Can I rescue my files using Testdisk?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Subhuti
Posts: 2
Joined: 18 Feb 2018, 17:02

Can you help me recover my files?

#1 Post by Subhuti »

Hello!


My WIndows 7 stopped being able to boot some days ago. I got a blue screen. Then it started System Recovery, but it said it couldn't help me.

I tried booting from a small Linux called Puppy, and I could still see all the files on my disk, so it seemed they were okay.

I was going to get a new harddrive, and ckean install Windows 7 or 10. But I was so upset about all the work which lay ahead of me, that I wanted to see if loading a Windows 7 installation disk could help me. I got my hands on one, and when it booted, it had the option "repair my computer." I was elated at the prospect of having it fixed in one easy step. But I couldn't get it to recognize my OS. I said to find some drivers for my harddisks, and I tried, but couldn't get it to work.

Bottom line: some time later, I wanted to get some files off my harddrive, but I couldn't see it anymore in Linux!

So I booted from a disk which had some recovery tools on, including a partion viewer, and It could see my disk, but said "Partition: unallocated. Filesystem: unallocated."!

I was shocked. But the recovery disk had a note, which said to run the prompt and run Testdisk. So I tried that. That's how I learned of the program.

But I am so scared to do anything wrong now. I just want to get as many files as possible off the harddrive and onto other media, before I dare try and edit anything in the settings. Is that possible? I saw under the "analyse" function, that there is a "copy" function. But I didn't know how to access any of my USB drives, so I don't know whether it works or not. I don't know my way around linux.


When I run Testdisk, and it says to select my media, I select the ST3000DM001, my Seagate 3 TB Barracuda. Then it says to "select the partition table type".

It has pre-selected "EFI GPT". But I don't know what that means.

All I know, is that when my friend once reinstalled Windows 7 on this machine before he gave it to me, he said he had made a mistake, which meant that I could only use 2000 GB of the 3000 GB on the drive. I don't know what that means. But I think it means he didn't select GPT and selected MBR instead - is that right?

I don't think he partitioned it to be 2000 GB. Rather, apparently it only used the 2000 GB of the 3000 GB partition. I don't know?

when I go with the EFI GPT option, it finds two partitions, I guess?

MS Data 2048 206847 204800 (system reserved)
MS Data 206848 4294967295 4294760448

And then it proceeds to slowly work itself through analysing the cylinders. It might take an hour at this speed. Should I let it continue, or does this mean it has found the original partitions?

When I choose "stop", I am able to press "p" to see files. I can see the directory structure of my lost disk, as well as the files. Most look like I remember them, but in my folders with lots of large video-files, many seem to have various numbers of duplicates of same date, name, attributes, but of size 0. What does this mean? Have they been damaged?

OKay, back to the partition table types. When I select Intel/PC, I get the following:

HPFS - NTFS 0 32 33 12 223 19 204800 (system reserved)
HPFS - NTFS 12 223 20 267349 89 4 429476044833

I don't know which is correct, the EFI GPT or the Intel/PC?

When I tried searching for my Seagate harddisk on Google, it said it had 4096 bytes per sector ("emulated 512"), 63 sectors/track, 16 heads, and 16383 cylinders. But when I entered those numbers into Testdisk, it came up with a very small size harddisk. Should I trust the numbers which Testdisk found on its own?

Does the fact that I can see all the directories and files mean that all the numbers Testdisk has used are correct?

What do you think I should do? I am petrified about doing anything. My "plan" is to buy a new harddrive, install Windows 7, and then install Testdisk for windows, and try to copy as many files as is possible from the damaged harddrive to the new one, or an external harddrive.

Is that what I should do? Should I use another tool than Testdisk for copying the files?

So sorry for rambling like this. So much has happened over the last days, I am just exhausted and totally confused.

I have backed up a lot of my things, because I have experienced harddrive problems before. But I haven't had the energy to back up everything, and I guess I am paying the price for that now. But it really is a lot to lose, if I can't get the files off this drive. It'll be like a year of my life, just gone!


Thank you,

Isak Lytting

Subhuti
Posts: 2
Joined: 18 Feb 2018, 17:02

Can I rescue my files using Testdisk?

#2 Post by Subhuti »

Hello!

I tried looking at some of the tutorials on this site, but it all seems so complex, and I am literally petrified about doing anything more to the drive which I might later learn was a mistake, and then it'll be too late.

