Page 1 of 1

Testdisk to recover a RAW partition, but thrashed two partitions instead

Posted: 26 Jan 2019, 08:46
by hstpctech
Hello,

I was merging two NTFS partitions out of three partitions in a 2TB drive with Minitool Partition Wizard. The first partition was a Windows system only about 30GB. The second was data partition about 290GB, and the rest was a general use partition about 1.4TB. I was merging data and general use.

That was a terrible choice, since the utility failed with disk I/O error and turned one of the NTFS partition RAW.

Then I found out about Testdisk and try to recover the lost partition.

I followed the common steps, Analyze, Intel NTFS partition, and after Testdisk finished I chose Write.

Then I ended up losing my system and 1.4TB general use partitions. The drive partitions is now a 29GB RAW (used to be a system only), 88GB unallocated (which I'm not sure what it was), 290GB NTFS data only, and 1.4TB of unallocated partition (the general use).

How do I recover myself from this disaster?

Also, the attachment doesn't seem to work as it rejected with a file extension error. I copied the log content as follows:
Sat Jan 26 11:53:20 2019
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=12000138625024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=12000138625024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255154660352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=274233032704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=125820576256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3371504238592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=11725257572352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=304088569344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=135164788224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1570485841408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1677721600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=410593632768
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - Crucial_CT256MX100SSD1, S/N:14310CCE928C, FW:MU01
Disk /dev/sdb - 12 TB / 10 TiB - CHS 1458933 255 63, sector size=512 - ST12000DM0007-2GR116, S/N:ZJV0J40X, FW:DN01
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:Z301X07Y, FW:CC54
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD2FNRJ, FW:CC32
Disk /dev/sde - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD6400AACS-00G8B1, S/N:WD-WCAUF2670381, FW:05.04C05
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD59KVL, FW:CC32

Partition table type (auto): Intel
Disk /dev/sdf - 2000 GB / 1863 GiB - ST2000DL003-9VT166
Partition table type: Intel

Analyse Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/3/4
BAD_RS LBA=245746368 63
NTFS at 15297/1/1
Info: size boot_sector 593922985, partition 593922987
BAD_RS LBA=839669418 63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5
Current partition structure:
1 P HPFS - NTFS 0 3 4 15296 210 35 245743313 [win7]
2 E extended LBA 15297 0 1 243201 8 8 3661278272
No partition is bootable
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]

Bad relative sector.
X extended 52267 0 1 243201 8 8 3067355222
Invalid NTFS or exFAT boot
6 L HPFS - NTFS 52267 1 1 243201 8 8 3067355159
6 L HPFS - NTFS 52267 1 1 243201 8 8 3067355159

Bad relative sector.

search_part()
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
FAT32 at 0/1/1
FAT1 : 34-15024
FAT2 : 15025-30015
start_rootdir : 30016 root cluster : 2
Data : 30016-61432479
sectors : 61432480
cluster_size : 32
no_of_cluster : 1918827 (2 - 1918828)
fat_length 14991 calculated 14991
FAT differs, FAT sectors=0-16/14991
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT: Directory entry is marked as free.
FAT: cluster=2(0x2), pos=30079
FAT32 LBA 0 1 1 3823 254 46 61432480 [NO NAME]
FAT32, blocksize=16384, 31 GB / 29 GiB
BAD_RS LBA=245746368 63
NTFS at 15297/1/1
filesystem size 593922985
sectors_per_cluster 8
mft_lcn 770019
mftmirr_lcn 25284753
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 15297 1 1 52266 254 61 593922985 [dat_290]
NTFS, blocksize=4096, 304 GB / 283 GiB
BAD_RS LBA=839669418 63
check_part_i386 failed for partition type 07
HPFS - NTFS 52267 1 1 243201 8 8 3067355159
file_pread(9,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(9,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907029162(243201/80/58)) ReadFile The drive cannot find the sector requested.

file_pread(9,1,buffer,3907029168(243201/81/1)) ReadFile The drive cannot find the sector requested.

