Partition recovery, wrong number of partitions

[recuperation]

Is there a way to recover the partition type? I tried to rebuild / recover boot, MBR, MFT, it found some records, but no files are being listed.

IF you are refering to the "MBR" or "GPT" scheme, there is nothing to recover. Those schemes are just shells that point to partitions. They can be used interchangeably.

Also, as visible at one of screenshots, both partitions are named "[New Volume]", would that make any good if I would try to search complete HDD for the exact string "[New Volume]", with expectation that there will be 2 results? If yes, which search software would be suggested to do this on the HDD not accessible by Windows?

"New Volume" looks like a generic name.
You can use any hex editor for searches on the disk.

[aldowski]

Hi;

Thanks for response.

The name "New Volume" is visible at first screenshot I put here, yes it's generic and default, I did not change it, I left it as it is after creation of partitions, when starting using the HDD. I cannot access the HDD partitions from Windows, accessing only thru Testdisk, so I may not use some HEX Editor utility for the search.

About the partitions details issue, as mentioned, I am still trying to recover first partition, as I recovered second partition and copied all files to another HDD. As I already used (in Testdisk) Write command few times, there may be a possibility that I overwrite first partition structure. I tried by adding the partitions (both) manually, after that structure became visible in Testisk partitions listing, but files cannot be listed (for the first partition) and partition name (should be "[New Volume]" ) not visible.

What is important, by adding 1st and 2nd partition details manually, 2nd partition was fully recovered (in Testdisk, that allows copying files), but 1st not. Something missing,

There is no blocksize for the first partition, but at the recognized second partition Blocksize=4096, partition type is NTFS.

After trying to go further, I got errors:
- "Number of bytes per sector mismatches 4096 (NTFS) !=512 (HD)" (when recovering first partition);
- "extrapolated boot sector and current boot sector are different".

Please, based on the blocksize missing detail and those two mentioned errors, is there anything that can be done to insert / change missing detail(s) into the first partition structure, to recover it?

Thank you.

[recuperation]

The name "New Volume" is visible at first screenshot I put here, yes it's generic and default, I did not change it, I left it as it is after creation of partitions, when starting using the HDD. I cannot access the HDD partitions from Windows, accessing only thru Testdisk, so I may not use some HEX Editor utility for the search.

When I said "New Volume" is generic I meant it could be a kind of placeholder name only in use be Testdisk.
You may not find that name anywhere on the disk.

And what is that information good for if you find it somewhere on the disk?
Your hex editor is not limited to the partitions. Your assumption about the hex editor is wrong.

Just doing something without any clear target won' help you further unfortunately.

- "Number of bytes per sector mismatches 4096 (NTFS) !=512 (HD)" (when recovering first partition);
- "extrapolated boot sector and current boot sector are different".

This is interesting. According to
https://www.storagereview.com/seagate_b ... t3000dm001
the correct sector size ist 512.
That can be changed with a disk editor if Testdisk does not support it.
But that won't help you if the address of the MFT is wrong anyway or does get wrong by changing that value.
Before doing this you would need to check if the bootsector points to a valid MFT.

[aldowski]

Hi recuperation;

thanks for the reply; related to the "[New Volume]" as partition name, I have it (the same partition name) on few other discs, where I created partitions same way, the name is "[New Volume]", cause I did not change it, I left it as it was.

Related to the search for it (with a Hex Editor) on the HDD, I thought it may be somehow logical to get (on this HDD) "[New Volume]" string found two times, cause there were two partitions created on this HDD. Yes, there may be different logic for placing partition names at the disc, but I had (on first screenshot here) both partitions named with "[New Volume]", so if search for this character string will show two results, it may be possible that it is not overwritten. Placement of the results may be somehow helpful as well.

Also, I did not say that Hex Editor is limited to partitions, problem is - this HDD is not visible at all from Windows point of view. I may use some bootable CD / DVD / USB with utilities (including Hex Editor) to do that search, most probably it will be in next steps.

About the "extrapolated boot sector and current boot sector are different", as error, and the MFT, next step may be editing / changing boot sector - using suggested value, then searching for a valid MFT.

Again, the second partition file details are all there including filenames, datetime, folder structure, everything looks okay. That is somehow providing hope that there is still a possibility to recover first partition. I must emphasize that Testdisk has some amazing options, those which are to be used at proper time, proper way.

