Unable to Recover Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Veee
Posts: 1
Joined: 11 Apr 2018, 09:38

Unable to Recover Partition

#1 Post by Veee »

I was trying to delete an old partition on my secondary hard drive(used to have windows 7 on it) System Reserved of 100MB but instead deleted the volume. The whole drive became unallocated and the photos, videos, and programs I had on the second partition were gone. I tried running testdisk to recover the partitions however even though it detected both partitions after a quick search. Testdisk had the second partition listed as "the following partitions can't be recovered". I wrote the first partition because they didn't intersect hoping to solve my problem and ran quick search again. It still wouldn't let me recover the partition. It also says the size is too small which I think is the problem. I ran photorec for a few minutes to see if it could pull photos from it and alas it did. I at least have a backup plan in case it doesn't work out but I would still like to recover the partition nonetheless. I am currently running a deep search but below is the log from the quick search and write. I am running windows 10 on the SSD where I am running test disk on.

Code: Select all



Wed Apr 11 00:09:54 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, March 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=209986061312
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:xxxxxxxxxxxxxxx, FW:EXT0DB6Q
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1002FAEX-00Z3A0, S/N:xxxxxxxxxxxxxxxx, FW:05.01D05

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD1002FAEX-00Z3A0
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=224 sector=19
NTFS at 0/32/33
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [System Reserved]
     NTFS, blocksize=4096, 104 MB / 100 MiB

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=224 sector=19
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [System Reserved]

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800 [System Reserved]
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 121613 183 42 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=206848, size=1953517568, end=1953724415, disk end=1953525168)
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
     HPFS - NTFS             12 223 20 121613 183 42 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   * HPFS - NTFS              0  32 33    12 223 19     204800 [System Reserved]
     NTFS, blocksize=4096, 104 MB / 100 MiB

interface_write()
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [System Reserved]
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Unable to Recover Partition

#2 Post by cgrenier »

Run TestDisk. In Geometry, set the number of cylinders to 121614, Analyze, Quick Search. If both partition are listed, set the first as D(eleted), the second as P(rimary).
On next screen, choose Write, confirm, Quit and restart your computer.
You should be able to access your data.
Note that the partition is too big for the disk. After a backup, try to resize the partition using gparted or a similar disk utility.
Top
Locked

Return to “Partition Recovery”