file_pread(9,8,buffer,3907029290(243201/82/60)) lseek err Invalid argument
file_pread(9,8,buffer,3907029418(243201/84/62)) lseek err Invalid argument
file_pread(9,8,buffer,3907029546(243201/87/1)) lseek err Invalid argument
file_pread(9,8,buffer,3907029674(243201/89/3)) lseek err Invalid argument
file_pread(9,8,buffer,3907029802(243201/91/5)) lseek err Invalid argument
file_pread(9,8,buffer,3907029930(243201/93/7)) lseek err Invalid argument
file_pread(9,8,buffer,3907030058(243201/95/9)) lseek err Invalid argument
file_pread(9,8,buffer,3907030186(243201/97/11)) lseek err Invalid argument
file_pread(9,8,buffer,3907030314(243201/99/13)) lseek err Invalid argument
file_pread(9,8,buffer,3907030442(243201/101/15)) lseek err Invalid argument
file_pread(9,8,buffer,3907030570(243201/103/17)) lseek err Invalid argument
file_pread(9,8,buffer,3907030698(243201/105/19)) lseek err Invalid argument
file_pread(9,8,buffer,3907030826(243201/107/21)) lseek err Invalid argument
file_pread(9,8,buffer,3907030954(243201/109/23)) lseek err Invalid argument
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,14,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(9,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(9,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(9,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(9,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=5

Results
* FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
FAT32, blocksize=16384, 31 GB / 29 GiB
L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
NTFS, blocksize=4096, 304 GB / 283 GiB
L HPFS - NTFS 52267 1 1 243201 254 63 3067370712
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
2 E extended LBA 15297 0 1 243201 254 63 3661293825
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
6 L HPFS - NTFS 52267 1 1 243201 254 63 3067370712
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
2 E extended LBA 15297 0 1 52266 254 63 593923050
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 15297/0/1,lba=245746305
You will have to reboot for the change to take effect.

TestDisk exited normally.

Re: Testdisk to recover a RAW partition, but thrashed two partitions instead

Posted: 28 Jan 2019, 18:24
by cgrenier
To undo what has been done, after Quick Search, use the arrow to set the partitions to *(bootable) or P(rimary) as described bellow
* HPFS - NTFS 0 3 4 15296 210 35 245743313 [win7]
P HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
P HPFS - NTFS 52267 1 1 243201 8 8 3067355159
If a partition isn't listed, use 'a' to manually add it. On next screen, if all partitions are listed, choose Write, confirm, Quit and restart

Re: Testdisk to recover a RAW partition, but thrashed two partitions instead

Posted: 28 Jan 2019, 19:43
by hstpctech
The quicksearch result: https://i.imgur.com/doarFt3.png

Should I change this Logical partition into a Primary and Continue? I'm afraid to do any more damage because your instruction isn't exactly matching the quicksearch result:
your instruction
P HPFS - NTFS 52267 1 1 243201 8 8 3067355159

quicksearch result
L HPFS - NTFS 52267 1 1 243201 254 63 3067370712

I also have a couple of sector count error with the drive: https://i.imgur.com/waVo2ym.png. I'm not sure if it's occurred before or after the partition problem.

Re: Testdisk to recover a RAW partition, but thrashed two partitions instead

Posted: 04 Feb 2019, 19:04
by hstpctech
Hi cgreenier,

sorry to bother you again. I need your advice to confirm which geometry I should go with to write on my drive. I am still waiting since your last reply.

Best regards
Andy

Re: Testdisk to recover a RAW partition, but thrashed two partitions instead

Posted: 05 Apr 2019, 11:34
by hstpctech
It doesn't work - both partitions resulted as RAW instead.

Re: Testdisk to recover a RAW partition, but thrashed two partitions instead

Posted: 05 Apr 2019, 13:33
by recuperation
Hello hstpctech,
hstpctech wrote: 26 Jan 2019, 08:46 That was a terrible choice, since the utility failed with disk I/O error and turned one of the NTFS partition RAW.
The message from your utility "disk I/O error" suggests dammage.
Your current pending sector count of at least 16 sectors confirms the first assumption.
Next step before continuing trying a recovery is to clone the drive ("ddrescue" is recommended).
Cloning is likely to increase the pending sector count.
Best thing is to clone to the copied drive again and restrict recovery attempts to that 2nd copy.