Page 2 of 2
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 13:16
by recuperation
slipstream3 wrote: ↑29 Feb 2020, 10:17
Hello,
...suggests you should use GPT instead of Intel/MBR when asked for the partition table type.
I am pretty sure that the drive was originally partitioned with Intel/MBR.
But you used GParted afterwards.
In the meantime I went ahead with Intel table type and recuperated my partitions with data. Is this why I am getting these errors when trying deeper search with GPT, or is GPT incorrect regardless? Keeping in mind that I only went as far as 11% as I had to stop for now.
11% of what?
I went through the deeper search again and went through all the results and found the valid partitions (with all my missing files), but I hit a wall again. I could not change the partitions from deleted to either L or P past 4 of them even excluding the NTFS partition.
Try setting the first one to Primary or bootable and the rest to "logical".
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 13:32
by recuperation
.
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 19:14
by slipstream3
Hello Recuperation!
11% of what?
I meant 11% of a deeper search, at that point at I peferred to shut things down. I could try one last complete deeper search with GPT partition table, but I am pretty sure that my drive was partionned Intel/MBR. In the past, I had previously re-partionned part of the drive with Gparted
without changing the partition table and it was always recognised as msdos and sudo parted -l shows msdos partition table as well. Aren't msdos partition table and Intel/MBR used interchangably?
But you used GParted afterwards.
I deleted my partition in error in gparted first without changing the partition table, then I used testdisk to get my windows partitions back using Intel partition table.
Try setting the first one to Primary or bootable and the rest to "logical".
I tried all combinations: I can change the NTFS and the swap file partitions to P and allow 4 more partitions to be either P or L. Even if I change either partition to P or L seems to make no difference. And its irrelevant if I keep the NTFS and swap partitions deleted or not.
I am rather baffled, and in the meantime I am moving some of my files (from the 4 recovered drives) to my proper backup drive, which is what I was supposed to partition orginally!
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 20:30
by slipstream3
Hello again!
When recovering my files, I found the testdisk.log from
before I recovered the Windows NTFS partitions! It shows the logical partitions that were part of the extended partition, including swap! This is at the stage when I deleted my Windows partitions in Gparted without changing any partition structure.
What can I do at this point, I know I did select 'copy (NTFS) to partition', when testdisk warned that the partitions tables didn't match effectively changing something of the partition table, correct?
https://drive.google.com/file/d/1jeIoGe ... sp=sharing
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 20:40
by recuperation
slipstream3 wrote: ↑29 Feb 2020, 19:14
I deleted my partition in error in gparted first without changing the partition table, then I used testdisk to get my windows partitions back using Intel partition table.
You can't delete any partition without changing the partition table.
I tried all combinations: I can change the NTFS and the swap file partitions to P and allow 4 more partitions to be either P or L. Even if I change either partition to P or L seems to make no difference. And its irrelevant if I keep the NTFS and swap partitions deleted or not.
You ignored my advice. Most of those combinations you mention are technically impossible to realize anyway.
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 21:24
by slipstream3
Hello,
I started doing a complete deeper search first with GPT and then I'll do it once again with Intel/MBR. I will try to change the first partition found that is valid to P then the rest to L and see what happens. Did you have a chance to view the testdisk.log that I recently found? It could be helpful! Thankyou!
