Page 1 of 1

They were there, then they weren't

Posted: 14 Nov 2016, 00:53
by MacDuff
Ran the analyze feature and 3 partitions showed up. The info looked accurate (I'm working on someone else's drive) Had the Dell part, Recovery, and System partitions all in RAW fs. I changed the Dell to DE per instructions then ran the deep scan. The scan came back with nothing at all. I ran analyze again and I have a tiny partition and nothing else.

Did I miss something? Am I hosed and the drive is now toast? Any help would be greatly appreciated.

Re: They were there, then they weren't

Posted: 14 Nov 2016, 07:39
by cgrenier
If you do not write the new partition table, changing the partition type is useless.
Can you post the testdisk.log file content ?

Re: They were there, then they weren't continued

Posted: 14 Nov 2016, 14:39
by MacDuff
Thanks for the reply Christophe, If I knew where it was I could. I'm running off the TRK USB stick. The last thing I saw was "log file corrupt". It's not looking good is it?
When it showed the partitions I did write down the CHS values for all three listed. I guess I should have stopped while I was ahead. Don't want to make any moves to avoid any further loss or damage.

Re: They were there, then they weren't

Posted: 16 Nov 2016, 20:40
by cgrenier
If you can't provide the log file, try to post screenshots...

Re: They were there, then they weren't

Posted: 22 Nov 2016, 06:17
by MacDuff
Christophe, I was able to finally get a log file. Also have the backup file. Does getting the I/O error indicate a head or control board issue or am I just missing something still? Thanks for your input and the work you have put into this project.

Backup:
#1479660884 Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63
1 : start= 63, size= 80262, Id=DE, P
2 : start= 81920, size= 30720000, Id=07, P
3 : start= 30801920, size=945969200, Id=07, *

I also have the start and end points written down from one of the screens I got early on. If that is needed I can put it together on here.

TestDisk:Mon Nov 21 19:56:07 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP2
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=74932300800
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=15728640000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=484336230400
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9726 255 63, sector size=512 - Maxtor 6Y080M0, S/N:325934313258434d202020202020202020202020, FW:YAR51HW0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500620AS, FW:DE13

Partition table type defaults to Intel
Disk /dev/sdb - 500 GB / 465 GiB - ST3500620AS
Partition table type: Intel

Interface Advanced

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:

Partition: Read error

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
file_pread(5,16,buffer,32(0/0/33)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,3,buffer,48(0/0/49)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,3,buffer,95(0/1/33)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,8,buffer,111(0/1/49)) ReadFile The request could not be performed because of an I/O device error.

* Truncated to keep post small

Re: They were there, then they weren't

Posted: 27 Nov 2016, 10:21
by cgrenier
The disk is correctly identified but all read operations failed, it's probably a damaged head. You will have to contact a data recovery company.