Can someone please help me find out what the problem with my drive is? In the tutorial, it mentions the many different examples of problems one can have: Either the boot sector has been damaged, or a partition has been deleted, or the Master File Table is corrupt, and something called MBR can be wrong, and probably many other things...

Is there any way I can tell what the problem is in my case?

The "Analyse"-option says there are no partitions, but when I choose "quick search", it immediately finds two partitions. A small, "system reserved", and a large one. Is this enough? Has it found what it needs, or should I let quick search finish? And once it is finished, should I also run "deeper search"? How will I know when or if it has found what it needs to find?

For instance, I can see from the tutorial, that there is a backup of the boot sector or something like that near the end of an NTFS partition. Is this necessary to find or can I save the drive without it? And how will I know whether or not Testdisk has found the backup copy it needs?

In the step-by-step tutorials, it is shown how to correct the partition table, the boot sector, etc. Do I need to do all of the things shown in the tutorial, or should I only write the partition table, and see if the drive then works? Can I then come back later and try to find the backup boot-sector, etc., or do I have to do it all at the same time?



When I choose "Intel" as partition type instead of "EFI GPT", it lists the first ("system reserved") partition as "*", and says that means "bootable/primary". The second partition is listed as "P" for primary.

When I choose "EFI GPT" as partition type, both are also listed as "P", primary, but neither are listed as bootable.

Surely, this must mean that the "intel" type is the correct one, doesn't it? But Testdisk had selected the "EFI GPT" option as default. Does this mean I should be worried about other default settings as well? For example, it selected "CHS 364801 255 63" for my drive. But when I looked up my drive on the internet, it said it had 16383 cylinders, 16 heads and 63 sectors/track. Does this indicate that there could arise a problem if I were to try to use Testdisk to salvage my drive?



I am truly sorry if I am rambling. I am just really in the dark here, and I am so dreading losing so much of my work from the past year.

I finally got the testdisk.log out of the linux boot, by emailing it to myself through a web-service for anonymous emailing. I wanted to attach it as a file to this message, but it says it has the wrong file-extension. So I will just paste it here:


------------------------------------------------------------------------------------------------------------------------------

Fri Sep 29 17:13:51 2017
Command line: TestDisk


TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER
http://www.cgsecurity.org
OS: Linux, kernel 2.6.37-slitaz (#4 SMP Fri Feb 1 18:58:10 UTC 2013) i686
Compiler: GCC 4.5
Compilation date: 2012-10-28T22:29:23
ext2fs lib: 1.41.14, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 5860533168 sectors
/dev/sda: user_max 5860533168 sectors
/dev/sda: native_max 5860533168 sectors
/dev/sda: dco 5860533168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Warning: can't get size for Disk /dev/md0 - 0 B - CHS 1 2 4, sector size=512
/dev/sr0 is not an ATA disk
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-9YN166, S/N:W1F15HXG, FW:CC4B
Disk /dev/sr0 - 125 MB / 119 MiB - 61038 sectors (RO), sector size=2048 - PLDS DVD+/-RW DH-16AAS, S/N:CN0H344R550819A8432U, FW:JD12


Partition table type default to EFI GPT
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM001-9YN166
Partition table type: Intel


Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Current partition structure:
No partition is bootable


search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 4294760448
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 267349 89 4 4294760448
NTFS, blocksize=4096, 2198 GB / 2047 GiB
Search for partition aborted


Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 267349 89 4 4294760448
NTFS, blocksize=4096, 2198 GB / 2047 GiB


interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 267349 89 4 4294760448
simulate write!


write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition


TestDisk exited normally.

------------------------------------------------------------------------------------------------------------------------------

I don't know why it begins by saying the date in 2017! I just ran it a few minutes ago. Well...

I really hope someone would like to help me...

Thank you.


Isak Lytting

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Can I rescue my files using Testdisk?

#3 Post by cgrenier »

Looks like all your partitions have been deleted.
- Set the date/time of your computer
- Read https://www.cgsecurity.org/testdisk.pdf chapter "Recovering deleted partition using TestDisk". You are in this case.
- Use testdisk 7.0 or 7.1-WIP
- Run TestDisk, choose EFI GPT instead of PC Intel.
- When testdisk find several partitions, try to list them using 'p'.
- Once all your partitions are listed, write Write, confirm, Quit

Locked