Partition and Filesystem Recovery - Uncertain

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Kherae
Posts: 3
Joined: 26 May 2018, 22:18

Partition and Filesystem Recovery - Uncertain

#1 Post by Kherae »

Hello, I'm kinda new to this stuff. I'm trying to do two things: partition recovery and filesystem recovery. I'm trying to recover my as much of my disk as possible after a system crash rendered the thing useless; one of the partitions that went splat was where windows booted from.
Then, when looking at diskpart, which was listing everything fine, my panicking self ran `clear`. So...now I'm running linux mint off a USB drive, trying to make sense of testdisk's output.
Haven't overwritten anything yet, as I'm trying to figure out what to do and how to get my data back. I'm a dummy who forgot to make backups.
Anywho, here's where I'm at so far:

testdisk screen:
Screenshot from 2018-05-25 22-47-03.png
Screenshot from 2018-05-25 22-47-03.png (67.91 KiB) Viewed 2022 times
I tried to view files for the last of the HPFS - NTFS partitions, as that's where all my stuff is, but the filesystem is damaged

log:

Code: Select all

Fri May 25 12:18:16 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-38-generic (#42~16.04.1-Ubuntu SMP Tue Oct 10 16:32:20 UTC 2017) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       1953525168 sectors
/dev/sda: user_max   1953525168 sectors
/dev/sda: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ02ABF100, S/N:15PQC2DYT, FW:DS001D
Disk /dev/sdb - 16 GB / 15 GiB - CHS 15360 64 32, sector size=512 - PNY USB 2.0 FD, FW:1638

Partition table type default to Intel
Disk /dev/sda - 1000 GB / 931 GiB - TOSHIBA MQ02ABF100
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6206-7198
FAT2 : 7199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1023999
sectors : 1024000
cluster_size : 8
no_of_cluster : 126976 (2 - 126977)
fat_length 993 calculated 993

FAT32 at 0/32/33
     FAT32                    0  32 33    63 221 30    1024000 [ESP]
     FAT32, blocksize=4096, 524 MB / 500 MiB
FAT32 at 63/221/31
FAT1 : 7038-7614
FAT2 : 7615-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-81919
sectors : 81920
cluster_size : 1
no_of_cluster : 73728 (2 - 73729)
fat_length 577 calculated 577

FAT32 at 63/221/31
     FAT32                   63 221 31    68 246 50      81920 [DIAGS]
     FAT32, blocksize=512, 41 MB / 40 MiB
NTFS at 85/72/52
filesystem size           1536000
sectors_per_cluster       8
mft_lcn                   64000
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             85  72 52   180 228 48    1536000
     NTFS, blocksize=4096, 786 MB / 750 MiB
file_pread(4,16,buffer,2906112(180/228/49)) read err: Input/output error
file_pread(4,1,buffer,2906112(180/228/49)) read err: Input/output error
file_pread(4,1,buffer,2906113(180/228/50)) read err: Input/output error
file_pread(4,14,buffer,2906114(180/228/51)) read err: Input/output error
file_pread(4,3,buffer,2906128(180/229/2)) read err: Input/output error
file_pread(4,16,buffer,2906131(180/229/5)) read err: Input/output error
file_pread(4,1,buffer,2906131(180/229/5)) read err: Input/output error
file_pread(4,8,buffer,2906135(180/229/9)) read err: Input/output error
file_pread(4,16,buffer,9197568(572/133/10)) read err: Input/output error
file_pread(4,1,buffer,9197568(572/133/10)) read err: Input/output error
file_pread(4,1,buffer,9197569(572/133/11)) read err: Input/output error
file_pread(4,14,buffer,9197570(572/133/12)) read err: Input/output error
FAT32 at 3697/27/43
FAT1 : 4206-6198
FAT2 : 6199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-2047999
sectors : 2048000
cluster_size : 8
no_of_cluster : 254976 (2 - 254977)
fat_length 1993 calculated 1993

FAT32 at 3697/27/43
     FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
     FAT32, blocksize=4096, 1048 MB / 1000 MiB
NTFS at 120611/181/19
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120611 181 19 120669  19 54     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 120669/19/55
filesystem size           14974384
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120669  19 55 121601  48 31   14974384
     NTFS, blocksize=4096, 7666 MB / 7311 MiB

