trying to recover deleted and reformatted FAT32 partition
Posted: 02 Mar 2016, 10:41
I had an external 1TB USB3.0/eSATA hard drive with a NTFS partition of almost all of the hard drive and a smaller FAT32 partition that I forget how big it was, but probably 20-30GB. I ran a utility that repartitioned and reformatted my drive without warning. I think I've managed to recover everything from the NTFS partition and copy it to another drive. But I get an error that says "The following partition can't be recovered" when I try to deep scan for the FAT32 partition. I had mostly Macintosh files on it, probably mostly in Stuff-it .SIT format, and some .toast images as well. I'm not sure how to proceed now, and I don't want to mess anything up. And once I recover the files from the FAT32 partition, I'd like to try and restore the lost partitions on the same drive, if possible. I've included screenshots of some of the screens and the text from the log file.
Code: Select all
Wed Mar 2 01:20:01 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=960197124096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=960197124096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104264105984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1843243008
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=855338123264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=524271222784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=475915091968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=1895504543744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=104857600000
Hard disk list
Disk /dev/sda - 960 GB / 894 GiB - CHS 116737 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdd - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 104 GB / 97 GiB - CHS 12676 255 63, sector size=512
Drive D: - 1843 MB / 1757 MiB - CHS 439 64 32, sector size=2048
Drive G: - 855 GB / 796 GiB - CHS 103988 255 63, sector size=512
Drive I: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive T: - 524 GB / 488 GiB - CHS 63739 255 63, sector size=512
Drive U: - 475 GB / 443 GiB - CHS 57860 255 63, sector size=512
Drive Y: - 1895 GB / 1765 GiB - CHS 230448 255 63, sector size=512
Drive Z: - 104 GB / 97 GiB - CHS 12748 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: Intel
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 4177/117/37
filesystem size 1886408704
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 117900543
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4177 117 37 121600 247 55 1886408704
NTFS, blocksize=4096, 965 GB / 899 GiB
BAD_RS LBA=3052784328 2274753
file_pread(6,3,buffer,3052784328(190027/9/7)) lseek err Invalid argument
file_pread(6,1,buffer,3052784328(190027/9/7)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 190027 9 7 273415 196 31 1339640026
This partition ends after the disk limits. (start=3052784328, size=1339640026, end=4392424353, disk end=1953525168)
NTFS at 121600/247/55
filesystem size 1886408704
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 117900543
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4177 117 37 121600 247 55 1886408704
NTFS found using backup sector, blocksize=4096, 965 GB / 899 GiB
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2248 GB / 2094 GiB)
The following partition can't be recovered:
FAT16 <32M 190027 9 7 273415 196 31 1339640026
Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 4177 117 37 121600 247 55 1886408704
NTFS, blocksize=4096, 965 GB / 899 GiB
SIGHUP detected! TestDisk has been killed.