Errors/Warnings Galore: # of heads, cylinders, sectors per track, bad start sector, seems too small!

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
gramdalf
Posts: 2
Joined: 03 Aug 2016, 21:01

Errors/Warnings Galore: # of heads, cylinders, sectors per track, bad start sector, seems too small!

#1 Post by gramdalf »

Hi there,

I have been reading a lot of cases of lost partitions and attempted recoveries on testdisk and searching for explanations, but keep getting lost, and I'm pretty sure I haven't found what I need anywhere.

I have a 2TB external drive. I had it working well in 2 partitions: 1 NTFS and 1 Mac OS extended journaled (I'm pretty sure was the format). I think I had near 1 TB data on the NTFS and 550-600 GB data on the Mac OSext. partition.
I used a windows computer program to create a 3rd partition to store a mac time machine image. My intention was to not use it for long this way and return to 2 partitions as before. But I have not gotten there. My Mac OS extended partition seemed to be gone. It won't mount on any computer, and is not visible in diskutility or other programs.

I believe my problem was caused by the program I used to take the empty space from the original 2 partitions. However, I'm not totally sure. It is possible to have happened while using the 3rd partition (~240GB) to save and restore a time machine image onto an iMac.

Either way I have spent a few solid days now trying to figure out how to use testdisk to get my macos extended partition back. It seems to still be there. The instructions I find and follow always seem to differ at some point from what I'm seeing/getting on testdisk. At one point I did about a 4 day deep search scan of the drive on one computer. I have done a 1 day scan on another computer.
This was result in terminal, and I had no idea what to do and could not find answer anywhere:
partition scan.png
partition scan.png (254.84 KiB) Viewed 1649 times

I feel like this was a waste of time if I want to recover partition table though? I'm not sure what that means, I am pretty scared by many of the possible commands I can select in testdisk. I feel like I am only understanding fragments of the problem or solution at a time and thus could easily make a detrimental mistake.

When I open testdisk this is what I see following what I understand to be the basic process I am supposed to be going through:

Here are some links to screenshots from what I get going through typical process in testdisk:

https://drive.google.com/open?id=0B269l ... ERvc01qenc
https://drive.google.com/open?id=0B269l ... 2dNM2w3eFk
https://drive.google.com/open?id=0B269l ... 0xtOHQzLUU



Here are the links to the log files:

1st computer I used to deep search (4 days, full disk) log:
https://drive.google.com/open?id=0B269l ... klwWGNXOVk

2nd computer I used to deep search (28hrs ish, only the partition I suspect is the one I want (~600 GB) log:



I have a feeling I can restore the partition as a whole, if I can understand how. If not, I am confident I could get the files and save them, but again, haven't understood the instructions I have managed to find to do this. I'm at wit's end.
At one point I followed a guide to use photorec, and it didn't get me anywhere. I am pretty sure I have to in order to do file recovery since I read that testdisk is not the tool for it on a mac os extended? Photorec doesn't seem to run with root though and none of the disks show up. Unlike testdisk it does not give me option to run sudo.



Can anyone explain to me what is going on, please?
Attachments
photorec wont work.png
photorec wont work.png (155.66 KiB) Viewed 1649 times
can I use testdisk for mac os extended, assuming no.png
can I use testdisk for mac os extended, assuming no.png (72.14 KiB) Viewed 1649 times
Last edited by gramdalf on 05 Aug 2016, 15:14, edited 2 times in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Errors/Warnings Galore: # of heads, cylinders, sectors per track, bad start sector, seems too small!

#2 Post by cgrenier »

It seems the device disconnects after the deeper search. It may be caused by bad sectors.
You should clone the disk to a new empty one using ddrescue. Once it's done, remove the original disk and try to recover your data from the clone.

gramdalf
Posts: 2
Joined: 03 Aug 2016, 21:01

Re: Errors/Warnings Galore: # of heads, cylinders, sectors per track, bad start sector, seems too small!

#3 Post by gramdalf »

cgrenier wrote:It seems the device disconnects after the deeper search. It may be caused by bad sectors.
You should clone the disk to a new empty one using ddrescue. Once it's done, remove the original disk and try to recover your data from the clone.

Why do you say it disconnects after the deeper search? Was this by looking at the log files? I believe it did disconnect by being bumped while I was running the 4 day test (i got notifications on the desktop saying it was ejected), but the test seemed to continue anyways and I did not think it was a problem. If you are saying it was, maybe I am better running the full deeper search again. I'd rather do that than go through buying another drive, clone AND then continue trying this...

It's strange because the first time, using my macbook, I was able to run a deeper search on full drive... but following typical process now on the imac does not give me that option. I check now, and I AM able to see the full disk and deeper search it while on macbook after the quick search analysis:

on imac
quick search results imac.png
quick search results imac.png (141.08 KiB) Viewed 1633 times
on macbook
quick search on macbook shows 4.png
quick search on macbook shows 4.png (59.85 KiB) Viewed 1633 times
The highlighted partition is the one I am trying to recover... its the most important one actually. I care so much less about the other two, and the smallest, the 3rd one I made, is worthless.

Locked