Results
     FAT32                    0  32 33    63 221 30    1024000 [ESP]
     FAT32, blocksize=4096, 524 MB / 500 MiB
     FAT32                   63 221 31    68 246 50      81920 [DIAGS]
     FAT32, blocksize=512, 41 MB / 40 MiB
     HPFS - NTFS             85  72 52   180 228 48    1536000
     NTFS, blocksize=4096, 786 MB / 750 MiB
     FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
     FAT32, blocksize=4096, 1048 MB / 1000 MiB
     HPFS - NTFS          120611 181 19 120669  19 54     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
     HPFS - NTFS          120669  19 55 121601  57 56   14974976
     NTFS, blocksize=4096, 7667 MB / 7312 MiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 1024000 linear /dev/sda 2048" | dmsetup create test0
echo "0 81920 linear /dev/sda 1026048" | dmsetup create test1
echo "0 1536000 linear /dev/sda 1370112" | dmsetup create test2
echo "0 2048000 linear /dev/sda 59394048" | dmsetup create test3
echo "0 921600 linear /dev/sda 1937627136" | dmsetup create test4
echo "0 14974976 linear /dev/sda 1938548736" | dmsetup create test5

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6206-7198
FAT2 : 7199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1023999
sectors : 1024000
cluster_size : 8
no_of_cluster : 126976 (2 - 126977)
fat_length 993 calculated 993

FAT32 at 0/32/33
     FAT32                    0  32 33    63 221 30    1024000 [ESP]
     FAT32, blocksize=4096, 524 MB / 500 MiB
FAT32 at 0/32/39
FAT1 : 6206-7198
FAT2 : 7199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1023999
sectors : 1024000
cluster_size : 8
no_of_cluster : 126976 (2 - 126977)
fat_length 993 calculated 993
FAT differs, FAT sectors=976-992/993
set_FAT_info: name from BS used

FAT32 at 0/32/39
     FAT32                    0  32 33    63 221 30    1024000 [NO NAME]
     FAT32, blocksize=4096, 524 MB / 500 MiB
FAT32 at 63/221/31
FAT1 : 7038-7614
FAT2 : 7615-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-81919
sectors : 81920
cluster_size : 1
no_of_cluster : 73728 (2 - 73729)
fat_length 577 calculated 577

FAT32 at 63/221/31
     FAT32                   63 221 31    68 246 50      81920 [DIAGS]
     FAT32, blocksize=512, 41 MB / 40 MiB
FAT32 at 63/221/37
FAT1 : 7038-7614
FAT2 : 7615-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-81919
sectors : 81920
cluster_size : 1
no_of_cluster : 73728 (2 - 73729)
fat_length 577 calculated 577
FAT differs, FAT sectors=560-576/577
set_FAT_info: name from BS used

FAT32 at 63/221/37
     FAT32                   63 221 31    68 246 50      81920 [NO NAME]
     FAT32, blocksize=512, 41 MB / 40 MiB
NTFS at 85/72/52
filesystem size           1536000
sectors_per_cluster       8
mft_lcn                   64000
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             85  72 52   180 228 48    1536000
     NTFS, blocksize=4096, 786 MB / 750 MiB
file_pread(4,16,buffer,2906112(180/228/49)) read err: Input/output error
file_pread(4,1,buffer,2906112(180/228/49)) read err: Input/output error
file_pread(4,16,buffer,2906111(180/228/48)) read err: Partial read
NTFS at 180/228/48
filesystem size           1536000
sectors_per_cluster       8
mft_lcn                   64000
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             85  72 52   180 228 48    1536000
     NTFS found using backup sector, blocksize=4096, 786 MB / 750 MiB
file_pread(4,16,buffer,2906127(180/229/1)) read err: Input/output error
file_pread(4,1,buffer,2906127(180/229/1)) read err: Input/output error
file_pread(4,3,buffer,2906128(180/229/2)) read err: Input/output error
file_pread(4,16,buffer,2906131(180/229/5)) read err: Input/output error
file_pread(4,1,buffer,2906131(180/229/5)) read err: Input/output error
file_pread(4,8,buffer,2906135(180/229/9)) read err: Input/output error
file_pread(4,16,buffer,9197568(572/133/10)) read err: Input/output error
file_pread(4,1,buffer,9197568(572/133/10)) read err: Input/output error
file_pread(4,16,buffer,9197569(572/133/11)) read err: Input/output error
file_pread(4,1,buffer,9197569(572/133/11)) read err: Input/output error
file_pread(4,14,buffer,9197570(572/133/12)) read err: Input/output error
NTFS at 3697/27/42
filesystem size           59392000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33  3697  27 42   59392000
     NTFS found using backup sector, blocksize=4096, 30 GB / 28 GiB
FAT32 at 3697/27/43
FAT1 : 4206-6198
FAT2 : 6199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-2047999
sectors : 2048000
cluster_size : 8
no_of_cluster : 254976 (2 - 254977)
fat_length 1993 calculated 1993

