FAT12 Partition that actually is NTFS

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Dan1
Posts: 3
Joined: 20 May 2019, 08:48

FAT12 Partition that actually is NTFS

#1 Post by Dan1 »

Hello everyone,

I do have a problem with one of my harddisks, since I can't get ahead with it I thought I'd ask here. I will start descrbing my problem from the very beginning:

What happened before recovery:
- My computer was running, I left it and when I came back the screen was turned black. Since I couldn't do anything to change that I turned off the computer by the on/off switch and it immedieatly turned off without pushing it for six seconds.
- Upon reboot the Windows bootmanager reported it could not find the hard disk with operating system
- The hard disk is a 1TB Samsung disc, partitioned into three parts: 100 Mb Windows 7 bootloader partition, 30 Gb partition, that I used for backups (it's not the only device I used for backups) and a 900 Gb partition that I used for my operating system, programs, games etc.
- Now I put in a Knoppix to see whats gone and what not. On that harddisk 100 Mb and the 30 Gb partition were still accessibile und luckily I could save all data that was not mirror anywhere else. For the 900 Gb partition it could not be loaded and the content could not be viewed or saved


Recovery with Testdisk:
- So I removed the hard disk, connected it by a special adapter the Usb of my laptop, and looked into the Windows Disk Management. The 900 Gb partition was shown to be "raw", the others were fine.
- Then I loaded Testdisk and run it over the hard disk. I took one of the tutorials that exist, Testdisk correctly found all partitions.
- First I chose the broken Partition for repair and Testdisk identified it as an "other" kind of partition. Since that wasnt the case I went back, chose the whole physical drive for testing and Testdisk identified it as Intel/PC partitions.
- The Quick Searched then revealed the problem I have now: It found the two small partitions (100 Mb and 30 Gb) just fine and labeled them as (* (bootable) und p (primary)) - also their files were browsable. The third partition it did not find, but it found a very large FAT12 partition it was unable to repair because the "hard disk seems to small".


Going into deep search did not help much (Screenshots attached):
- It also complained about the FAT12 partition during Deeper Search and told the same "hard disk seems to small" problem.
- After that it mentioned that the Number of heads per cylinder is 255 which might be wrong. 128 could be correct. However I read on the internet 255 is quite normal for NTFS
- It found the 100 Mb partition, which was as usual, the 30 Gb partition, which was now flagged as deleted (with a D), but both were still browsable. It also found another partition of the same size as the 30 Gb partition but it wasn't accessible (Sectors started with the end of the first 30 Gb partition). And then there was fourth partition that overlapped with others. It was browsable but empty. The two latter were also flagged as deleted (D).

General things:
- I suppose the lost partition was not a boot partition, since the bootloader for Windows 7 was on a different partition, that is a boot partition, right?
- I actually do not really know what file system was used for the lost partition. But I am quite certain it was NTFS and I am very certain it was not FAT12

And now I do not know what to do. I didn't find similar issues on the net (or was just unable to search properly) and I hope that someone of you might have an idea or two. I'd be grateful

Thanks, Daniel
Attachments
partitionen.PNG
partitionen.PNG (27.22 KiB) Viewed 1896 times
numberofcylinders.PNG
numberofcylinders.PNG (22.12 KiB) Viewed 1896 times
disktoosmall.PNG
disktoosmall.PNG (20.45 KiB) Viewed 1896 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: FAT12 Partition that actually is NTFS

#2 Post by cgrenier »

You can ignore the FAT12.
Run TestDisk, Advanced, select the last NTFS partition, if should start at cylinder 4015 and ends at 121601, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.

Dan1
Posts: 3
Joined: 20 May 2019, 08:48

Re: FAT12 Partition that actually is NTFS

#3 Post by Dan1 »

Hi, thanks for the quick reply!

I did as you told me; however, after RebuildBS I tried to list the files and there were none. The only thing shown were two directories labeled ".." and "." - it was shown exactly the same content when I looked into this partition after deeper search. (as described in my first post) I attached the status message from RebuildBS and the fileslist as images. I am unsure what to do now - does this mean my files are lost?

(Since I couldn't see my files I chose the option quit after until the program was closed)

Thanks for your efforts so far!
Attachments
file_list.PNG
file_list.PNG (19.11 KiB) Viewed 1887 times
statusafterrebuildbs.PNG
statusafterrebuildbs.PNG (21.75 KiB) Viewed 1887 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: FAT12 Partition that actually is NTFS

#4 Post by cgrenier »

AFter rebuilding this partition, can you try Undelete also in the Advanced menu ?
If it doesn't work, use PhotoRec on this partition. Note that you need enough space to store the recovered files on another partition.

Dan1
Posts: 3
Joined: 20 May 2019, 08:48

Re: FAT12 Partition that actually is NTFS

#5 Post by Dan1 »

Hi,

using undelete after rebuild BS yielded me the error message: "Can't open filesystem. Filesystem seems damaged". Considering your suggestion on photorec I assume that means the partition can't be recovered, I have to retrieve the data with photorec, save it somewhere else and then I have to format the damaged partition to make the space usable again, correct? Sorry if I may ask obvious questions here, I am not much into partitions an file systems.

Locked