Converting CHS to LBA Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ApproximateIdentity
Posts: 3
Joined: 11 May 2017, 19:22

Converting CHS to LBA

#1 Post by ApproximateIdentity »

I used testdisk's analyze to find that I have a partition that starts at 29989 134 34 and ends at 38530 146 16 and a size of 137211904 blocks. I'm trying to convert the start and stop to LBA values. I've tried using the conversion at:

https://en.wikipedia.org/wiki/Logical_b ... conversion

i.e. this equation: LBA = (C × HPC + H) × SPT + (S - 1)

I tried the values of HPC = 16 and SPT = 63 (as the page says is "typical"), but that would imply that the extent of the partition (i.e. space between start and stop) is 8610066 instead of 137211904 blocks. Obviously I'm doing something wrong.

How is it that these values get turned into LBA values? Maybe my constants for HPC/SPT are wrong? Or maybe the equation doesn't apply at all to my drive? Is there a way to get testdisk to just list those values directly instead of CHS?

Thanks for any help.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Converting CHS to LBA

#2 Post by cgrenier »

Please post the testdisk.log file.
If it's an existing partition, you use "testdisk_win.exe -lu" to get the values.

ApproximateIdentity
Posts: 3
Joined: 11 May 2017, 19:22

Re: Converting CHS to LBA

#3 Post by ApproximateIdentity »

Thanks for the response!

Sorry I should have been more specific. I'm not actually on Windows I'm using Linux (debian 8). I installed testdisk from the debian repositories. This is the version info:

Code: Select all

$ testdisk -v
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Version: 6.14
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
I'm not entirely sure how I should answer the question of whether it is an existing partition. My situation is as follows: I have a drive that accidentally partially wiped. But I'm lucky because I actually did not care about the first (larger) partion(s) which were NTFS partitions that had nothing useful on them. However, the first extended partition has data from a Linux installation that I would like to access. So roughly I had a situation like this (I remember because I looked at it a few times with fdisk before screwing stuff up):

Code: Select all

sda1 Primary NTFS 
sda2 Primary NTFS <--- Not sure if there were two but I think so. Also maybe both weren't NTFS
sda3 Logical Partition
sda5 Extended Partition <--- This one I care about
sda6 Swap
I know that the dd command killed all the partitions before the Logical Partition, but I'm essentially totally sure it did not make it to the extended partitions. Basically what I want to do is to get the exact location of the start of the extended partition as an LBA address if possible. I think that as long as I could find the exact beginning of the Logical partition housing the rest, I'd be okay by just looking at the specs of how these things are setup. (By the way, I presume there is a way for me to directly access the sda5 partition using testdisk, but I'm actually a little curious to do some of this stuff by hand...especially since I won't be editing the drive anyway...well ignore the dding of course.

Here's the log. I appended a couple analyze runs because I was confused about how the program worked. The first time it found information about the extended partitions and the second time it seemed to find info on the NTFS partitions as well:

Code: Select all



Wed Jan  1 13:13:37 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco        625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP

Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63

recover_EXT2: s_block_group_nr=0/523, s_mnt_count=366/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 17151488
recover_EXT2: part_size 137211904
     Linux                29989 134 34 38530 146 16  137211904
     ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
     Linux Swap           38530 178 49 38913  69 52    6146032
     SWAP2 version 1, pagesize=4096, 3146 MB / 3000 MiB

Results
   * Linux                29989 134 34 38530 146 16  137211904
     ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
   P Linux Swap           38530 178 49 38913  70  5    6146048
     SWAP2 version 1, pagesize=4096, 3146 MB / 3001 MiB

interface_write()
 1 * Linux                29989 134 34 38530 146 16  137211904
 2 P Linux Swap           38530 178 49 38913  70  5    6146048

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 29989/102/1
filesystem size           481572864
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 29989 102  1  481572864
     NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB

recover_EXT2: s_block_group_nr=0/523, s_mnt_count=366/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 17151488
recover_EXT2: part_size 137211904
     Linux                29989 134 34 38530 146 16  137211904
     ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
     Linux Swap           38530 178 49 38913  69 52    6146032
     SWAP2 version 1, pagesize=4096, 3146 MB / 3000 MiB

Results
   * HPFS - NTFS             12 223 20 29989 102  1  481572864
     NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB
   P Linux                29989 134 34 38530 146 16  137211904
     ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
   P Linux Swap           38530 178 49 38913  70  5    6146048
     SWAP2 version 1, pagesize=4096, 3146 MB / 3001 MiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA            12 190 51 29989 102  1  481574912
 2 P Linux                29989 134 34 38530 146 16  137211904
 3 P Linux Swap           38530 178 49 38913  70  5    6146048
 5 L HPFS - NTFS             12 223 20 29989 102  1  481572864
add_ext_part_i386: max

interface_write()
 1 E extended LBA             0  32 33 29989 102  1  481777664
 2 P Linux                29989 134 34 38530 146 16  137211904
 3 P Linux Swap           38530 178 49 38913  70  5    6146048
 5 L HPFS - NTFS             12 223 20 29989 102  1  481572864
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/32/33,lba=2048

TestDisk exited normally.


Wed Jan  1 15:06:00 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list


TestDisk exited normally.


Wed Jan  1 15:06:03 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco        625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP

Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.


Wed Jan  1 15:17:55 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list


TestDisk exited normally.


Wed Jan  1 15:17:57 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco        625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP

Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel

TestDisk exited normally.


Wed Jan  1 15:26:58 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list


TestDisk exited normally.


Wed Jan  1 15:27:00 2003
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco        625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP

Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

TestDisk exited normally.
Thanks again!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Converting CHS to LBA

#4 Post by cgrenier »

Use testdisk 7.1-WIP instead of this old version. Read https://www.cgsecurity.org/testdisk.pdf if necessary on how to install it.
Why didn't you let TestDisk rewrote the partition table with the partitions found ?

ApproximateIdentity
Posts: 3
Joined: 11 May 2017, 19:22

Re: Converting CHS to LBA

#5 Post by ApproximateIdentity »

Thanks so much for the help! Apparently I had the information I needed all along and it was listed in the original log.

Code: Select all

Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
I didn't realize that I needed to use 255 as my HPC value in the equation I posted. Once I used that value instead of 16, everything worked fine. I ended up using that offset to just mount the partition directly and everything worked perfectly.

So as to why I did it this way instead of using the program directly...mainly just to make things hard for myself. I got curious as to the partition data structures themselves and wanted to understand what was going on. (In fact, originally I was about to write a little program to scan the drive for the byte signatures for the ext4 file system, but then I saw your software and decided to try it out...)

In any case, thanks so much for the software! I'm going to recover the data the intelligent way now (i.e. letting testdisk do it for me) so that I get a bit of experience with that in case I do something stupid like prematurely dd a drive again in the future. Thanks for all the help!

edit: Alright it was trivially easy to get things running again usting testdisk the right way. I'm happy I went through the exercise to understand things a little more, but I'll definitely use testdisk itself in the future. Thanks so much for the great software!

Locked