FAT32 at 3697/27/43
     FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
     FAT32, blocksize=4096, 1048 MB / 1000 MiB
FAT32 at 3697/27/49
FAT1 : 4206-6198
FAT2 : 6199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-2047999
sectors : 2048000
cluster_size : 8
no_of_cluster : 254976 (2 - 254977)
fat_length 199Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
3 calculated 1993
set_FAT_info: name from BS used

FAT32 at 3697/27/49
     FAT32 LBA             3697  27 43  3824 150 38    2048000 [NO NAME]
     FAT32, blocksize=4096, 1048 MB / 1000 MiB
NTFS at 120611/181/18
filesystem size           1934721024
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            180 228 49 120611 181 18 1934721024
     NTFS found using backup sector, blocksize=4096, 990 GB / 922 GiB
NTFS at 120611/181/19
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120611 181 19 120669  19 54     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 120669/19/54
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120611 181 19 120669  19 54     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
NTFS at 120669/19/55
filesystem size           14974384
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          120669  19 55 121601  48 31   14974384
     NTFS, blocksize=4096, 7666 MB / 7311 MiB
NTFS at 180/228/48
filesystem size           1536000
sectors_per_cluster       8
mft_lcn                   64000
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1

Results
     FAT32                    0  32 33    63 221 30    1024000 [ESP]
     FAT32, blocksize=4096, 524 MB / 500 MiB
     HPFS - NTFS              0  32 33  3697  27 42   59392000
     NTFS found using backup sector, blocksize=4096, 30 GB / 28 GiB
     FAT32                   63 221 31    68 246 50      81920 [DIAGS]
     FAT32, blocksize=512, 41 MB / 40 MiB
     HPFS - NTFS             85  72 52   180 228 48    1536000
     NTFS, blocksize=4096, 786 MB / 750 MiB
     HPFS - NTFS            180 228 48   276 129 44    1536000
     NTFS, blocksize=4096, 786 MB / 750 MiB
     HPFS - NTFS            180 228 49 120611 181 18 1934721024
     NTFS found using backup sector, blocksize=4096, 990 GB / 922 GiB
     FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
     FAT32, blocksize=4096, 1048 MB / 1000 MiB
   * HPFS - NTFS          120611 181 19 120669  19 54     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
   P HPFS - NTFS          120669  19 55 121601  57 56   14974976
     NTFS, blocksize=4096, 7667 MB / 7312 MiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 1024000 linear /dev/sda 2048" | dmsetup create test0
echo "0 59392000 linear /dev/sda 2048" | dmsetup create test1
echo "0 81920 linear /dev/sda 1026048" | dmsetup create test2
echo "0 1536000 linear /dev/sda 1370112" | dmsetup create test3
echo "0 1536000 linear /dev/sda 2906111" | dmsetup create test4
echo "0 1934721024 linear /dev/sda 2906112" | dmsetup create test5
echo "0 2048000 linear /dev/sda 59394048" | dmsetup create test6
echo "0 921600 linear /dev/sda 1937627136" | dmsetup create test7
echo "0 14974976 linear /dev/sda 1938548736" | dmsetup create test8
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,16,buffer,9197568(572/133/10)) read err: Input/output error
file_pread(4,1,buffer,9197568(572/133/10)) read err: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,1,buffer,9197569(572/133/11)) read err: Input/output error
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

     HPFS - NTFS            180 228 49 120611 181 18 1934721024
     NTFS found using backup sector, blocksize=4096, 990 GB / 922 GiB
Can't open filesystem. Filesystem seems damaged.
Change partition type:
     FAT32                Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Additionally, I remember that some of the partitions were Dell partitions but have no idea how to restore them properly.

