Testdisk not finding some partitions Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
rknichols
Posts: 2
Joined: 17 Aug 2016, 15:46

Testdisk not finding some partitions

#1 Post by rknichols »

This is a test case, not an actual recovery situation. I have a 500GB disk drive that contains an ext4 filesystem at LBA 383896264 and an NTFS filesystem at LBA 829761856.

Code: Select all

# losetup -f --show --offset $((383896264*512)) --sizelimit $((264334264*512)) /dev/sde
/dev/loop0
losetup: /dev/sde: warning: file does not fit into a 512-byte sector the end of the file will be ignored.
# file -s /dev/loop0
/dev/loop0: Linux rev 1.0 ext4 filesystem data (extents) (large files) (huge files)
# fsck -n -f /dev/loop0
fsck from util-linux-ng 2.17.2
e2fsck 1.41.12 (17-May-2010)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
part9: 11/8265728 files (0.0% non-contiguous), 566775/33041783 blocks
# losetup -d /dev/loop0
# losetup -f --show --offset $((829761856*512)) --sizelimit $((146800640*512)) /dev/sde
/dev/loop0
losetup: /dev/sde: warning: file does not fit into a 512-byte sector the end of the file will be ignored.
# file -s /dev/loop0
/dev/loop0: x86 boot sector; partition 1: ID=0x72, starthead 13, startsector 1920221984, 1816210284 sectors, code offset 0x52, OEM-ID "NTFS    ", sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads 255, hidden sectors 829761856, dos < 4.0 BootSector (0x80)
# mount -r /dev/loop0 /mnt/tmp
# ls /mnt/tmp
$GetCurrent                     Boot                    Program Files              Users         rescuepe.log
$Recycle.Bin                    DRIVERS                 Program Files (x86)        Windows       swapfile.sys
$WINRE_BACKUP_PARTITION.MARKER  Documents and Settings  ProgramData                bootmgr
BOOTNXT                         Logs                    Recovery                   hiberfil.sys
BOOTSECT.BAK                    PerfLogs                System Volume Information  pagefile.sys
# umount /mnt/tmp
# losetup -d /dev/loop0
For purposes of testing, the MBR and primary partition table have been zeroed. Testdisk 7.0 fails to find either of these partitions. Here is the log

Code: Select all

/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       976773168 sectors
/dev/sde: user_max   976773168 sectors
/dev/sde: native_max 976773168 sectors
/dev/sde: dco        976773168 sectors
Using locale 'LC_CTYPE=en_US.UTF-8;LC_NUMERIC=en_US.UTF-8;LC_TIME=en_US.UTF-8;LC_COLLATE=C;LC_MONETARY=en_US.UTF-8;LC_MESSAGES=en_US.UTF-8;LC_PAPER=en_US.UTF-8;LC_NAME=en_US.UTF-8;LC_ADDRESS=en_US.UTF-8;LC_TELEPHONE=en_US.UTF-8;LC_MEASUREMENT=en_US.UTF-8;LC_IDENTIFICATION=en_US.UTF-8'.


Wed Aug 17 10:19:19 2016
Command line: TestDisk /log /debug /dev/sde

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-642.3.1.el6.x86_64 (#1 SMP Tue Jul 12 18:30:56 UTC 2016) x86_64
Compiler: GCC 4.4
Compilation date: 2015-04-18T13:05:16
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
Hard disk list
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS545050B9A300, S/N:090331PB4400Q7GGTVRA, FW:PB4OC60G

Partition table type default to Intel
Disk /dev/sde - 500 GB / 465 GiB - Hitachi HTS545050B9A300
Partition table type: Intel

Analyse Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Why can't testdisk find these? When I tell people, "If there is a filesystem there, testdisk should find it," I'd like to have some confidence that this is true.

If I make up a geometry that puts these filesystems on "cylinder" boundaries, then testdisk does see them. But when there were other, similarly "misaligned" filesystems on the drive, testdisk had no trouble finding those. What is different about these? I've tried both with and without the "Align partition" option set -- no difference.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Testdisk not finding some partitions

#2 Post by cgrenier »

TestDisk doesn't read all sectors (except for partition type None), it searches at cylinder boundary or 1-MB boundary.
Top
rknichols
Posts: 2
Joined: 17 Aug 2016, 15:46

Re: Testdisk not finding some partitions

#3 Post by rknichols »

OK, thanks for the clarification. I would have expected the "Align partition: no" option to accomplish that, too. Apparently not. Does that option actually do anything?
Top
Locked

Return to “Partition Recovery”