Testdisk to recover a RAW partition, but thrashed two partitions instead
Posted: 26 Jan 2019, 08:46
Hello,
I was merging two NTFS partitions out of three partitions in a 2TB drive with Minitool Partition Wizard. The first partition was a Windows system only about 30GB. The second was data partition about 290GB, and the rest was a general use partition about 1.4TB. I was merging data and general use.
That was a terrible choice, since the utility failed with disk I/O error and turned one of the NTFS partition RAW.
Then I found out about Testdisk and try to recover the lost partition.
I followed the common steps, Analyze, Intel NTFS partition, and after Testdisk finished I chose Write.
Then I ended up losing my system and 1.4TB general use partitions. The drive partitions is now a 29GB RAW (used to be a system only), 88GB unallocated (which I'm not sure what it was), 290GB NTFS data only, and 1.4TB of unallocated partition (the general use).
How do I recover myself from this disaster?
Also, the attachment doesn't seem to work as it rejected with a file extension error. I copied the log content as follows:
Sat Jan 26 11:53:20 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=12000138625024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=12000138625024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255154660352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=274233032704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=125820576256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3371504238592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=11725257572352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=304088569344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=135164788224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1570485841408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1677721600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=410593632768
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - Crucial_CT256MX100SSD1, S/N:14310CCE928C, FW:MU01
Disk /dev/sdb - 12 TB / 10 TiB - CHS 1458933 255 63, sector size=512 - ST12000DM0007-2GR116, S/N:ZJV0J40X, FW:DN01
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:Z301X07Y, FW:CC54
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD2FNRJ, FW:CC32
Disk /dev/sde - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD6400AACS-00G8B1, S/N:WD-WCAUF2670381, FW:05.04C05
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD59KVL, FW:CC32
Partition table type (auto): Intel
Disk /dev/sdf - 2000 GB / 1863 GiB - ST2000DL003-9VT166
Partition table type: Intel
Analyse Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/3/4
BAD_RS LBA=245746368 63
NTFS at 15297/1/1
Info: size boot_sector 593922985, partition 593922987
BAD_RS LBA=839669418 63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5
Current partition structure:
1 P HPFS - NTFS 0 3 4 15296 210 35 245743313 [win7]
2 E extended LBA 15297 0 1 243201 8 8 3661278272
No partition is bootable
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
Bad relative sector.
X extended 52267 0 1 243201 8 8 3067355222
Invalid NTFS or exFAT boot
6 L HPFS - NTFS 52267 1 1 243201 8 8 3067355159
6 L HPFS - NTFS 52267 1 1 243201 8 8 3067355159
Bad relative sector.
search_part()
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
FAT32 at 0/1/1
FAT1 : 34-15024
FAT2 : 15025-30015
start_rootdir : 30016 root cluster : 2
Data : 30016-61432479
sectors : 61432480
cluster_size : 32
no_of_cluster : 1918827 (2 - 1918828)
fat_length 14991 calculated 14991
FAT differs, FAT sectors=0-16/14991
set_FAT_info: name from BS used
FAT32 at 0/1/1
FAT: Directory entry is marked as free.
FAT: cluster=2(0x2), pos=30079
FAT32 LBA 0 1 1 3823 254 46 61432480 [NO NAME]
FAT32, blocksize=16384, 31 GB / 29 GiB
BAD_RS LBA=245746368 63
NTFS at 15297/1/1
filesystem size 593922985
sectors_per_cluster 8
mft_lcn 770019
mftmirr_lcn 25284753
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 15297 1 1 52266 254 61 593922985 [dat_290]
NTFS, blocksize=4096, 304 GB / 283 GiB
BAD_RS LBA=839669418 63
check_part_i386 failed for partition type 07
HPFS - NTFS 52267 1 1 243201 8 8 3067355159
file_pread(9,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(9,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907029162(243201/80/58)) ReadFile The drive cannot find the sector requested.
file_pread(9,1,buffer,3907029168(243201/81/1)) ReadFile The drive cannot find the sector requested.
