Data partition formatted to mbr

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
maxlamenace75
Posts: 3
Joined: 09 Oct 2016, 20:59

Data partition formatted to mbr

#1 Post by maxlamenace75 »

Hi Guys,

Not sure posting in the right place, so plz let me know in case.
I wanted to create a bootable USB key to test kali-linux from Ubuntu 16.04 (In french in the second part of this tuto:http://fr.docs.kali.org/installation-fr ... ux-sur-usb)

I used the dd command but did not correctly specified the path to the usb stick (MEA CULPA)

I typed

dd if=kali.iso of=/dev/sdb bs=512k

As a result, my 500go DD used as Data was somehow formated to :
/dev/sdb1 : HPFS / NTFS cachée (Amorçable) : 2.9Go
/dev/sdb2 : FAT12 : FAT (version 16 bit) — Monté sur /media/z...e/Kali Live : 93 MB
/dev/sdb : not allocated (about 497 Go)


ran a testdisk and had following:

As u can imagine, with such a newbie mystake, it makes no sense for me.

Any help welcome

Thank you

Sun Oct 9 20:13:32 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.4.0-41-generic (#61-Ubuntu SMP Tue Sep 27 17:30:08 UTC 2016) i686
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 976773168 sectors
/dev/sdb: user_max 976773168 sectors
/dev/sdb: native_max 976773168 sectors
/dev/sdb: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKX-001CA0, S/N:WD-WCAYU7639641, FW:15.01H15
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500630A, S/N:9QG21A8F, FW:3.AAE

Partition table type (auto): None
Disk /dev/sdb - 500 GB / 465 GiB - ST3500630A
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=170 sector=32
BAD_RS LBA=64 126
check_part_i386 failed for partition type 17
BAD_RS LBA=5570560 16445173
FAT16 at 346/191/38
Info: size boot_sector 182336, partition 182336
FAT1 : 1-180
FAT2 : 181-360
start_rootdir : 361
Data : 393-182332
sectors : 182336
cluster_size : 4
no_of_cluster : 45485 (2 - 45486)
fat_length 180 calculated 178
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
Current partition structure:
Invalid NTFS or EXFAT boot
1 * hid. HPFS/NTFS 0 1 2 346 191 37 5570496
1 * hid. HPFS/NTFS 0 1 2 346 191 37 5570496

Bad relative sector.
Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
2 P FAT12 346 191 38 358 25 51 182336 [NO NAME]

Bad relative sector.

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 346/191/38
FAT1 : 1-180
FAT2 : 181-360
start_rootdir : 361
Data : 393-182332
sectors : 182336
cluster_size : 4
no_of_cluster : 45485 (2 - 45486)
fat_length 180 calculated 178
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT16 at 346/191/38
FAT16 >32M 346 191 38 358 25 51 182336 [NO NAME]
FAT16, blocksize=2048, 93 MB / 89 MiB
file_pread(5,16,buffer,525006864(32680/42/19)) read err: Partial read
NTFS at 60800/254/63
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 60800 254 63 121601 253 62 976768002
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976768002, end=1953536065, disk end=976773168)
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60800 254 63 121601 253 62 976768002
NTFS, blocksize=4096, 500 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 1 1 60800 254 63 976768002
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
FAT16 >32M 346 191 38 358 57 19 184320 [NO NAME]
FAT16, blocksize=2048, 94 MB / 90 MiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 976768002 linear /dev/sdb 63" | dmsetup create test0
echo "0 184320 linear /dev/sdb 5570560" | dmsetup create test1

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 346/191/38
FAT1 : 1-180
FAT2 : 181-360
start_rootdir : 361
Data : 393-182332
sectors : 182336
cluster_size : 4
no_of_cluster : 45485 (2 - 45486)
fat_length 180 calculated 178
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT16 at 346/191/38
FAT16 >32M 346 191 38 358 25 51 182336 [NO NAME]
FAT16, blocksize=2048, 93 MB / 89 MiB
NTFS at 60800/254/63
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 60800 254 63 121601 253 62 976768002
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976768002, end=1953536065, disk end=976773168)
Search for partition aborted
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60800 254 63 121601 253 62 976768002
NTFS, blocksize=4096, 500 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 0 1 1 60800 254 63 976768002
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
FAT16 >32M 346 191 38 358 57 19 184320 [NO NAME]
FAT16, blocksize=2048, 94 MB / 90 MiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 976768002 linear /dev/sdb 63" | dmsetup create test0
echo "0 184320 linear /dev/sdb 5570560" | dmsetup create test1

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

merci

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Data partition formatted to mbr

#2 Post by cgrenier »

If you had a single NTFS partition, use the arrow keys to switch the NTFS partition to *(bootable). On next screen, choose Write, confirm, BackupBS, confirm, Quit and restart your computer.

maxlamenace75
Posts: 3
Joined: 09 Oct 2016, 20:59

Re: Data partition formatted to mbr

#3 Post by maxlamenace75 »

Thank you

my DD reappeared in nautilus.
however, here is what happens when clicking on it:

Error mounting system-managed device /dev/sdb1: Command-line `mount "/mnt/D0C80CC1C80CA7B4"' exited with non-zero exit status 13: ntfs_mst_post_read_fixup_warn: magic: 0x371fc018 size: 4096 usa_ofs: 28544 usa_count: 32815: Argument invalide
Actual VCN (0x641f0f4fcdcf00) of index buffer is different from expected VCN (0x5).
Failed to mount '/dev/sdb1': Erreur d'entrée/sortie
NTFS is either inconsistent, or there is a hardware fault, or it's a
SoftRAID/FakeRAID hardware. In the first case run chkdsk /f on Windows
then reboot into Windows twice. The usage of the /f parameter is very
important! If the device is a SoftRAID/FakeRAID then first activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documentation
for more details.

maxlamenace75
Posts: 3
Joined: 09 Oct 2016, 20:59

Re: Data partition formatted to mbr

#4 Post by maxlamenace75 »

I kept searching and here is what I have

sudo ntfsfix /dev/sdb1
Mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0x371fc018 size: 4096 usa_ofs: 28544 usa_count: 32815: Invalid argument
Actual VCN (0x641f0f4fcdcf00) of index buffer is different from expected VCN (0x5).
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
ntfs_mst_post_read_fixup_warn: magic: 0x371fc018 size: 4096 usa_ofs: 28544 usa_count: 32815: Invalid argument
Actual VCN (0x641f0f4fcdcf00) of index buffer is different from expected VCN (0x5).
Remount failed: Input/output error

Any help welcome....

Thx

Locked