Please help, I am in a bit of trouble.
256GB SSD - DUAL BOOT
sda1 - winXP FAT32
sda2/5/6 - ubuntu EXT4
1TB INTERNAL SAMSUNG HDD
sdb1 NTFS (has had EXT on it previously)
2TB EXTERNAL WD HDD
sdc1 originally EXT4, reformatted to NTFS
When sdc1 was ext4. I had some pictures stored on it. The wife wanted to use the external hdd on her laptop and I no longer had a use for it, so I copied all the data to sdb1 and reformatted sdc1 to NTFS
I then started copying the data from sdb1 to sdc1, part way through the copy it threw an error that unfortunately I cannot remember it, from memory something about target file not found and sdb1 was no longer mounted.
using disk 3.6.1 under ubuntu sdb1 reported as unallocated. I also looked it using GParted, same report, ran gpart recover without any luck.
after googling for a while, I tried this; http://www.rodsbooks.com/missing-parts/ without luck.
I then found testdisk and this long log below shows the mess I am now in.
Is there anyway to restore the previous file system on sdc1 to recover the original data or can I recover the partition and data from sdb? Any help is greatly appreciated, I have a very unhappy wife atm. I apologise for the long log, I am not sure what information is required and not and it shows the mess I have got myself into. I have left out a file list as the file names have sensitive names.
Help, sorry story, wife wants her pictures back
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Re: Help, sorry story, wife wants her pictures back
Code: Select all
Sun Dec 23 10:37:21 2012
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.0-21-generic (#32-Ubuntu SMP Tue Dec 11 18:52:46 UTC 2012) i686
Compiler: GCC 4.7
Compilation date: 2012-10-01T12:56:22
ext2fs lib: 1.42.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 500118192 sectors
/dev/sda: user_max 500118192 sectors
/dev/sda: native_max 500118192 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 1953525168 sectors
/dev/sdb: user_max 1953525168 sectors
/dev/sdb: native_max 1953525168 sectors
/dev/sdb: dco 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - LZT-256, S/N:002226106791, FW:ZZA3
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SI, S/N:S1VSJ9CS910381, FW:1AG01118
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WD Ext HDD 1021, FW:2021
Disk /dev/mapper/cryptswap1 - 3082 MB / 2940 MiB - CHS 6021120 1 1, sector size=512
Disk /dev/dm-0 - 3082 MB / 2940 MiB - CHS 6021120 1 1, sector size=512
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - SAMSUNG HD103SI
Partition table type: Intel
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=27 sector=57
check_part_i386 failed for partition type 83
Current partition structure:
No ext2, JFS, Reiser, cramfs or XFS marker
1 * Linux 0 32 31 31 26 57 497664
1 * Linux 0 32 31 31 26 57 497664
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 244188927
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907022848, end=3907024895, disk end=1953536130)
block_group_nr 25
recover_EXT2: "e2fsck -b 204801 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=25/30, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=4016
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 248832
recover_EXT2: part_size 497664
Linux 0 32 31 31 26 57 497664
EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
LVM2 magic value at 31/59/29
part_size 1953021952
Linux LVM 31 59 29 121601 57 56 1953021952
LVM2, 999 GB / 931 GiB
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, 2000 GB / 1863 GiB
Results
* Linux 0 32 31 31 26 57 497664
EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
P Linux LVM 31 59 29 121601 57 56 1953021952
LVM2, 999 GB / 931 GiB
interface_write()
1 * Linux 0 32 31 31 26 57 497664
2 P Linux LVM 31 59 29 121601 57 56 1953021952
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 244188927
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907022848, end=3907024895, disk end=1953536130)
block_group_nr 25
recover_EXT2: "e2fsck -b 204801 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=25/30, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=4016
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 248832
recover_EXT2: part_size 497664
Linux 0 32 31 31 26 57 497664
EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
block_group_nr 27
recover_EXT2: "e2fsck -b 221185 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=27/30, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=4016
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 248832
recover_EXT2: part_size 497664
Linux 0 32 31 31 26 57 497664
EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
LVM2 magic value at 31/59/29
part_size 1953021952
Linux LVM 31 59 29 121601 57 56 1953021952
LVM2, 999 GB / 931 GiB
NTFS at 31/91/61
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 1946902528
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 121681407
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 31 91 61 121220 111 43 1946902528 [New Volume]
NTFS, 996 GB / 928 GiB
BAD_RS LBA=2994796758 10956425
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 186417 121 31 371271 71 43 2969676373
This partition ends after the disk limits. (start=2994796758, size=2969676373, end=1669505834, disk end=1953536130)
recover_EXT2: s_block_group_nr=0/7429, s_mnt_count=84/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 243437312
