Please help me recover a partition. "Disk Too Small!"

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Mark01
Posts: 3
Joined: 03 Jun 2012, 18:17

Please help me recover a partition. "Disk Too Small!"

#1 Post by Mark01 »

Today for no reason at all, a message appeared on my computer, telling me that "the disk is not formatted"
Image

And guess what, the drive affected was my archive which was full of very important data.

I've tried running testdisk but it says that my partition can't be recovered (there was only one, called "Private"), and something about the disk being too small or something. I honestly have no clue what this means.

Please, help me recover this partition.

Here is my log file, I have no idea what any of that means, so please, please help me, I tried all day to restore this drive but so far I restored nothing.
  • Sun Jun 3 16:23:16 2012
    Command line: TestDisk

    TestDisk 6.14-WIP, Data Recovery Utility, May 2012
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    OS: Windows 7 (7601) SP1
    Compiler: GCC 4.6, Cygwin 1007.9
    Compilation date: 2012-05-21T08:46:51
    ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500105740288
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=500107829760
    filewin32_getfilesize(\\.\E:) GetFileSize err Funzione non corretta.

    filewin32_setfilepointer(\\.\E:) SetFilePointer err Funzione non corretta.

    Warning: can't get size for \\.\E:
    Hard disk list
    Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5001AALS-00LWTA0, S/N:2020202057202d444d5759413050353036363230, FW:01.01S01
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-00A7B0, S/N:2020202057202d444d5753413759303234333331, FW:01.03B01

    Partition table type (auto): Intel
    Disk /dev/sdb - 500 GB / 465 GiB - WDC WD5000AAKS-00A7B0
    Partition table type: Intel

    Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Geometry from i386 MBR: head=255 sector=63


    test_FAT()
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105
    sector_size 0
    cluster_size 0
    reserved 0
    fats 0
    dir_entries 0
    sectors 0
    media 00
    fat_length 0
    secs_track 0
    heads 0
    hidden 0
    total_sect 0
    check_part_i386 failed for partition type 0C
    get_geometry_from_list_part_aux head=255 nbr=1
    get_geometry_from_list_part_aux head=8 nbr=2
    get_geometry_from_list_part_aux head=16 nbr=2
    get_geometry_from_list_part_aux head=32 nbr=1
    get_geometry_from_list_part_aux head=64 nbr=1
    get_geometry_from_list_part_aux head=128 nbr=1
    get_geometry_from_list_part_aux head=240 nbr=1
    get_geometry_from_list_part_aux head=255 nbr=1
    Current partition structure:
    Invalid FAT boot sector
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105

    Bad sector count.
    Backup partition structure
    partition_save
    Ask the user for vista mode
    search_vista_part: 1

    search_part()
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Search for partition aborted

    Results

    interface_write()

    No partition found or selected for recovery
    simulate write!

    write_mbr_i386: starting...
    write_all_log_i386: starting...
    No extended partition

    Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Geometry from i386 MBR: head=255 sector=63


    test_FAT()
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105
    sector_size 0
    cluster_size 0
    reserved 0
    fats 0
    dir_entries 0
    sectors 0
    media 00
    fat_length 0
    secs_track 0
    heads 0
    hidden 0
    total_sect 0
    check_part_i386 failed for partition type 0C
    get_geometry_from_list_part_aux head=255 nbr=1
    get_geometry_from_list_part_aux head=8 nbr=2
    get_geometry_from_list_part_aux head=16 nbr=2
    get_geometry_from_list_part_aux head=32 nbr=1
    get_geometry_from_list_part_aux head=64 nbr=1
    get_geometry_from_list_part_aux head=128 nbr=1
    get_geometry_from_list_part_aux head=240 nbr=1
    get_geometry_from_list_part_aux head=255 nbr=1
    Current partition structure:
    Invalid FAT boot sector
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105

    Bad sector count.
    Ask the user for vista mode
    search_vista_part: 1

    search_part()
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    NTFS at 12748/86/11
    filesystem size 976766976
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 48248063
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
    NTFS, blocksize=4096, 500 GB / 465 GiB
    This partition ends after the disk limits. (start=204802048, size=976766976, end=1181569023, disk end=976773168)
    file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
    file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
    file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
    file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
    file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
    file_pread(5,6,buffer,976775170(60801/112/50)) lseek err Invalid argument
    file_pread(5,8,buffer,976775176(60801/112/56)) lseek err Invalid argument
    file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
    file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
    file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
    file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
    file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Check the harddisk size: HD jumpers settings, BIOS detection...
    The harddisk (500 GB / 465 GiB) seems too small! (< 604 GB / 563 GiB)
    The following partition can't be recovered:
    HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
    NTFS, blocksize=4096, 500 GB / 465 GiB

