trying to recover deleted and reformatted FAT32 partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
tincognito
Posts: 2
Joined: 02 Mar 2016, 10:09

trying to recover deleted and reformatted FAT32 partition

#1 Post by tincognito »

I had an external 1TB USB3.0/eSATA hard drive with a NTFS partition of almost all of the hard drive and a smaller FAT32 partition that I forget how big it was, but probably 20-30GB. I ran a utility that repartitioned and reformatted my drive without warning. I think I've managed to recover everything from the NTFS partition and copy it to another drive. But I get an error that says "The following partition can't be recovered" when I try to deep scan for the FAT32 partition. I had mostly Macintosh files on it, probably mostly in Stuff-it .SIT format, and some .toast images as well. I'm not sure how to proceed now, and I don't want to mess anything up. And once I recover the files from the FAT32 partition, I'd like to try and restore the lost partitions on the same drive, if possible. I've included screenshots of some of the screens and the text from the log file.
testdisk1.png
testdisk1.png (11.39 KiB) Viewed 1973 times
testdisk2.png
testdisk2.png (11.79 KiB) Viewed 1973 times
testdisk3.png
testdisk3.png (14.31 KiB) Viewed 1973 times

Code: Select all


Wed Mar  2 01:20:01 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=960197124096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=960197124096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104264105984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1843243008
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=855338123264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=524271222784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=475915091968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=1895504543744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=104857600000
Hard disk list
Disk /dev/sda - 960 GB / 894 GiB - CHS 116737 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdd - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 104 GB / 97 GiB - CHS 12676 255 63, sector size=512
Drive D: - 1843 MB / 1757 MiB - CHS 439 64 32, sector size=2048
Drive G: - 855 GB / 796 GiB - CHS 103988 255 63, sector size=512
Drive I: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive T: - 524 GB / 488 GiB - CHS 63739 255 63, sector size=512
Drive U: - 475 GB / 443 GiB - CHS 57860 255 63, sector size=512
Drive Y: - 1895 GB / 1765 GiB - CHS 230448 255 63, sector size=512
Drive Z: - 104 GB / 97 GiB - CHS 12748 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 4177/117/37
filesystem size           1886408704
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               117900543
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS           4177 117 37 121600 247 55 1886408704
     NTFS, blocksize=4096, 965 GB / 899 GiB
BAD_RS LBA=3052784328 2274753
file_pread(6,3,buffer,3052784328(190027/9/7)) lseek err Invalid argument
file_pread(6,1,buffer,3052784328(190027/9/7)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
     FAT16 <32M           190027   9  7 273415 196 31 1339640026
This partition ends after the disk limits. (start=3052784328, size=1339640026, end=4392424353, disk end=1953525168)
NTFS at 121600/247/55
filesystem size           1886408704
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               117900543
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS           4177 117 37 121600 247 55 1886408704
     NTFS found using backup sector, blocksize=4096, 965 GB / 899 GiB
NTFS at 121601/25/24
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2248 GB / 2094 GiB)
The following partition can't be recovered:
     FAT16 <32M           190027   9  7 273415 196 31 1339640026

Results
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
     HPFS - NTFS           4177 117 37 121600 247 55 1886408704
     NTFS, blocksize=4096, 965 GB / 899 GiB
SIGHUP detected! TestDisk has been killed.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: trying to recover deleted and reformatted FAT32 partitio

#2 Post by cgrenier »

The FAT16 is listed as 2TB, an impossible value for a FAT16. It's a false positive.
No trace of a FAT32 has been found.
The NTFS found by TestDisk use the whole disk, there is no place for a 20/30GB FAT32.

So I wonder if there rally was a FAT32 on this disk.
The disk utility you had used may have overwritten all traces...

tincognito
Posts: 2
Joined: 02 Mar 2016, 10:09

Re: trying to recover deleted and reformatted FAT32 partitio

#3 Post by tincognito »

cgrenier wrote:The FAT16 is listed as 2TB, an impossible value for a FAT16. It's a false positive.
No trace of a FAT32 has been found.
The NTFS found by TestDisk use the whole disk, there is no place for a 20/30GB FAT32.

So I wonder if there rally was a FAT32 on this disk.
The disk utility you had used may have overwritten all traces...
Is there anything else I can do to solve this? There was definitely a second partition. I'm almost positive it was FAT32 because I wanted it to be compatible with a wide range of operating systems. The partition size couldn't have been more than 50GB. I think I've managed to recover everything from the NTFS partition, so I'm okay with being drastic in recovery of whatever was on the FAT32 partition.

Also, I see a lot of Zone.Identifier files from my NTFS recovery. Are those safe to delete? I read to run error checking, but it didn't find anything.

I was also wondering if there was a way to check if any files are corrupted? I haven't found any problems yet opening random files, but it's not a reliable method.

sSiysu
Posts: 3
Joined: 27 Aug 2016, 04:14

Re: trying to recover deleted and reformatted FAT32 partition

#4 Post by sSiysu »

I also need to know if Zone.Identifier files from NTFS recovery are safe to delete??
Do files with Zone.Identifier extension mean they are corrupt or not??

Please can anyone clarify this?

Locked