file_pread(9,8,buffer,3907029290(243201/82/60)) lseek err Invalid argument
file_pread(9,8,buffer,3907029418(243201/84/62)) lseek err Invalid argument
file_pread(9,8,buffer,3907029546(243201/87/1)) lseek err Invalid argument
file_pread(9,8,buffer,3907029674(243201/89/3)) lseek err Invalid argument
file_pread(9,8,buffer,3907029802(243201/91/5)) lseek err Invalid argument
file_pread(9,8,buffer,3907029930(243201/93/7)) lseek err Invalid argument
file_pread(9,8,buffer,3907030058(243201/95/9)) lseek err Invalid argument
file_pread(9,8,buffer,3907030186(243201/97/11)) lseek err Invalid argument
file_pread(9,8,buffer,3907030314(243201/99/13)) lseek err Invalid argument
file_pread(9,8,buffer,3907030442(243201/101/15)) lseek err Invalid argument
file_pread(9,8,buffer,3907030570(243201/103/17)) lseek err Invalid argument
file_pread(9,8,buffer,3907030698(243201/105/19)) lseek err Invalid argument
file_pread(9,8,buffer,3907030826(243201/107/21)) lseek err Invalid argument
file_pread(9,8,buffer,3907030954(243201/109/23)) lseek err Invalid argument
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,14,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(9,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(9,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(9,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(9,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=5
Results
* FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
FAT32, blocksize=16384, 31 GB / 29 GiB
L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
NTFS, blocksize=4096, 304 GB / 283 GiB
L HPFS - NTFS 52267 1 1 243201 254 63 3067370712
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 * FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
2 E extended LBA 15297 0 1 243201 254 63 3661293825
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
6 L HPFS - NTFS 52267 1 1 243201 254 63 3067370712
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 * FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
2 E extended LBA 15297 0 1 52266 254 63 593923050
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 15297/0/1,lba=245746305
You will have to reboot for the change to take effect.
TestDisk exited normally.
I was merging two NTFS partitions out of three partitions in a 2TB drive with Minitool Partition Wizard. The first partition was a Windows system only about 30GB. The second was data partition about 290GB, and the rest was a general use partition about 1.4TB. I was merging data and general use.
That was a terrible choice, since the utility failed with disk I/O error and turned one of the NTFS partition RAW.
Then I found out about Testdisk and try to recover the lost partition.
I followed the common steps, Analyze, Intel NTFS partition, and after Testdisk finished I chose Write.
Then I ended up losing my system and 1.4TB general use partitions. The drive partitions is now a 29GB RAW (used to be a system only), 88GB unallocated (which I'm not sure what it was), 290GB NTFS data only, and 1.4TB of unallocated partition (the general use).
How do I recover myself from this disaster?
Also, the attachment doesn't seem to work as it rejected with a file extension error. I copied the log content as follows:
Sat Jan 26 11:53:20 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=12000138625024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=12000138625024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=640133946880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255154660352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=274233032704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=125820576256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3371504238592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=11725257572352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=304088569344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=135164788224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1570485841408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1677721600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=410593632768
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - Crucial_CT256MX100SSD1, S/N:14310CCE928C, FW:MU01
Disk /dev/sdb - 12 TB / 10 TiB - CHS 1458933 255 63, sector size=512 - ST12000DM0007-2GR116, S/N:ZJV0J40X, FW:DN01
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:Z301X07Y, FW:CC54
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD2FNRJ, FW:CC32
Disk /dev/sde - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD6400AACS-00G8B1, S/N:WD-WCAUF2670381, FW:05.04C05
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL003-9VT166, S/N:5YD59KVL, FW:CC32
Partition table type (auto): Intel
Disk /dev/sdf - 2000 GB / 1863 GiB - ST2000DL003-9VT166
Partition table type: Intel
Analyse Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/3/4
BAD_RS LBA=245746368 63
NTFS at 15297/1/1
Info: size boot_sector 593922985, partition 593922987
BAD_RS LBA=839669418 63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5
Current partition structure:
1 P HPFS - NTFS 0 3 4 15296 210 35 245743313 [win7]
2 E extended LBA 15297 0 1 243201 8 8 3661278272
No partition is bootable
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
Bad relative sector.