    Results

    interface_write()

    No partition found or selected for recovery
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/Output error.
    Failed to startup volume: Input/Output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/Output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/Output error.
    Failed to startup volume: Input/Output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/Output error.

    search_part()
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    NTFS at 12748/53/41
    filesystem size 976766976
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 48248063
    clusters_per_mft_record -10
    clusters_per_index_record 1
    NTFS part_offset=104857599488, part_size=500104691712, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 12748/86/10
    filesystem size 204800000
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 2
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 0 32 33 12748 86 10 204800000
    NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
    NTFS at 12748/86/11
    filesystem size 976766976
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 48248063
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
    NTFS, blocksize=4096, 500 GB / 465 GiB
    This partition ends after the disk limits. (start=204802048, size=976766976, end=1181569023, disk end=976773168)
    Search for partition aborted
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Check the harddisk size: HD jumpers settings, BIOS detection...
    The harddisk (500 GB / 465 GiB) seems too small! (< 604 GB / 563 GiB)
    The following partition can't be recovered:
    HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
    NTFS, blocksize=4096, 500 GB / 465 GiB

    Results
    * HPFS - NTFS 0 32 33 12748 86 10 204800000
    NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
    Not an exFAT boot sector.

    P HPFS - NTFS 0 32 33 12748 86 10 204800000
    NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
    Can't open filesystem. Filesystem seems damaged.

    interface_write()
    1 P HPFS - NTFS 0 32 33 12748 86 10 204800000
    Don't write, no confirmation

    Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Geometry from i386 MBR: head=255 sector=63


    test_FAT()
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105
    sector_size 0
    cluster_size 0
    reserved 0
    fats 0
    dir_entries 0
    sectors 0
    media 00
    fat_length 0
    secs_track 0
    heads 0
    hidden 0
    total_sect 0
    check_part_i386 failed for partition type 0C
    get_geometry_from_list_part_aux head=255 nbr=1
    get_geometry_from_list_part_aux head=8 nbr=2
    get_geometry_from_list_part_aux head=16 nbr=2
    get_geometry_from_list_part_aux head=32 nbr=1
    get_geometry_from_list_part_aux head=64 nbr=1
    get_geometry_from_list_part_aux head=128 nbr=1
    get_geometry_from_list_part_aux head=240 nbr=1
    get_geometry_from_list_part_aux head=255 nbr=1
    Current partition structure:
    Invalid FAT boot sector
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105
    1 * FAT32 LBA 0 1 1 60801 80 63 976773105

    Bad sector count.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Please help me recover a partition. "Disk Too Small!"

#2 Post by remy »

There's now a FAT32 partition. Did you accept to format the disk ?
If yes, what was the previous filesystem ? FAT32 or NTFS ?

Mark01
Posts: 3
Joined: 03 Jun 2012, 18:17

Re: Please help me recover a partition. "Disk Too Small!"

#3 Post by Mark01 »

remy wrote:There's now a FAT32 partition. Did you accept to format the disk ?
If yes, what was the previous filesystem ? FAT32 or NTFS ?
No, I didn't accept to format the disk. The error appeared suddenly while I was using the computer normally. I'm 100% sure when I turned on the computer it was still fine (I have my desktop folder on that drive, when I started the computer all my icons and desktop stuff was there, when the error appeared all my stuff on the desktop disappeared). The disk was NTFS, I think it was a dynamic disk as I merged two partitions that were on it some time ago into a single one called private, but honestly, I don't remember. Anyway, under "my computer", the disk appeared as a single partition of 500Gb in NTFS.

What could have happened? And is there any way to recover it?

I tried PhotoRec but it recovers without filenames and this is a big problem, because the disk was almost full (had about 50Gb free out of 500) and it would require days of sorting to put it back the way it was before.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Please help me recover a partition. "Disk Too Small!"