During recent days, I have to say that there was lesson learned for me = "No Rush". I made few wrong steps at start, so I do not have filesystem of first partition listed. Now, going slowly, taking time, checking possibilities.

Thank you recuperation, for suggestions.

[recuperation]

Also, I did not say that Hex Editor is limited to partitions, problem is - this HDD is not visible at all from Windows point of view. I may use some bootable CD / DVD / USB with utilities (including Hex Editor) to do that search, most probably it will be in next steps.

That is wrong. If the hard disk is not visible in Windows, testdisk will not have any access either.
You are assuming that visibility in Windows Explorer is equal to visibility for Windows.
Visibility for Windows can be verified using the Disk management (dskmgmnt.msc?).
Visibility in Disk management does not imply visibility in Windows explorer.

[aldowski]

Seems that it is not possible to recreate / rebuild the first partition filesystem automatically. I tried, few times, using different options.

There may be a possibility to recover the lost / damaged partition manually, by copying correct "header" (this may not be proper name for it) to the place where the lost one was originally placed. Some adjustments are to be done, then partition and filesystem may be revived. I'll make a 3TB disc mirror copy to other 3TB HDD first. On superuser dot com ("NTFS partition no longer accessible"), there is explanation about the manual recovery, using DMDE and WinHEX, there are steps to be done to make recovery, also, there is a need for some initial records to be used, copy them as valid data to corrupted parts of the HDD, adjust that newly created record.

At this page, Testdisk was mentioned as well.

Now, have to ask if someone already tried manual recovery, using correct partition definition, copying it to the bad one, replacing then adjusting?

Thank you.

[aldowski]

I decided, after previous reply, to do the Deeper search (EFI).

After 3 days, it is going over 50% of the 3TB HDD, so it may need up to 3 days more to finish. I am using 2XHDD docking station with USB3.0 cable to laptop.

Is that too slow (I saw on some other topics that EFI Deeper search / scan may be slow)?

I found the testdisk.log file from those first attempts of recovery (from different laptop), there were multiple sessions saved in it, including those from the start, I did not create new sessions, I just did append new ones to the same file. would that be okay to put it here at forum (huge text file, should I cut the first sessions only)?

Thank you.

[recuperation]

After 3 days, it is going over 50% of the 3TB HDD, so it may need up to 3 days more to finish. I am using 2XHDD docking station with USB3.0 cable to laptop.

I would suspect damaged sectors.

For my opinion it is always worth checking the SMART parameters before recovery with tools like smartmontools (command line) oder Crystaldiskinfo (graphic gui).

Cloning the suspicous disk is a good idea anyway and working on that clone should exclude the possibility that pending sectors are thwarting the activities of testdisk and photorec.

(huge text file, should I cut the first sessions only)?

How big in terms of size is "huge"? Nobody except for you knows what "huge" is.
You should only provide relevant information.
In order not to loose the overview about your data recovery efforts you are better of using a new log file name for a new attempt.

[aldowski]

Hi;

Now, the Deeper scan / search is 75%. I would let it finish the search, I saw many Linux and small number of MS Data partitions in the existing list of found partitions.

Here is only first, small part of the log:

Code: Select all

Wed Feb 13 16:07:33 2019
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248470433280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=250214350848
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA MK5065GSXN, S/N:81NFC638T, FW:GH101M
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM 001-1CH166, S/N:0000AB1238A4, FW:0425

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM 001-1CH166
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           476533504
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 237319  39 32 3812268032 [New Volume]
     NTFS, blocksize=4096, 1951 GB / 1817 GiB
NTFS at 237319/39/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           255999744
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS          237319  39 33 364801  33 32 2047997952 [New Volume]
     NTFS, blocksize=4096, 1048 GB / 976 GiB
NTFS at 364801/66/1
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 364801  66  1 5860268032
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364801/66/1
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,2,buffer,5866823685(365192/225/31)) lseek err Invalid argument
file_pread(5,1,buffer,5866823685(365192/225/31)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS          364801  66  1 729586  18 31 5860268032
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860532223, size=5860268032, end=11720800254, disk end=5860533168)
file_pread(5,2,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,8,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,5860533376(364801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,5860533504(364801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,5860533632(364801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,5860533760(364801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,5860533888(364801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,5860534016(364801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,5860534144(364801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534280(364801/98/42)) lseek err Invalid argument
file_pread(5,3,buffer,5860534288(364801/98/50)) lseek err Invalid argument
file_pread(5,3,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534351(364801/99/50)) lseek err Invalid argument
file_pread(5,11,buffer,5860534398(364801/100/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860536320(364801/131/3)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partition can't be recovered:
     HPFS - NTFS          364801  66  1 729586  18 31 5860268032
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
     HPFS - NTFS             16 113 34 237319  39 32 3812268032 [New Volume]
     NTFS, blocksize=4096, 1951 GB / 1817 GiB
     HPFS - NTFS             16 113 34 364801  66  1 5860268032
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
     HPFS - NTFS          237319  39 33 364801  33 32 2047997952 [New Volume]
     NTFS, blocksize=4096, 1048 GB / 976 GiB

