cgsecurity.org

Hello,

I need help to recover an important folder. Windows 7 was reinstalled on my laptop and OS partition formatted. I need to recover a MySql data folder from the old windows installation.

I followed this steps to recover the old OS partition

1. Started quick search and only actual partitions are showed. After that I selected a deep search trying to find the old partition.



2. After a time, deep search testdisk found the partition that probably I want and and error with fat boot sector.


3. Waiting until the deep search is completed a message "hard disk seems to small and FAT12 partition can't be recovered"


When I press enter to continue, the partition that I want disappear.
How to solve this problem I think message about disk too small is for the bad boot sector showed.

please I need help, the most important folder that I want to recover is the database from a mysql folder in the old windows installation.
thanks

You can safely ignore the FAT12.
With the first 2 NTFS partitions, use 'p' to list the files. Do you see your old files ?

Hello crrenier,

When I press enter to continue, partitions that I want to recover disappear. Only actual partions of my harddisk are shown.

The log file says that partitions it was found using backup sector. I don't know why it disappear when I press enter.



this is the logfile:

Mon Nov 13 09:13:01 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.4.0-53-generic (#74-Ubuntu SMP Fri Dec 2 15:59:10 UTC 2016) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63, sector size=512 - VMware, VMware Virtual S, FW:1.0
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ASMT 2105

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - ASMT 2105
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 24320/69/6
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 24320 69 5 390498304
3 P HPFS - NTFS 24320 69 6 121601 25 24 1562816512

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 390498304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
NTFS at 24320/69/6
filesystem size 1562816512
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
P HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sdb 2048" | dmsetup create test0
echo "0 390498304 linear /dev/sdb 206848" | dmsetup create test1
echo "0 1562816512 linear /dev/sdb 390705152" | dmsetup create test2

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 390498304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
NTFS at 24320/69/5
filesystem size 390498304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS found using backup sector, blocksize=4096, 199 GB / 186 GiB
NTFS at 24320/69/6
filesystem size 1562816512
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB
BAD_RS LBA=2684462347 10280596
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 167100 13 29 256881 29 12 1442332757
This partition ends after the disk limits. (start=2684462347, size=1442332757, end=4126795103, disk end=1953525168)
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2112 GB / 1967 GiB)
The following partition can't be recovered:
FAT12 167100 13 29 256881 29 12 1442332757

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
P HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sdb 2048" | dmsetup create test0
echo "0 390498304 linear /dev/sdb 206848" | dmsetup create test1
echo "0 1562816512 linear /dev/sdb 390705152" | dmsetup create test2
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


I hope you can help, thanks