Greatly appreciate any help. I'm stressing a lot so any help is extremely welcome. I don't want to mess up on this.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Partition and Filesystem Recovery - Uncertain

#2 Post by cgrenier »

Try EFI GPT as partition table type. TestDisk will list the partition as MS DATA but it will find the same partitions otherwise.
You have to select which partitions to recover. It's probably one of the following combinations (D=deleted, P=primary).

Code: Select all

P FAT32                    0  32 33    63 221 30    1024000 [ESP]
D HPFS - NTFS              0  32 33  3697  27 42   59392000
P FAT32                   63 221 31    68 246 50      81920 [DIAGS]
P HPFS - NTFS             85  72 52   180 228 48    1536000
D HPFS - NTFS            180 228 48   276 129 44    1536000
P HPFS - NTFS            180 228 49 120611 181 18 1934721024
D FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
P HPFS - NTFS          120611 181 19 120669  19 54     921600
P HPFS - NTFS          120669  19 55 121601  57 56   14974976

P FAT32                    0  32 33    63 221 30    1024000 [ESP]
D HPFS - NTFS              0  32 33  3697  27 42   59392000
P FAT32                   63 221 31    68 246 50      81920 [DIAGS]
P HPFS - NTFS             85  72 52   180 228 48    1536000
D HPFS - NTFS            180 228 48   276 129 44    1536000
P HPFS - NTFS            180 228 49 120611 181 18 1934721024
D FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
P HPFS - NTFS          120611 181 19 120669  19 54     921600
P HPFS - NTFS          120669  19 55 121601  57 56   14974976

D FAT32                    0  32 33    63 221 30    1024000 [ESP]
P HPFS - NTFS              0  32 33  3697  27 42   59392000
D FAT32                   63 221 31    68 246 50      81920 [DIAGS]
D HPFS - NTFS             85  72 52   180 228 48    1536000
D HPFS - NTFS            180 228 48   276 129 44    1536000
P HPFS - NTFS            180 228 49 120611 181 18 1934721024
P FAT32 LBA             3697  27 43  3824 150 38    2048000 [AM6B]
P HPFS - NTFS          120611 181 19 120669  19 54     921600
P HPFS - NTFS          120669  19 55 121601  57 56   14974976
Top
Kherae
Posts: 3
Joined: 26 May 2018, 22:18

Re: Partition and Filesystem Recovery - Uncertain

#3 Post by Kherae »

so, I poked at it more. made progress. noticed/found out out a few things.
There is a limit of 4 Primary partitions. Option 1 has 6 set. The partition listed as primary bootable to a primary partition, in the primary option, was changed to an ordinary partition.
Some of the partitions were Dell partitions, not primary partitions. I don't seem to be able to select that type.

Moving forward, I guessed based off some reading that the fat32 partitions are probably the dell partitions., and the ESP labeled one is probably where the UEFI stuff is located. I recovered what I believed to be the correct ones, so now I have these after fixing the MBR:
Partition Start End Size in sectors
1 P FAT32 0 32 33 63 221 30 1024000 [ESP]
> 2 P HPFS - NTFS 180 228 49 120611 181 18 1934721024
3 * HPFS - NTFS 120611 181 19 120669 19 54 921600
4 P HPFS - NTFS 120669 19 55 121601 57 56 14974976

the selected one is the main partition, and...sadly...it would appear that the boot sector is not just corrupted, but unwritable, which I believe means the drive failed at that location (based on posts by others elsewhere). Since it apparently needs that NTFS boot sector to load the filesystem, it would appear I need another drive of equivalent or greater capacity to copy the disk's image to, or I can't recover my files.
Am I missing something?
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Partition and Filesystem Recovery - Uncertain

#4 Post by cgrenier »

There is a limit of 4 primary partitions when using a PC Intel partition table. I think you had an EFI GPT partition table, this format doesn't have the limit of 4 partitions.
Top
Kherae
Posts: 3
Joined: 26 May 2018, 22:18

Re: Partition and Filesystem Recovery - Uncertain

#5 Post by Kherae »

ah, that makes more sense. Still...I don't know what to do about the filesystem thing. I guess that means using photorec or hoping someone loans me a drive? Or would those just not work?
Top
Locked

Return to “Partition Recovery”