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 29 Feb 2020, 23:58
by slipstream3
Here are my partitions after I deleted the windows partitions but before I tried to recover them in test disk, back in January:
Code: Select all
Current partition structure:
1 P Linux 0 32 33 10917 14 41 175380480 [Movies and Shows]
3 E extended 10917 47 9 60801 80 15 801388546
No partition is bootable
5 L Linux 30816 96 1 33941 153 3 50206719
X extended 60278 97 44 60801 80 15 8400896
6 L Linux Swap 60278 130 13 60801 80 15 8398848
X extended 42390 154 5 60278 97 43 287367168
7 L Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
X extended 14375 0 1 22941 43 14 137615513
8 L Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
X extended 10917 47 10 14374 239 38 55548830
9 L Linux 10917 47 11 14374 239 38 55548829 [KxStudio_14]
X extended 33941 153 4 42390 154 4 135733249
10 L Linux 33941 153 5 42390 154 4 135733248
X extended 22941 43 15 30816 63 31 126513152
11 L Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
and
Code: Select all
Results
HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS found using backup sector, blocksize=4096, 1572 MB / 1500 MiB
Linux 0 32 33 10917 14 41 175380480 [Movies and Shows]
ext4 blocksize=4096 Large_file Sparse_SB, 89 GB / 83 GiB
HPFS - NTFS 191 89 27 10916 237 9 172306432
NTFS, blocksize=4096, 88 GB / 82 GiB
Linux 10917 47 11 14375 2 27 55549952 [KxStudio_14]
ext4 blocksize=4096 Large_file Sparse_SB, 28 GB / 26 GiB
Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
ext4 blocksize=4096 Large_file Sparse_SB, 70 GB / 65 GiB
Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
ext4 blocksize=4096 Large_file Sparse_SB, 64 GB / 60 GiB
Linux 30816 96 1 33941 153 4 50206720
ext4 blocksize=4096 Large_file Sparse_SB Recover, 25 GB / 23 GiB
Linux 33941 153 5 42390 154 4 135733248
ext4 blocksize=4096 Large_file Sparse_SB Recover, 69 GB / 64 GiB
Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
ext4 blocksize=4096 Large_file Sparse_SB, 147 GB / 137 GiB
Linux Swap 60278 130 13 60801 80 15 8398848
SWAP2 version 1, pagesize=4096, 4300 MB / 4101 MiB
and what I did in testdisk:
Code: Select all
interface_write()
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
2 P HPFS - NTFS 191 89 27 10916 237 9 172306432
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS found using backup sector, blocksize=4096, 1572 MB / 1500 MiB
NTFS at 0/32/33
filesystem size 1 3072000
sectors_per_cluster 0 8
mft_lcn 0 128000
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS found using backup sector, blocksize=4096, 1572 MB / 1500 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.
TestDisk exited normally.
Finally what I recuperated recently:
Code: Select all
Current partition structure:
1 P HPFS - NTFS 191 89 27 10916 237 9 172306432
2 E extended LBA 14374 224 59 60278 97 43 737439744
3 * Linux Swap 60278 130 13 60801 80 15 8398848
5 L Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
X extended 22941 74 1 30816 63 31 126511213
6 L Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
X extended 33941 152 1 42390 154 4 135733315
7 L Linux 33941 153 5 42390 154 4 135733248
X extended 42390 185 1 60278 97 43 287365219
8 L Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
Results
Linux 0 32 33 10917 14 41 175380480 [Movies and Shows]
ext4 blocksize=4096 Large_file Sparse_SB, 89 GB / 83 GiB
Linux 10917 47 11 14375 2 27 55549952 [KxStudio_14]
ext4 blocksize=4096 Large_file Sparse_SB, 28 GB / 26 GiB
Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 70 GB / 65 GiB
Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
ext4 blocksize=4096 Large_file Sparse_SB, 64 GB / 60 GiB
Linux 30816 96 1 33941 153 4 50206720
ext4 blocksize=4096 Large_file Sparse_SB, 25 GB / 23 GiB
Linux 33941 153 5 42390 154 4 135733248
ext4 blocksize=4096 Large_file Sparse_SB Recover, 69 GB / 64 GiB
Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 147 GB / 137 GiB
Linux Swap 60278 130 13 60801 80 15 8398848
SWAP2 version 1, pagesize=4096, 4300 MB / 4101 MiB
Note: using deeper search with GPT partition table resulted in hundreds and hundreds of entries and I gave up sifting to see what files were in each partition including:
Code: Select all
dir_partition inode=0
MS Data 524935747 524938626 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
I noted that GPT partitionning allowed only Primary or deleted as options for recovery.
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 01 Mar 2020, 21:20
by recuperation
Thank you for providing better information now. I was about to stop trying to help.
I checked my only Windows 7 Installation (32-bit, non-UEFI) to learn that Windows placed partitions directly on after another without any free space. That means that the old school Intel/MBR can be used.
I can only guess that Testdisk expects free space between your windows partitions because of the bunch of extended partitions that had been created by your linux installations.
Code: Select all
interface_write()
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
2 P HPFS - NTFS 191 89 27 10916 237 9 172306432
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS found using backup sector, blocksize=4096, 1572 MB / 1500 MiB
NTFS at 0/32/33
You would need to manually add the first partition (just above).
Despite one log you showed it had not been integrated into the structure.
You might need to do stuff according to your individual boot manager setup.
You probably did not boot from your Linux swap partition "*".