X extended 52267 0 1 243201 8 8 3067355222
Invalid NTFS or exFAT boot
6 L HPFS - NTFS 52267 1 1 243201 8 8 3067355159
6 L HPFS - NTFS 52267 1 1 243201 8 8 3067355159
Bad relative sector.
search_part()
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
FAT32 at 0/1/1
FAT1 : 34-15024
FAT2 : 15025-30015
start_rootdir : 30016 root cluster : 2
Data : 30016-61432479
sectors : 61432480
cluster_size : 32
no_of_cluster : 1918827 (2 - 1918828)
fat_length 14991 calculated 14991
FAT differs, FAT sectors=0-16/14991
set_FAT_info: name from BS used
FAT32 at 0/1/1
FAT: Directory entry is marked as free.
FAT: cluster=2(0x2), pos=30079
FAT32 LBA 0 1 1 3823 254 46 61432480 [NO NAME]
FAT32, blocksize=16384, 31 GB / 29 GiB
BAD_RS LBA=245746368 63
NTFS at 15297/1/1
filesystem size 593922985
sectors_per_cluster 8
mft_lcn 770019
mftmirr_lcn 25284753
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 15297 1 1 52266 254 61 593922985 [dat_290]
NTFS, blocksize=4096, 304 GB / 283 GiB
BAD_RS LBA=839669418 63
check_part_i386 failed for partition type 07
HPFS - NTFS 52267 1 1 243201 8 8 3067355159
file_pread(9,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(9,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907029162(243201/80/58)) ReadFile The drive cannot find the sector requested.
file_pread(9,1,buffer,3907029168(243201/81/1)) ReadFile The drive cannot find the sector requested.
file_pread(9,8,buffer,3907029290(243201/82/60)) lseek err Invalid argument
file_pread(9,8,buffer,3907029418(243201/84/62)) lseek err Invalid argument
file_pread(9,8,buffer,3907029546(243201/87/1)) lseek err Invalid argument
file_pread(9,8,buffer,3907029674(243201/89/3)) lseek err Invalid argument
file_pread(9,8,buffer,3907029802(243201/91/5)) lseek err Invalid argument
file_pread(9,8,buffer,3907029930(243201/93/7)) lseek err Invalid argument
file_pread(9,8,buffer,3907030058(243201/95/9)) lseek err Invalid argument
file_pread(9,8,buffer,3907030186(243201/97/11)) lseek err Invalid argument
file_pread(9,8,buffer,3907030314(243201/99/13)) lseek err Invalid argument
file_pread(9,8,buffer,3907030442(243201/101/15)) lseek err Invalid argument
file_pread(9,8,buffer,3907030570(243201/103/17)) lseek err Invalid argument
file_pread(9,8,buffer,3907030698(243201/105/19)) lseek err Invalid argument
file_pread(9,8,buffer,3907030826(243201/107/21)) lseek err Invalid argument
file_pread(9,8,buffer,3907030954(243201/109/23)) lseek err Invalid argument
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,14,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(9,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(9,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(9,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(9,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=5
Results
* FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
FAT32, blocksize=16384, 31 GB / 29 GiB
L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
NTFS, blocksize=4096, 304 GB / 283 GiB
L HPFS - NTFS 52267 1 1 243201 254 63 3067370712
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 * FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
2 E extended LBA 15297 0 1 243201 254 63 3661293825
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
6 L HPFS - NTFS 52267 1 1 243201 254 63 3067370712
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 * FAT32 LBA 0 1 1 3823 254 63 61432497 [NO NAME]
2 E extended LBA 15297 0 1 52266 254 63 593923050
5 L HPFS - NTFS 15297 1 1 52266 254 63 593922987 [dat_290]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 15297/0/1,lba=245746305
You will have to reboot for the change to take effect.
TestDisk exited normally.