Page 2 of 4

Re: Repairing an NTFS

Posted: 15 Mar 2012, 09:44
by veleiro
I went ahead with the instructions.


Change partition type:
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
Change partition type:
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(5,16,buffer,1927445824(119977/243/11)) read err: Invalid argument
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

Re: Repairing an NTFS

Posted: 15 Mar 2012, 09:48
by Fiona
It's only a diagnose.
Until you don't confirm at Write, you'll change nothing.
So you shouldn't write anything and it's intended only for diagnosis purposes.
Currently your partition is aligned on megabyte boundary.
I selected the default MBR option. On top of that, I assigned the drive a letter.
Might be your accidentally created one?
Please check it first.

Fiona

Re: Repairing an NTFS

Posted: 15 Mar 2012, 10:14
by veleiro
Fiona wrote:It's only a diagnose.
Until you don't confirm at Write, you'll change nothing.
So you shouldn't write anything and it's intended only for diagnosis purposes.
Currently your partition is aligned on megabyte boundary.
I selected the default MBR option. On top of that, I assigned the drive a letter.
Might be your accidentally created one?
Please check it first.

Fiona
Yes, Windows 7 created a MBR on the drive, and I gave it a letter, thats the original problem

Re: Repairing an NTFS

Posted: 15 Mar 2012, 10:24
by Fiona
Could you do that diagnose first?
If it doesn't help, please create a backup as you suggested.
Then we'll go further to delete your accidentally created partition and adding an intel partition manually to have a boot sector diagnose.

I still struggle about your issue, that GetDataBACK didn't find anything in your sectors?
It's a strange behavior.

Re: Repairing an NTFS

Posted: 15 Mar 2012, 21:04
by veleiro
i posted the log of the diagnosis above, from the RebuildFS, as it didnt work

Re: Repairing an NTFS

Posted: 16 Mar 2012, 01:00
by Fiona
Start Testdisk.
Confirm through testdisk until you see Analyse.
Your affected disk must be selected.
Confirm at Analyse and highlight Backup.
Press Enter.
If there appears a message like "do you want to search for partitions created under vista, conform with y (yes).
If Quick Search is starting any search, finish it pressing Enter for stop!
Afterwards your screen should look like this;

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63

Press a to add another partition
The menu should look like this;

[ Cylinders ] [ Heads ] [ Sectors ] [ Cylinders ] [ Heads ] [ Sectors ] [ Type ] [ Done ]
......0....... .....1..........1..........121601.......254........63.........07.....[Enter]
the Type 07 is for NTFS
Please enter exactly these values!

After confirm at [Done], you will get back to the previous screen.

In case, check your added partition, it must be primary (P).
You can check it at the left side must be a P for primary.
If not, use your arrow keys.

Press enter to proceed.

Write your partition table at Write.

Now you have an empty unformatted partition.
Don't format it, you would override your underlying file system.

Confirm in TestDisk through until you see the menu Analyse.
Don't confirm at Analyse but Advanced.
Highlight your affected partition and confirm at Boot.
Highlight Rebuild BS and hit Enter.
Rebuild BS will be in progress.
Normally, it takes some minutes.
If it's finished, please post the infos or upload a screen.
If you see a menu List, please highlight it and press enter.
Please let me know, do you see your data or an error message.
To get back to the previous screen, easily press q for Quit.

Re: Repairing an NTFS

Posted: 16 Mar 2012, 08:08
by veleiro
I had to go through the whole thing on RebuildFS, so it took 4 hours, and it still had the same result.

This time I attached the log because it was longer
http://www.mediafire.com/?x7403dwge47qlx8

Re: Repairing an NTFS

Posted: 16 Mar 2012, 09:25
by Fiona
Sry I've seen something wrong.
I've used your screen from here, if you watch your disk;
http://forum.cgsecurity.org/phpBB3/down ... php?id=144
The amount of cylinders is 121602 but it's 121601.
See your last screen.
So it might be necessary to add your partition again using the following values;
[ Cylinders ] [ Heads ] [ Sectors ] [ Cylinders ] [ Heads ] [ Sectors ] [ Type ] [ Done ]
......0....... .....1..........1..........121600.......254........63.........07.....[Enter]

The value is 121600 now!

Sry for the inconvenience!

Fiona

Re: Repairing an NTFS

Posted: 16 Mar 2012, 23:05
by veleiro
Ok, then here is the latest log/screenshots



Fri Mar 16 07:05:16 2012
Command line: TestDisk

Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=159934054400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=8066271232
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000210466304
file_pread(4,1,buffer,312581919(73444/223/19)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 73444 224 19, sector size=512 - WDC WD1600JB-00EVA0, S/N:4457572d414d4b45303332343534 034 0 0 0 0, FW:15.05R15
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EADS-11M2B2, S/N:2020202057202d44435756414335313134383337, FW:80.00A80
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500KS-00MJB0, S/N:2020202057202d4443574e41334b313539353935, FW:02.01C03
Drive E: - 8066 MB / 7692 MiB - CHS 1923 64 32, sector size=2048 - ASUS DRW-1608P3S, FW:1.06

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD10EADS-11M2B2
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
Change partition type:
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
Not an exFAT boot sector.
Not an exFAT boot sector.

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
Backup partition structure
partition_save
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Search for partition aborted

Results
Change partition type:
HPFS - NTFS 0 1 1 121600 254 63 1953520002

interface_write()
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(5,16,buffer,1927445823(119977/243/10)) read err: Invalid request code
file_pread(5,16,buffer,1927446976(119978/6/29)) read err: Invalid request code
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

Re: Repairing an NTFS

Posted: 17 Mar 2012, 11:09
by cgrenier
An NTFS filesystem contains an MFT and an MFT Mirror. When using RebuildBS, TestDisk searches for both copies but in your case, it has found none, the same result you get with GetDataBack.
Are you sure the partition was an NTFS and not a FAT32 or exFAT ?
In the Advanced menu, force the type to FAT32 LBA and try again Boot, RebuildBS, List. Choose Write if it works.