recover_EXT2: part_size 1947498496
Linux 60590 149 40 181816 194 10 1947498496
EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
This partition ends after the disk limits. (start=973387776, size=1947498496, end=2920886271, disk end=1953536130)
recover_EXT2: s_block_group_nr=0/7429, s_mnt_count=84/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 243437312
recover_EXT2: part_size 1947498496
Linux 60595 239 61 181822 29 31 1947498496
EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
This partition ends after the disk limits. (start=973473792, size=1947498496, end=2920972287, disk end=1953536130)
recover_EXT2: s_block_group_nr=0/7426, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 243362816
recover_EXT2: part_size 1946902528
Linux 60621 176 36 181810 196 18 1946902528
EXT4 Large file Sparse superblock Recover, 996 GB / 928 GiB
This partition ends after the disk limits. (start=973887488, size=1946902528, end=2920790015, disk end=1953536130)
NTFS at 63740/254/63
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS found using backup sector!, 524 GB / 488 GiB
recover_EXT2: s_block_group_nr=0/3703, s_mnt_count=35/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 121341440
recover_EXT2: part_size 970731520
Linux 90850 12ntfs_mst_post_read_fixup_warn: magic: 0xe956b207 size: 1024 usa_ofs: 9140 usa_count: 19765: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x89215c45 size: 1024 usa_ofs: 17574 usa_count: 19662: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x064cc1b8 size: 1024 usa_ofs: 14906 usa_count: 37342: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x1021cc78 size: 1024 usa_ofs: 2020 usa_count: 51759: Invalid argument
$MFTMirr does not match $MFT (record 0).
8 31 151275 190 19 970731520
EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
This partition ends after the disk limits. (start=1459513344, size=970731520, end=2430244863, disk end=1953536130)
recover_EXT2: s_block_group_nr=0/3703, s_mnt_count=35/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 121341440
recover_EXT2: part_size 970731520
Linux 90852 138 39 151277 200 27 970731520
EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
This partition ends after the disk limits. (start=1459546112, size=970731520, end=2430277631, disk end=1953536130)
recover_EXT2: s_block_group_nr=0/3703, s_mnt_count=35/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 121341440
recover_EXT2: part_size 970731520
Linux 90854 51 14 151279 113 2 970731520
EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
This partition ends after the disk limits. (start=1459572736, size=970731520, end=2430304255, disk end=1953536130)
NTFS at 121220/111/43
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 1946902528
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 121681407
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 31 91 61 121220 111 43 1946902528 [New Volume]
NTFS found using backup sector!, 996 GB / 928 GiB
NTFS at 121601/57/56
filesystem size 1953521664
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 122095103
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 57 56 1953521664
NTFS found using backup sector!, 1000 GB / 931 GiB
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3053 GB / 2844 GiB)
The following partitions can't be recovered:
HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, 2000 GB / 1863 GiB
Linux 60590 149 40 181816 194 10 1947498496
EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
Linux 60595 239 61 181822 29 31 1947498496
EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
Linux 60621 176 36 181810 196 18 1946902528
EXT4 Large file Sparse superblock Recover, 996 GB / 928 GiB
Linux 90850 128 31 151275 190 19 970731520
EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
Linux 90852 138 39 151277 200 27 970731520
EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
Linux 90854 51 14 151279 113 2 970731520
EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
FAT12 186417 121 31 371271 71 43 2969676373
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS found using backup sector!, 524 GB / 488 GiB
Linux 0 32 31 31 26 57 497664
EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
HPFS - NTFS 0 32 33 121601 57 56 1953521664
NTFS found using backup sector!, 1000 GB / 931 GiB
Linux LVM 31 59 29 121601 57 56 1953021952
LVM2, 999 GB / 931 GiB
HPFS - NTFS 31 91 61 121220 111 43 1946902528 [New Volume]
NTFS, 996 GB / 928 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem nntfs_mst_post_read_fixup_warn: magic: 0x92be7b4a size: 4096 usa_ofs: 781 usa_count: 57046: Invalid argument
Actual VCN (0x4e423a22f1610ca5) of index buffer is different from expected VCN (0x0) in inode 0x5.
eed to be repaired.
dir_partition inode=5
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS found using backup sector!, 524 GB / 488 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 26-Nov-2012 09:12 .
5 dr-xr-xr-x 0 0 0 26-Nov-2012 09:12 ..
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Re: Help, sorry story, wife wants her pictures back
I think the best option may be to try and recover the original files from the external hdd sdc1.
Any thoughts?
Any thoughts?
Re: Help, sorry story, wife wants her pictures back
Did u manage to recover your data ?