), should be 1.
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 8-19
FAT2 : 20-31
start_rootdir : 32
Data : 64-32063
sectors : 32067
cluster_size : 8
no_of_cluster : 4000 (2 - 4001)
fat_length 12 calculated 12
FAT differs, FAT sectors=0-12/12
heads/cylinder 255 (FAT) != 240 (HD)

....

Re: Partition mess and 3TB turns to 5TB

Posted: 04 Feb 2016, 19:23
by PIXIP
can anyone help? deep search is still running since my first post and now at 42%
do i really need to wait for it to finish?