Recovering NTFS Partition from (partly?) quick-formatted drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
shiz0
Posts: 4
Joined: 17 Sep 2016, 08:05

Recovering NTFS Partition from (partly?) quick-formatted drive

#1 Post by shiz0 »

Hi.
I dont know if this should be in here, or in FS recovery. Apologies if so:

I have here a 1TB disk a friend gave to me. It was his data drive.
He accidentally quick-formatted the wrong disk. :roll:
As soon as he got aware of his error he killed the pc. :roll:

Now the disk is detected as follows:

Code: Select all

# lsblk -o NAME,FSTYPE,SIZE,MODEL
NAME   FSTYPE            SIZE MODEL
[...]
sdi                    931.5G Hitachi HDS72101
└─sdi1                 931.5G

Code: Select all

# fdisk -l /dev/sdi
Disk /dev/sdi: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x7f99d2ff

Device     Boot Start        End    Sectors   Size Id Type
/dev/sdi1        2048 1953521663 1953519616 931.5G  7 HPFS/NTFS/exFAT
In Testdisk, the Drive and also the Partition seems to be detected okay:

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332

Please select the partition table type, press Enter when done.
>[Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

Hint: Intel partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332
     CHS 121601 255 63 - sector size=512

>[ Analyse  ] Analyse current partition structure and search for lost partitions
 [ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ MBR Code ] Write TestDisk MBR code to first sector
 [ Delete   ] Delete all data in the partition table
 [ Quit     ] Return to disk selection

Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.
In "Analyze":

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
No partition is bootable
In "Advanced":

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63

     Partition                  Start        End    Size in sectors
> 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
Trying to list the files fails with error "Filesystem seems damaged".
So first, I go with quick search, and the deeper search, but it only detects some FAT32 Partition with wrong size and says the disk is too small.
The I can only go back to the menu. Going for "Advanced" in Boot Repair it says both boot sectors are bad. Trying to rebuild them fails.
Am I missing something?
I just started the process over from the beginning to get a clean log file.
I will append it here, as soon as its finished (will take some hours ofc).

Any help appreciated.
Thank you.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

#2 Post by cgrenier »

In Advanced, try Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.
If it doesn't please post the testdisk.log file content.
Top
shiz0
Posts: 4
Joined: 17 Sep 2016, 08:05

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

#3 Post by shiz0 »

During Scans (normal, as well as deep) it outputs:

Code: Select all

Invalid FAT boot sector
 0 D FAT32 LBA            36883 158 33 279707 107 49 3900964364
  FAT32 LBA            36883 158 33 279707 107 49 3900964364
Normal scan finished:

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63

The harddisk (1000 GB / 931 GiB) seems too small! (< 2300 GB / 2142 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  FAT32 LBA            36883 158 33 279707 107 49 3900964364


[ Continue ]
1997 GB / 1860 GiB

I will try rebuilding the BS right after the currently running deep scan is finished.
That again will take some hours scanning all the sectors :arrow:
I will report back to you and post the log file after it's all done.
Thank you!
Top
shiz0
Posts: 4
Joined: 17 Sep 2016, 08:05

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

#4 Post by shiz0 »

Unfortunately, after trying to rebuild BS, they are still listed as bad.
Listing files is still not possible:
"Can't open filesystem. Filesystem seems damaged."

In the log there are MFTs found, but "read_mft_info failed".
Here's the log:

Code: Select all

$ cat testdisk.log


Sat Sep 17 09:16:02 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.7.3-2-ARCH (#1 SMP PREEMPT Thu Sep 8 09:44:02 CEST 2016) x86_64
Compiler: GCC 5.3
Compilation date: 2016-03-21T14:32:26
ext2fs lib: 1.43.3, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.0
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48 support
/dev/sdc: size       117231408 sectors
/dev/sdc: user_max   117231408 sectors
/dev/sdc: native_max 117231408 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       488397168 sectors
/dev/sdd: user_max   488397168 sectors
/dev/sdd: native_max 488397168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       488397168 sectors
/dev/sde: user_max   488397168 sectors
/dev/sde: native_max 488397168 sectors
/dev/sdf: LBA, HPA, LBA48, DCO support
/dev/sdf: size       1953525168 sectors
/dev/sdf: user_max   1953525168 sectors
/dev/sdf: native_max 1953525168 sectors
/dev/sdg: LBA, HPA, LBA48, DCO support
/dev/sdg: size       1953525168 sectors
/dev/sdg: user_max   1953525168 sectors
/dev/sdg: native_max 1953525168 sectors
/dev/sdh: LBA, HPA, LBA48, DCO support
/dev/sdh: size       1953516911 sectors
/dev/sdh: user_max   1953516911 sectors
/dev/sdh: native_max 1953525168 sectors
/dev/sdi: LBA, HPA, LBA48, DCO support
/dev/sdi: size       1953525168 sectors
/dev/sdi: user_max   1953525168 sectors
/dev/sdi: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 2002 MB / 1910 MiB - CHS 1017 62 62, sector size=512 - Verbatim STORE N GO, FW:5.00
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - OCZ-REVODRIVE, S/N:OCZ-YWPB40YH4GR9643F, FW:1.37
Disk /dev/sdc - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - OCZ-REVODRIVE, S/N:OCZ-0KG9274T2008N1L9, FW:1.37
Disk /dev/sdd - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:S1DBNSBD904354F,
FW:EXT0CB6Q
Disk /dev/sde - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:S1DBNSBF121198K,
FW:EXT0BB6Q
Disk /dev/sdf - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103UJ, S/N:S13PJ1KS802869, FW:1AA011
18
Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103UJ, S/N:S13PJ1KS802870, FW:1AA011
18
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - SAMSUNG HD103SJ, S/N:S246J9CZA11375, FW:1AJ100
01
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDS721010CLA332, S/N:JP9960HZ2NGAAU, F
W:JP4OA3MA

Partition table type (auto): Intel
Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332
Partition table type: Intel
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
Partition table type (auto): Intel
Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616

Analyse Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
No partition is bootable

search_part()
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=592535381 98990
check_part_i386 failed for partition type 0C
     FAT32 LBA            36883 158 33 279707 107 49 3900964364
This partition ends after the disk limits. (start=592535381, size=3900964364, end=4493499744, disk end=1953525168)
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2300 GB / 2142 GiB)
The following partition can't be recovered:
     FAT32 LBA            36883 158 33 279707 107 49 3900964364

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=592535381 98990
check_part_i386 failed for partition type 0C
     FAT32 LBA            36883 158 33 279707 107 49 3900964364
This partition ends after the disk limits. (start=592535381, size=3900964364, end=4493499744, disk end=1953525168)
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2300 GB / 2142 GiB)
The following partition can't be recovered:
     FAT32 LBA            36883 158 33 279707 107 49 3900964364

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
filesystem size           16831425191078376410
sectors_per_cluster       0
mft_lcn                   87998667047671
mftmirr_lcn               11844738985903526868
clusters_per_mft_record   -1
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 582190978
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

mft at 582194082
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

mft at 1088141718
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

mft at 1088144822
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

Potential partition:
 1 P HPFS - NTFS          36239 181 31 157840 174 22 1953519616
 1 P HPFS - NTFS          67733 175 39 189334 168 30 1953519616
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
filesystem size           16831425191078376410
sectors_per_cluster       0
mft_lcn                   87998667047671
mftmirr_lcn               11844738985903526868
clusters_per_mft_record   -1
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS signature is missing.
NTFS signature is missing.
Not an exFAT boot sector.

 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
Can't open filesystem. Filesystem seems damaged.

TestDisk exited normally.
I noticed:

Code: Select all

sectors_per_cluster       0
[...]
clusters_per_mft_record   -1
clusters_per_index_record 0
and

Code: Select all

ntfs_find_mft: sectors_per_cluster invalid
Seems to me like the clusters are messed up, is there anything I can do about that?
Thank you.
Top
shiz0
Posts: 4
Joined: 17 Sep 2016, 08:05

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

#5 Post by shiz0 »

Anyone?
Any ideas greatly appreciated. :-)
Top
Locked

Return to “Partition Recovery”