There might be an extended partition "x" missing labeled number 4.
Strangely you did not say a word about accesibility of your partitions although they all showed up.
Code: Select all
Current partition structure:
1 P HPFS - NTFS 191 89 27 10916 237 9 172306432
2 E extended LBA 14374 224 59 60278 97 43 737439744
3 * Linux Swap 60278 130 13 60801 80 15 8398848
5 L Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
X extended 22941 74 1 30816 63 31 126511213
6 L Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
X extended 33941 152 1 42390 154 4 135733315
7 L Linux 33941 153 5 42390 154 4 135733248
X extended 42390 185 1 60278 97 43 287365219
8 L Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
Results
Linux 0 32 33 10917 14 41 175380480 [Movies and Shows]
ext4 blocksize=4096 Large_file Sparse_SB, 89 GB / 83 GiB
Linux 10917 47 11 14375 2 27 55549952 [KxStudio_14]
ext4 blocksize=4096 Large_file Sparse_SB, 28 GB / 26 GiB
Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 70 GB / 65 GiB
Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
ext4 blocksize=4096 Large_file Sparse_SB, 64 GB / 60 GiB
Linux 30816 96 1 33941 153 4 50206720
ext4 blocksize=4096 Large_file Sparse_SB, 25 GB / 23 GiB
Linux 33941 153 5 42390 154 4 135733248
ext4 blocksize=4096 Large_file Sparse_SB Recover, 69 GB / 64 GiB
Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 147 GB / 137 GiB
Linux Swap 60278 130 13 60801 80 15 8398848
SWAP2 version 1, pagesize=4096, 4300 MB / 4101 MiB
Re: wiped out extended and logical partitions after trying to recover NTFS partition
Posted: 05 Mar 2020, 05:06
by slipstream3
Hello,
Got a chance to give an update now! I am not clear on adding the partition manually for Windows, but I had an issue with my 2 linux root partitions that I couldn't figure out. Even if I left every other partitions as deleted, testdisk warned of these partitions as being: structure: bad, even if these root partitions were verified to be the correct partitions. At least I had my 2 home and 2 data partitions, which after a final deeper search, were still accepted by test disk as extended partitions, and the swap partition as well, and the Windows as Primary, so I wrote to disk again just as a re-confirmation for myself.
You were wondering how I accessed all my drives; originally, I was planning on just re-installing grub2. At this point I was running out of time for resolving this & since this laptop is now mostly a multimedia computer, I could allow myself to just wipe Windows at this point, and make some space for a new Ubuntu installation. (I was able to retrieve all needed files from the live disk)).
I re-installed a fresh version of Ubuntu with updated software, and at least I can replace all my lost software gradually if needed. I love open source based software and OS because it is so flexible among many things!
I wish we could have figured out why testdisk rejected recovering the 2 root drives? thankyou for your help as I am more clear on things at least!
Results
Linux 0 32 33 10917 14 41 175380480 [Movies and Shows]
ext4 blocksize=4096 Large_file Sparse_SB, 89 GB / 83 GiB
Linux 10917 47 11 14375 2 27 55549952 [KxStudio_14] /
ext4 blocksize=4096 Large_file Sparse_SB, 28 GB / 26 GiB
Linux 14375 2 28 22941 43 14 137615360 [KxStudio_Home]
ext4 blocksize=4096 Large_file Sparse_SB, 70 GB / 65 GiB
Linux 22941 75 47 30816 63 31 126511104 [Multimedia]
ext4 blocksize=4096 Large_file Sparse_SB, 64 GB / 60 GiB
Linux 30816 96 1 33941 153 4 50206720
ext4 blocksize=4096 Large_file Sparse_SB, 25 GB / 23 GiB /
Linux 33941 153 5 42390 154 4 135733248
ext4 blocksize=4096 Large_file Sparse_SB, 69 GB / 64 GiB
Linux 42390 186 37 60278 97 43 287365120 [MultimediaII]
ext4 blocksize=4096 Large_file Sparse_SB, 147 GB / 137 GiB
Linux Swap 60278 130 13 60801 80 15 8398848
SWAP2 version 1, pagesize=4096, 4300 MB / 4101 MiB
If there is ever another issue requiring testdisk, and If testdisk gives any warning message; I will NOT copy to partition and write to disk- before asking questions on this forum first, as I am sure the issue would have been much simpler to resolve.