Thanks for the response!
Sorry I should have been more specific. I'm not actually on Windows I'm using Linux (debian 8). I installed testdisk from the debian repositories. This is the version info:
Code: Select all
$ testdisk -v
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Version: 6.14
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
I'm not entirely sure how I should answer the question of whether it is an existing partition. My situation is as follows: I have a drive that accidentally partially wiped. But I'm lucky because I actually did not care about the first (larger) partion(s) which were NTFS partitions that had nothing useful on them. However, the first extended partition has data from a Linux installation that I would like to access. So roughly I had a situation like this (I remember because I looked at it a few times with fdisk before screwing stuff up):
Code: Select all
sda1 Primary NTFS
sda2 Primary NTFS <--- Not sure if there were two but I think so. Also maybe both weren't NTFS
sda3 Logical Partition
sda5 Extended Partition <--- This one I care about
sda6 Swap
I know that the dd command killed all the partitions before the Logical Partition, but I'm essentially totally sure it did not make it to the extended partitions. Basically what I want to do is to get the exact location of the start of the extended partition as an LBA address if possible. I think that as long as I could find the exact beginning of the Logical partition housing the rest, I'd be okay by just looking at the specs of how these things are setup. (By the way, I presume there is a way for me to directly access the sda5 partition using testdisk, but I'm actually a little curious to do some of this stuff by hand...especially since I won't be editing the drive anyway...well ignore the dding of course.
Here's the log. I appended a couple analyze runs because I was confused about how the program worked. The first time it found information about the extended partitions and the second time it seemed to find info on the NTFS partitions as well:
Code: Select all
Wed Jan 1 13:13:37 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
recover_EXT2: s_block_group_nr=0/523, s_mnt_count=366/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 17151488
recover_EXT2: part_size 137211904
Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
Linux Swap 38530 178 49 38913 69 52 6146032
SWAP2 version 1, pagesize=4096, 3146 MB / 3000 MiB
Results
* Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
P Linux Swap 38530 178 49 38913 70 5 6146048
SWAP2 version 1, pagesize=4096, 3146 MB / 3001 MiB
interface_write()
1 * Linux 29989 134 34 38530 146 16 137211904
2 P Linux Swap 38530 178 49 38913 70 5 6146048
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
New options :
Dump : No
Align partition: Yes
Expert mode : No
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 29989/102/1
filesystem size 481572864
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 29989 102 1 481572864
NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB
recover_EXT2: s_block_group_nr=0/523, s_mnt_count=366/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 17151488
recover_EXT2: part_size 137211904
Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
Linux Swap 38530 178 49 38913 69 52 6146032
SWAP2 version 1, pagesize=4096, 3146 MB / 3000 MiB
Results
* HPFS - NTFS 12 223 20 29989 102 1 481572864
NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB
P Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
P Linux Swap 38530 178 49 38913 70 5 6146048
SWAP2 version 1, pagesize=4096, 3146 MB / 3001 MiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 12 190 51 29989 102 1 481574912
2 P Linux 29989 134 34 38530 146 16 137211904
3 P Linux Swap 38530 178 49 38913 70 5 6146048
5 L HPFS - NTFS 12 223 20 29989 102 1 481572864
add_ext_part_i386: max
interface_write()
1 E extended LBA 0 32 33 29989 102 1 481777664
2 P Linux 29989 134 34 38530 146 16 137211904
3 P Linux Swap 38530 178 49 38913 70 5 6146048
5 L HPFS - NTFS 12 223 20 29989 102 1 481572864
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/32/33,lba=2048
TestDisk exited normally.
Wed Jan 1 15:06:00 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
TestDisk exited normally.
Wed Jan 1 15:06:03 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Wed Jan 1 15:17:55 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
TestDisk exited normally.
Wed Jan 1 15:17:57 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
TestDisk exited normally.
Wed Jan 1 15:26:58 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
TestDisk exited normally.
Wed Jan 1 15:27:00 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Interface Advanced
New options :
Dump : No
Align partition: Yes
Expert mode : No
TestDisk exited normally.
Thanks again!