Partition recovery, wrong number of partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition recovery, wrong number of partitions

#21 Post by recuperation »

viewtopic.php?f=5&t=8353&start=10#p26993

As I said:
But that won't help you if the address of the MFT is wrong anyway or does get wrong by changing that value.
Before doing this you would need to check if the bootsector points to a valid MFT.
There is a reason why testdisk doesn't find anything.

aldowski
Posts: 17
Joined: 17 Feb 2019, 09:48

Re: Partition recovery, wrong number of partitions

#22 Post by aldowski »

Hi;

I found some explanations related to the filesystem issues in the Forum: -> "Using NTFS backup boot sector, TestDisk will be able to list the files."

Also: -> "TestDisk, Advanced, Repair then should be able to list the files by listing only the valid MFT records, they will need to scan the NTFS partition first. "

And: -> "Using the NTFS backup boot sector, TestDisk will be able to list the files.
If the MFT table is corrupted, TestDisk, Advanced, Repair MFT, may be able to use its backup. If some MFT records are corrupted, TestDisk will failed to list the files.
Some other data recovery utilities (like scrounge-ntfs) will still be able to list the files by listing only the valid MFT records, they will need to scan the NTFS partition first."

The Deeper Scan is at 95%, it should be finished in few hours. I'll check the results then.

Please, should I try other type of the Deeper Scan (NTFS one), or I may expect similar / same results?

Also, should I try the mentioned scrounge-ntfs?

Thank you.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition recovery, wrong number of partitions

#23 Post by recuperation »

Please, should I try other type of the Deeper Scan (NTFS one), or I may expect similar / same results?
Don't know!
Sorry - as my last recovery took place some time ago I am not aware of the variations of "deep scan".
so, should I try the mentioned scrounge-ntfs?
From reading the manpages here
http://manpages.ubuntu.com/manpages/bio ... tfs.8.html

you are required to enter the MFT address.
Otherwise the program writes everything into one folder - seems to operate like photorec then...
I doubt that it could help you - you have to find the MFT somehow.

aldowski
Posts: 17
Joined: 17 Feb 2019, 09:48

Re: Partition recovery, wrong number of partitions

#24 Post by aldowski »

Thanks for the reply.

Unfortunately, seems that Testdisk Deeper Scan did not find more details about 1st partition.

I tried more other apps (7-8 of them), most applications provided no details.

Only the DMDE, newest version, in it's freeware mode, did recognize 2 partitions, seems in correct way, correct positions, correct volumes of data and correct filesystems. Only problem is, it found 4 partitions total, first is total 3TB space as one partition, second is MS Data 2TB the same as third correct one of 2 TB, and fourth is correct 1TB partition as it is (both with correct partition names [New Volume]).

Third and fourth partition listed are correct, filesystem is okay, it has all folder / files there, found no issues.

Unfortunately, the second, MS Data partition is "overlapping" the third correct partition. I tried to add / remove partitions, but I cannot remove the first (3TB), and second (MS Data, 2TB) partition, to reestablish the 3rd and 4th partitions to be on 1st and 2nd place in the table.

When I am adding drive letters, I am able to see partition letters in Windows, both partitions as "not formatted".

That way, still the Testdisk is not recognizing the 2TB partition.

The Stellar Phoenix seems to be the only software (next to DMDE) to recognize filesystems on both partitions in this case. I did not try recovery yet.

I made exact clone to other 3TB disc, just in case (already have one copy on 6TB). Will continue to try to recover the partitions / files / folders.

At the moment the DMDE (free version, I checked partitions / filesystems only) seems to provide highest level of recovery.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition recovery, wrong number of partitions

#25 Post by recuperation »

Hello aldowski,
aldowski wrote: 18 Mar 2019, 09:29 Only the DMDE, newest version, in it's freeware mode, did recognize 2 partitions, seems in correct way, correct positions, correct volumes of data and correct filesystems. Only problem is, it found 4 partitions total, first is total 3TB space as one partition, second is MS Data 2TB the same as third correct one of 2 TB, and fourth is correct 1TB partition as it is (both with correct partition names [New Volume]).

Third and fourth partition listed are correct, filesystem is okay, it has all folder / files there, found no issues.
the information you are giving is contradictory. Here's why:

You have a single hard drive with 3TB that contains 2 partitions, that's what you said initially.
Now you said "DMDE" (What is that?) shows you 2 correct partitions and you are still searching for a 3rd one? :roll:

aldowski
Posts: 17
Joined: 17 Feb 2019, 09:48

Re: Partition recovery, wrong number of partitions

#26 Post by aldowski »

Hi;

I tried to explain the results from DMDE.

