Drive C (Windows System) become RAW after unexpected shutdown Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
konco
Posts: 2
Joined: 15 Jul 2019, 05:08

Drive C (Windows System) become RAW after unexpected shutdown

#1 Post by konco »

I can't boot into windows after getting my laptop shutdown unexpected.

Then i try to put hdd to another laptop with external usb.
I cannot access the drive c, while other drive like system reserved, drive d, drive e i can open the file and folder normally.

i try to find how to fix this. and i found the testdisk.

Here the result after i use the testdisk.

Code: Select all


Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 44/190/19
NTFS at 12748/53/42
Info: size boot_sector 385978361, partition 385978368
NTFS at 36774/64/27
Info: size boot_sector 385994745, partition 385994752
Current partition structure:
 1 * HPFS - NTFS              0  32 33    44 190 18     716800
 2 P HPFS - NTFS             44 190 19 12748  53 41  204081152
 3 P HPFS - NTFS          12748  53 42 36774  64 26  385978368
 4 P HPFS - NTFS          36774  64 27 60801  80 15  385994752

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           716800
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    44 190 18     716800
     NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size           204081152
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             44 190 19 12748  53 41  204081152
     NTFS, blocksize=4096, 104 GB / 97 GiB
NTFS at 12748/53/42
filesystem size           385978361
sectors_per_cluster       8
mft_lcn                   10109
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          12748  53 42 36774  64 19  385978361
     NTFS, blocksize=4096, 197 GB / 184 GiB
NTFS at 36774/64/27
filesystem size           385994745
sectors_per_cluster       8
mft_lcn                   10109
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          36774  64 27 60801  80  8  385994745
     NTFS, blocksize=4096, 197 GB / 184 GiB
file_pread(5,3,buffer,976773176(60801/81/9)) lseek err Invalid argument
file_pread(5,1,buffer,976773176(60801/81/9)) lseek err Invalid argument
file_pread(5,8,buffer,976773192(60801/81/25)) lseek err Invalid argument
file_pread(5,11,buffer,976773239(60801/82/9)) lseek err Invalid argument
file_pread(5,2,buffer,976775161(60801/112/41)) lseek err Invalid argument
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,7,buffer,976773200(60801/81/33)) lseek err Invalid argument
file_pread(5,7,buffer,976773250(60801/82/20)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,16,buffer,976773168(60801/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,976773186(60801/81/19)) lseek err Invalid argument
file_pread(5,3,buffer,976773231(60801/82/1)) lseek err Invalid argument
file_pread(5,11,buffer,976773294(60801/83/1)) lseek err Invalid argument
file_pread(5,2,buffer,976775216(60801/113/33)) lseek err Invalid argument

Results
     HPFS - NTFS              0  32 33    44 190 18     716800
     NTFS, blocksize=4096, 367 MB / 350 MiB
     HPFS - NTFS             44 190 19 12748  53 41  204081152
     NTFS, blocksize=4096, 104 GB / 97 GiB
     HPFS - NTFS          12748  53 42 36774  64 26  385978368
     NTFS, blocksize=4096, 197 GB / 184 GiB
     HPFS - NTFS          36774  64 27 60801  80 15  385994752
     NTFS, blocksize=4096, 197 GB / 184 GiB
NTFS Volume is dirty.
Then after make analyze.

Image

Why all four parttition become deleted?

I can list the file on second partition that is the drive c (windows system).

