Page 1 of 1

Testdisk found extra NTFS partition

Posted: 28 Oct 2018, 17:19
by boarder2k7
I had a bootable Windows partition disappear, and I'm using testdisk within Gparted to try and recover it.

testdisk seems to have found the partition, but there is also an extra one here:
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
D HPFS - NTFS 0 1 1 2693 254 63 43279047
1 HPFS - NTFS 0 32 33 12 223 19 204800
2 HPFS - NTFS 12 223 20 60801 112 47 976568320

The two I want are the ones I labeled "1" and "2" where partition 1 is the 100 MiB reserved partition Windows creates, and 2 is the active bootable Windows partition. I have no idea what the 20 GiB partition marked "D" is as I've only ever had this drive formatted with that one Windows instance.

What should I set the two wanted partitions to in order to restore the drive? Does 1 become bootable and 2 become primary?

Gparted sees both partitions 1 and 2 and has 1 flagged as boot, is this correct? Partition 2 is labeled as "Windows" in Gparted but has no assigned size.

Gparted also shows an exclamation point next to the partition, and says:
"Index root attribute missing in directory inode 5: No such file or directory
Failed to open $Secure: No such file or directory
Failed to mount '/dev/sdb2': No such file or directory"

The message I got from testdisk at the beginning showed partition 2 as "Warning: Bad starting sector (CHS and LBA don't match."

(Sorry for the bad formatting and lack of actual pictures, not sure how to do screenshots within Gparted and none of the forum formatting buttons show up in NetSurf)

Thanks for the help

Re: Testdisk found extra NTFS partition

Posted: 29 Oct 2018, 06:37
by cgrenier
Set the partition labeled as 1 as P(rimary) and 2 as *(bootable).
You will probably have to repair the filesystem, read the corresponding chapter in
If it doesn't work, use PhotoRec to recover your data.

Re: Testdisk found extra NTFS partition

Posted: 16 Dec 2018, 00:08
by boarder2k7
Follow-up: Never got this to work. In fact I suspect that trying to write the partitions back may have made the drive unrecoverable when I passed it off for a friend to try with a RapidSpar recovery tool (didn't know he had access to one or I would have tried that first).

Note for next time (which I know to do but somehow forgot): ALWAYS make a forensic copy of the drive and work off the copy to avoid breaking things worse.

End Result - no clue what happened in the first place, or what would have solved it, I didn't get it to work, nor did my friends who work in the field.

Re: Testdisk found extra NTFS partition

Posted: 16 Dec 2018, 11:44
by cgrenier
Even if recovering the partition failed, you should be able to recover some data using PhotoRec.