Partition sector doesn't have the endmark 0xAA55

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ricardo100671
Posts: 1
Joined: 25 Sep 2016, 22:31

Partition sector doesn't have the endmark 0xAA55

#1 Post by ricardo100671 »

Can anyone please advise if, and how, my disk may be recoverable. Seems Mac Os has written an EFI partition to it and now cannot read read in windows.
Any help would be much appreciated.

Thank you

Code: Select all

Sat Sep 24 08:53:20 2016
Command line: TestDisk
Sat Sep 24 08:53:20 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=395999969280
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=103248101376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=999860912128
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 395 GB / 368 GiB - CHS 48144 255 63, sector size=512
Drive E: - 103 GB / 96 GiB - CHS 12552 255 63, sector size=512
Drive F: - 999 GB / 931 GiB - CHS 121559 255 63, sector size=512

Partition table type default to None
Drive F: - 999 GB / 931 GiB
Partition table type: Intel

Analyse Drive F: - 999 GB / 931 GiB - CHS 121559 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Drive F: - 999 GB / 931 GiB - CHS 121559 255 63
NTFS at 92894/1/1
filesystem size           929224704
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          92894   1  1 150735 144 30  929224704
     NTFS, blocksize=4096, 475 GB / 443 GiB
This partition ends after the disk limits. (start=1492342173, size=929224704, end=2421566876, disk end=1952853344)
Drive F: - 999 GB / 931 GiB - CHS 121559 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (999 GB / 931 GiB) seems too small! (< 1239 GB / 1154 GiB)
The following partition can't be recovered:
     HPFS - NTFS          92894   1  1 150735 144 30  929224704
     NTFS, blocksize=4096, 475 GB / 443 GiB
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Partition sector doesn't have the endmark 0xAA55

#2 Post by cgrenier »

It's useless to search partitions inside the partition F:.
Run TestDisk, select /dev/sdb, Advanced, select the NTFS partition, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit, restart your computer.
If it doesn't work, please post the testdisk.log file content.
Top
Locked

Return to “Partition Recovery”