DMDE (Disk Manager, version 3.4.4 free version), found 4 partition records:
1. NTFS Total space, as it is not partitioned at all 3TB, no filesystem here;
2. NTFS MS Data partition, wrong one, 2TB which is overlapping the 3rd partition found by DMDE, next in this list, no filesystem here;
3. NTFS [New Volume] Correct partition, this should be the first partition in real 2TB; All details including complete filesystem is correct in this partition;
4. NTFS [New Volume] Correct partition, this should be the second partition in real 1TB; All details including complete filesystem is correct in this partition as well.

So, in fact, I need those 3rd and 4th partitions recovered (total 3TB) and somehow I would need 1st and 2nd from this list removed, as I tried to explain.
First and second record are overlapping third and fourth record from the mentioned list.

The DMDE 3.4.4 found this, it allows many different activities in the free version, especially related to partition managing. I found DMDE being used together with Testdisk, by number of users.

Unfortunately, not clear how to remove partitions (in the right click menu on those partitions 1st and 2nd, I got grey, inactive "Remove partition" option).

As I cloned the 3TB HDD, I am now trying to get the 3rd and 4th partition from this list fully visible, not as 3rd and 4th, but as 1st and 2nd, with complete filesystem, to the Windows.

Assigning the drive letter to 3rd and 4th partition is possible, after that filesystem with all files / folders is fully visible as well on both partitions in DMDE and in, for example, Stellar Phoenix, but it is not visible from Windows.

Windows can see those partitions as not formatted.

Thanks for the reply, I hope I was able to clarify the issue.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition recovery, wrong number of partitions

#27 Post by recuperation »

Hello aldowski,
aldowski wrote: 18 Mar 2019, 14:04 DMDE (Disk Manager, version 3.4.4 free version), found 4 partition records:
1. NTFS Total space, as it is not partitioned at all 3TB, no filesystem here;
2. NTFS MS Data partition, wrong one, 2TB which is overlapping the 3rd partition found by DMDE, next in this list, no filesystem here;
3. NTFS [New Volume] Correct partition, this should be the first partition in real 2TB; All details including complete filesystem is correct in this partition;
4. NTFS [New Volume] Correct partition, this should be the second partition in real 1TB; All details including complete filesystem is correct in this partition as well.

So, in fact, I need those 3rd and 4th partitions recovered (total 3TB) and somehow I would need 1st and 2nd from this list removed, as I tried to explain.
First and second record are overlapping third and fourth record from the mentioned list.
that's a precise statement, now I can imagine how your situation is like.
Now you are talking about partition records (partition tables) instead of partitions which is more precise.

What you describe sounds like the old MBR-style partitioning scheme has been used.
In this case the first partition table is perfectly OK because as an extended partition p.e. it would span the whole disk space. Inside there should another two partition tables for each of the two logical partitions within the big extended partition.

Many tools do not bother with "in situ repair" because an uninformed user could cause a lot of dammage.
Just try to read out the partition in question if your tools allows it.
Otherwise you have to build a valid bootsector with valid pointers to the MFT etc.

aldowski
Posts: 17
Joined: 17 Feb 2019, 09:48

Re: Partition recovery, wrong number of partitions

#28 Post by aldowski »

Hi recuperation;

thanks for reply; yes, for the reason of the possible damage, I made that exact HDD 3TB clone. Now I am copying the clone back to the original drive, cause I "overplayed" a bit with those tries, experiments.

This application is providing extended definitions with number of indicators about status of some partitions features, for example, capitol "F" if it is green, means the filesystem on the partition is okay.
When all records being listed there are few 3TB records, including HDD, as first one. I will put the screenshot here so it will be clearly visible.

Yes, almost all applications for recovery HDD's partitions do not "like" to reestablish partitions and / or filesystem at original disc, strongly suggested is to copy data to the backup HDD.
Many of those applications, including some "big names", have issues with reestablishing real filenames, folder structure, time date stamps.
I must say that few of those are very, very slow, I got estimation time for files checking (without recovery) of 720+ hours (and rising).

Now, as mentioned, copying cloned data back to original HDD, then I'll continue checking partition recovery possibilities.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition recovery, wrong number of partitions

#29 Post by recuperation »

Hello aldowski,
Many of those applications, including some "big names", have issues with reestablishing real filenames, folder structure, time date stamps. 1
how are you able to judge that these applications "have issues"?

aldowski
Posts: 17
Joined: 17 Feb 2019, 09:48

Re: Partition recovery, wrong number of partitions

#30 Post by aldowski »

Hi;

DMDE is showing correct filenames, foldernames, structure - tree, with correct timestamps for both partitions on the HDD.
Testdisk is showing everything, correct filenames, foldernames, structure - tree, with correct timestamps in this case for the second partition.
But few expensive ones, not freewares I tried (big company names, better not to mention them) for the same HDD, partition table, same environment, are creating numbered filenames (example: file0001, file0002, file0003, ........), with no folder structure, no timestamps.
Again, the same HDD and Partition table. And completely different results. Issues I mentioned are related to those results.

Locked