#4 Post by Fiona »

Today for no reason at all, a message appeared on my computer, telling me that "the disk is not formatted"
Your case looks a kind of weird.
Reason is, you have an unformatted FAT32-partition in your partition table and your NTFS-Partition labeled as Private is displaced and starts about a quarter after the beginning of the disk and ends beyond the disk limit.
In your case, you should have a try to increase the amount of your disk/Cylinder like in these cases and have a try to list your data;
http://forum.cgsecurity.org/phpBB3/post ... icky#p1093
http://forum.cgsecurity.org/phpBB3/post ... icky#p2334
Would it be possible to diagnose your disk exactly like in the first case.
The amount/value of your cylinders is different and should be 73550.
If you still have any question, please let me know.

Fiona

Mark01
Posts: 3
Joined: 03 Jun 2012, 18:17

Re: Please help me recover a partition. "Disk Too Small!"

#5 Post by Mark01 »

YES! After changing the number of cylinders I was able to see my data and then it recovered succesfully.

I am so freaking happy!

Anyway, I think I did something wrong at some point, because now I have my old Private partition which is intact and has no corrupted files as far as I can tell, but instead of showing up as D:, it now shows up as F: along with a "ghost" D: drive in "my computer", which is raw. I have no idea where that other D comes from because the Private partition is there and just like it was before with only about 50Gb free out of 500.

Not a big problem, it's probably just a misconfiguration that I caused while I was freaking out when the catastrophe happened. I succesfully managed to reassign the letter D to Private and now everything is back the way it was before.

Thank you very much Fiona and Remy for the support you offered me.

If I may make a last request, I'd like to know more about how you figured out how many cylinders the drive should have had. If you don't mind, explain it to me or link me to an article that explains it. Seems like useful knowledge to have.

Thanks againg for solving my problem. You have my eternal gratitude.

I still have no idea how my partition disappeared to begin with, I'm 100% sure I did nothing partition related when it happened. Oh well.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Please help me recover a partition. "Disk Too Small!"

#6 Post by remy »

You have my eternal gratitude.
Thanks, it's more than all the money on earth. Event when making half/half with Fiona ;)


For Cylinders :
Your disk has a geometry, for example X Cylinders (C), 255 heads by cylinder (H), 63 sector by head. (S)
LBA size is :
C*H*S-1=C*255*63-1
Size of your disk is then LBA*sector size (512 most of time, sometimes 4096)

If you have the size of your disk eiuither in bytes or in LBA, you can define the number of cylinder.

There, it's just a sum with the place wher the partition should begin and the size it should have. But you are lying to your computer (and to testdisk also) : you can't do a 800GB disk with one that is 500GB.... That's just a way to recover data with dynamic disks, wher filesystem begin sometimes... after the end.

Hope that was clear enough, if not, contact me by PM : I close the thread and mark it as solved :)

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Please help me recover a partition. "Disk Too Small!"

#7 Post by remy »

Thread reoppened after mail received :
Hi, thanks for explaining me how to figure out those parameters and all, it was very clear and after reading up on what heads, cylinders, etc were, I think I fully understood it.

Anyway, I found a small problem with my drive. I would have added this to my thread but I see you have locked it.

My problem is that some of my files are damaged and cannot be opened under windows. I'd say about 10% of all my files are like that, it's not a big problem as most of those were unimportant files but still, it's bothering me, because I get this error if I try to copy the files to another drive (pic from google)

http://nerd.steveferson.com/wp-content/ ... -error.png

Also, I have that weird "ghost" partition that appeared as a consequence of me messing around blindly in testdisk while panicking (pic from my drive):

http://imageshack.us/photo/my-images/265/catturaeb.png/

I don't know exactly why that partition appeared, but I think it shouldn't exist and that it might be the cause of the corrupted files on my drive.

If you can help me on removing that weird partition and maybe recovering those corrupted files too, I'd appreciate it.

Thanks in advance.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Please help me recover a partition. "Disk Too Small!"

#8 Post by remy »

I'm sorry, but :
1/ The first pic seems to have a broken link. I'm not sure, but corruption may come from writtings on the disk while your first tries.
2/ I have no idea how to manage partition under windows, even more when dynamic disks are involved. In my opinion, if recovery is finished, the easiest is to copy data somewhere else and to reformat a clean volume on your disk. This will also defragment your data and provide better efficiency.

Locked