Deleted VHD partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
chrispret
Posts: 3
Joined: 09 Feb 2016, 20:18

Deleted VHD partition

#1 Post by chrispret »

I deleted the partition on a VHD by mistake and I'm trying to use TestDisk to restore it.

When I scanned it as an Intel type it comes back saying 'No partition is bootable'. Running a quick scan yields no partition to try and recover.

Next I scanned it as type None and it found the partition, but won't let me write it. I can view the files, directories and all seems ok.

Then I scanned it as type 'EFI GPT' and it at first states: 'Bad GPT Partition, invalid signature'. Then I did a Quick Search and it finds a partition, I can view the directories and all that.

That said, the partition info is not the same as it found on 'None'. I suspect that the info is probably right, but I don't want to mess it up by assuming...

Is there any way to check?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deleted VHD partition

#2 Post by cgrenier »

Please post the testdisk.log file content.

chrispret
Posts: 3
Joined: 09 Feb 2016, 20:18

Re: Deleted VHD partition

#3 Post by chrispret »

See below, I had to cut out a bunch of 'lseek err' entries (like the one below) to keep the size down, else the file is too big.
file_pread(5,1,buffer,945026006(58825/37/51)) lseek err Invalid argument

The VHD file is on a NAS drive that has minor communication issues, not sure if that is contributing to the lseek err entries.

I also cut out parts of the directory listing, but that's just because I'm being neurotic about people seeing my directory structure. Please do laugh if you feel like it :)

When you see: ***************************** know that I cut out either option above.



Tue Feb 9 16:05:31 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=483853271040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=483853271040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=225121927168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=137437904896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=137438953472
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63, sector size=512
Drive C: - 225 GB / 209 GiB - CHS 27369 255 63, sector size=512
Drive D: - 137 GB / 127 GiB - CHS 16709 255 63, sector size=512
Drive E: - 137 GB / 128 GiB - CHS 16709 255 63, sector size=512

Partition table type default to Intel
Disk /dev/sdc - 483 GB / 450 GiB
Partition table type: None

Analyse Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
Current partition structure:
P Unknown 0 0 1 58825 36 27 945025920

search_part()
Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=65536, part_size=483852812288, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 2 3 58825 24 15 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
file_pread(5,2,buffer,945027200(58825/56/48)) lseek err Invalid argument
file_pread(5,1,buffer,945027200(58825/56/48)) lseek err Invalid argument
*********************
file_pread(5,1,buffer,945025985(58825/37/30)) lseek err Invalid argument
file_pread(5,1,buffer,945026006(58825/37/51)) lseek err Invalid argument
file_pread(5,1,buffer,945026056(58825/38/38)) lseek err Invalid argument
file_pread(5,1,buffer,945027969(58825/68/61)) lseek err Invalid argument

Results
P NTFS 0 2 3 58825 24 15 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB


dir_partition inode=5
P NTFS 0 2 3 58825 24 15 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
Directory /
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 .
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 ..
35 dr-xr-xr-x 0 0 0 10-Jun-2013 10:07 $Recycle.Bin
*****************************
641 dr-xr-xr-x 0 0 0 24-Apr-2015 16:42 Windows


interface_write()
P NTFS 0 2 3 58825 24 15 945025024

Write isn't available because the partition table type "None" has been selected.
Partition table type default to Intel
Disk /dev/sdc - 483 GB / 450 GiB
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=65536, part_size=483852812288, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 128 945025151 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
file_pread(5,2,buffer,945027200(58825/56/48)) lseek err Invalid argument
file_pread(5,1,buffer,945027200(58825/56/48)) lseek err Invalid argument
file_pread(5,2,buffer,945027201(58825/56/49)) lseek err Invalid argument
file_pread(5,1,buffer,945027203(58825/56/51)) lseek err Invalid argument
file_pread(5,1,buffer,945027204(58825/56/52)) lseek err Invalid argument
file_pread(5,1,buffer,945027205(58825/56/53)) lseek err Invalid argument
file_pread(5,1,buffer,945027206(58825/56/54)) lseek err Invalid argument
file_pread(5,1,buffer,945027207(58825/56/55)) lseek err Invalid argument
******************************
file_pread(5,8,buffer,945025998(58825/37/43)) lseek err Invalid argument
file_pread(5,11,buffer,945026045(58825/38/27)) lseek err Invalid argument
file_pread(5,1,buffer,945027968(58825/68/60)) lseek err Invalid argument
file_pread(5,7,buffer,945025921(58825/36/29)) lseek err Invalid argument
file_pread(5,8,buffer,945025928(58825/36/36)) lseek err Invalid argument
file_pread(5,1,buffer,945025938(58825/36/46)) lseek err Invalid argument
file_pread(5,1,buffer,945025985(58825/37/30)) lseek err Invalid argument
file_pread(5,1,buffer,945026006(58825/37/51)) lseek err Invalid argument
file_pread(5,1,buffer,945026056(58825/38/38)) lseek err Invalid argument
file_pread(5,1,buffer,945027969(58825/68/61)) lseek err Invalid argument

Results
P MS Data 128 945025151 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB


dir_partition inode=5
P MS Data 128 945025151 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
Directory /
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 .
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 ..
35 dr-xr-xr-x 0 0 0 10-Jun-2013 10:07 $Recycle.Bin
****************************
641 dr-xr-xr-x 0 0 0 24-Apr-2015 16:42 Windows

interface_write()
1 P MS Data 128 945025151 945025024
simulate write!

TestDisk exited normally.

chrispret
Posts: 3
Joined: 09 Feb 2016, 20:18

Re: Deleted VHD partition

#4 Post by chrispret »

So I grew impatient (since no-one replied), copied the VDH to a new location and just wrote the 'EFI GPT' partition to the disk.

Everything seems ok, I guess this thread is dead :)

Locked