Weird partition fragments in the Analyze List, zero partitions found after deep search

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
solomon3
Posts: 1
Joined: 16 May 2016, 12:15

Weird partition fragments in the Analyze List, zero partitions found after deep search

#1 Post by solomon3 »

I try to recover a dying 400 GB Drive. It refused to boot into its windows, later also created weird behaviour in the BIOS boot process, hanging up the system there, when attached) It has two partitions on it. I cloned it with ddrescue (sysrecCD) to a freshly formated 500 GB Drive. Some read errors, but the rest of unrecoverable Data size was only around 1 MB. The clone has than been connected to a recoverysystem internally as a SATA slave.

Boot into Windows of Recovery Host System.

The First recovered Partition [G] (an old Win XP bootable Partition size 20 GB ) appears as RAW in DataStorageManagement of Windows 7. It appears in the "Computer" Secton, but is not accessible. The second recovered Partition [H] is shown as "100% functional" and is shown in "Computer" section and is 100% nicely accesible (It was a 20 GB storage PArtition, non bootable')

When entering analyze menu subpoint in testdisk, it shows:

[Screenshot1] for the first partition [G] in INTEL MODE (not searched yet)
-after Search and Deepsearch, the list just stays EMPTY, no partitions found.

[Screenshot2] for the second partition [H] in INTEL MODE (not searched yet)
-after Search and Deepsearch, the list just stays EMPTY, no partitions found.


One Partition [H] is working, but both show the same weird Partition List in the beginning of ANALYZE Menu ? And no results after Searches? How is that possible..

So I Quick Searched the First Partition [G] in ANALYZE MENU but this time NONE MODE

[Screenshot3] show what happened during the search

[Screenshot4] And after it

I can now access the File List of first Partition [G] , looks good. But how can i restore the MBR or Partition Files now, in order to make that partition work in Windows and maybe make it even bootable again? It says the NTFS backup is alive, so this should be possible, right? But all the write tools don`t work in NONE MODE right?

One more thought, who created those little weird partitions, maybe a virus of some sort?
I would appreciate help and thx for the great programme

-solomon3
Attachments
Screenshot3
Screenshot3
Screenshot3.PNG (10.62 KiB) Viewed 985 times
Screenshot2
Screenshot2
Screenshot2.PNG (10.87 KiB) Viewed 985 times
Schrrenshot1
Schrrenshot1
Screenshot1.PNG (10.97 KiB) Viewed 985 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Weird partition fragments in the Analyze List, zero partitions found after deep search

#2 Post by cgrenier »

Why are you searching partitions inside partition ? It's useless.

Run TestDisk, select the physicaldisk, Advanced, for each partition, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit.

Locked