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Backup partition structure
partition_save

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           476533504
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 237319  39 32 3812268032 [New Volume]
     NTFS, blocksize=4096, 1951 GB / 1817 GiB
NTFS at 237319/39/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           255999744
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS          237319  39 33 364801  33 32 2047997952 [New Volume]
     NTFS, blocksize=4096, 1048 GB / 976 GiB
NTFS at 364801/66/1
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 364801  66  1 5860268032
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364801/66/1
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,2,buffer,5866823685(365192/225/31)) lseek err Invalid argument
file_pread(5,1,buffer,5866823685(365192/225/31)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS          364801  66  1 729586  18 31 5860268032
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860532223, size=5860268032, end=11720800254, disk end=5860533168)
file_pread(5,2,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,8,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,5860533376(364801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,5860533504(364801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,5860533632(364801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,5860533760(364801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,5860533888(364801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,5860534016(364801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,5860534144(364801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534280(364801/98/42)) lseek err Invalid argument
file_pread(5,3,buffer,5860534288(364801/98/50)) lseek err Invalid argument
file_pread(5,3,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534351(364801/99/50)) lseek err Invalid argument
file_pread(5,11,buffer,5860534398(364801/100/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860536320(364801/131/3)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partition can't be recovered:
     HPFS - NTFS          364801  66  1 729586  18 31 5860268032
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
     HPFS - NTFS             16 113 34 237319  39 32 3812268032 [New Volume]
     NTFS, blocksize=4096, 1951 GB / 1817 GiB
     HPFS - NTFS             16 113 34 364801  66  1 5860268032
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
     HPFS - NTFS          237319  39 33 364801  33 32 2047997952 [New Volume]
     NTFS, blocksize=4096, 1048 GB / 976 GiB

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

First results were somehow correct (and my mistake - I did not use the "P" function - list files immediately).

Code: Select all

Results
     HPFS - NTFS             16 113 34 237319  39 32 3812268032 [New Volume]
     NTFS, blocksize=4096, 1951 GB / 1817 GiB
     HPFS - NTFS             16 113 34 364801  66  1 5860268032
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
     HPFS - NTFS          237319  39 33 364801  33 32 2047997952 [New Volume]
     NTFS, blocksize=4096, 1048 GB / 976 GiB

It recognized the Partition as Intel:

Code: Select all

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM 001-1CH166
Partition table type: Intel

As mentioned, I'll wait for the Deep scan finish.

[aldowski]

Now, I have to ask, most important: may I use those details from first session in the log somehow to input them into partition table?

Code: Select all

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM 001-1CH166, S/N:0000AB1238A4, FW:0425

Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM 001-1CH166
Partition table type: Intel
Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test

Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           476533504
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 237319  39 32 3812268032 [New Volume]
     NTFS, blocksize=4096, 1951 GB / 1817 GiB
NTFS at 237319/39/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           255999744
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS          237319  39 33 364801  33 32 2047997952 [New Volume]
     NTFS, blocksize=4096, 1048 GB / 976 GiB
NTFS at 364801/66/1
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 364801  66  1 5860268032
     NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364801/66/1
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,2,buffer,5866823685(365192/225/31)) lseek err Invalid argument
file_pread(5,1,buffer,5866823685(365192/225/31)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS          364801  66  1 729586  18 31 5860268032
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860532223, size=5860268032, end=11720800254, disk end=5860533168)

Blocksize, partition name, NTFS placement is here visible for the first partition (which I am not able to view now). As mentioned, the second partition is fully visible, recovered by using the P, list files and folders option.

First partition is the problematical one. The question is, as mentioned, may I use details from this log, input those details somewhere to the HDD partition table, or anywhere else and how?

Thank you.