Code: Select all

dir_partition inode=5
     HPFS - NTFS             44 190 19 12748  53 41  204081152
     NTFS, blocksize=4096, 104 GB / 97 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 25-Apr-2019 09:06 .
       5 dr-xr-xr-x     0      0         0 25-Apr-2019 09:06 ..
      59 dr-xr-xr-x     0      0         0  9-May-2016 08:27 $Recycle.Bin
   19810 dr-xr-xr-x     0      0         0 28-Jul-2016 06:54 $SysReset
      45 dr-xr-xr-x     0      0         0 23-Apr-2017 22:47 $WINDOWS.~BT
  109558 dr-xr-xr-x     0      0         0 13-Sep-2016 19:04 $Windows.~WS
   99646 dr-xr-xr-x     0      0         0 28-Jul-2016 00:26 AMD
  101482 dr-xr-xr-x     0      0         0 25-Apr-2019 09:07 Config.Msi
   18873 dr-xr-xr-x     0      0         0 22-Aug-2013 21:45 Documents and Settings
   19489 dr-xr-xr-x     0      0         0 13-Sep-2016 20:26 ESD
  215143 dr-xr-xr-x     0      0         0 12-Feb-2019 20:49 Fraps
  173915 dr-xr-xr-x     0      0         0 30-Dec-2016 11:08 GarenaDownload
   55153 dr-xr-xr-x     0      0         0  9-May-2016 07:12 Intel
  116020 dr-xr-xr-x     0      0         0  9-May-2016 23:33 MSOCache
      60 dr-xr-xr-x     0      0         0 22-Aug-2013 22:22 PerfLogs
      61 dr-xr-xr-x     0      0         0 19-Apr-2019 19:57 Program Files
    1995 dr-xr-xr-x     0      0         0 19-Apr-2019 19:52 Program Files (x86)
    2051 dr-xr-xr-x     0      0         0  7-Jul-2019 17:10 ProgramData
  119240 dr-xr-xr-x     0      0         0 20-Oct-2018 09:15 Python27
  169692 dr-xr-xr-x     0      0         0 28-Jul-2016 22:03 Recovery
   97156 dr-xr-xr-x     0      0         0 17-May-2017 05:57 SWSetup
   95106 dr-xr-xr-x     0      0         0 11-Jul-2019 11:50 System Volume Information
  191108 dr-xr-xr-x     0      0         0 17-May-2017 05:22 System.sav
    2171 dr-xr-xr-x     0      0         0  9-May-2016 06:11 Users
    2223 dr-xr-xr-x     0      0         0 26-Apr-2019 08:00 Windows
  101277 dr-xr-xr-x     0      0         0 14-Nov-2017 17:35 [Smad-Cage]
  185530 dr-xr-xr-x     0      0         0 26-Nov-2016 15:23 usr
    1462 dr-xr-xr-x     0      0         0 15-Jun-2016 09:01 xampp
  177573 -r--r--r--     0      0      1024 26-Nov-2016 16:23 .rnd
   18867 -r--r--r--     0      0         1 18-Jun-2013 19:18 BOOTNXT
   18872 -r--r--r--     0      0    404250 21-Nov-2014 16:17 bootmgr
     360 -r--r--r--     0      0 3371466752 15-Jun-2019 15:49 hiberfil.sys
   65844 -r--r--r--     0      0 1711599616  8-Jul-2019 15:07 pagefile.sys
     365 -r--r--r--     0      0 268435456 15-Jun-2019 15:49 swapfile.sys
    1462 -r--r--r--     0      0         0 15-Jun-2016 09:01 xampp:Win32App_1

I can copy the file too.

Then how to fix this partition so it can booting again to windows?
Last edited by konco on 16 Jul 2019, 04:23, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Drive C (Windows System) become RAW after unexpected shutdown

#2 Post by cgrenier »

Run "cmd" (right click "run as Administrator") and "chkdsk /f d:" (replace d: by the correct drive letter).
Does it work ?

konco
Posts: 2
Joined: 15 Jul 2019, 05:08

Re: Drive C (Windows System) become RAW after unexpected shutdown

#3 Post by konco »

cgrenier wrote: 15 Jul 2019, 20:05 Run "cmd" (right click "run as Administrator") and "chkdsk /f d:" (replace d: by the correct drive letter).
Does it work ?
Thank you very much sir. I can see my drive c again. After usn journal veryfication complete take 20 minutes to complete.

Locked