Page 1 of 1

Help, sorry story, wife wants her pictures back

Posted: 22 Dec 2012, 23:51
by Kirk
Please help, I am in a bit of trouble.
256GB SSD - DUAL BOOT
sda1 - winXP FAT32
sda2/5/6 - ubuntu EXT4

1TB INTERNAL SAMSUNG HDD
sdb1 NTFS (has had EXT on it previously)

2TB EXTERNAL WD HDD
sdc1 originally EXT4, reformatted to NTFS

When sdc1 was ext4. I had some pictures stored on it. The wife wanted to use the external hdd on her laptop and I no longer had a use for it, so I copied all the data to sdb1 and reformatted sdc1 to NTFS

I then started copying the data from sdb1 to sdc1, part way through the copy it threw an error that unfortunately I cannot remember it, from memory something about target file not found and sdb1 was no longer mounted.

using disk 3.6.1 under ubuntu sdb1 reported as unallocated. I also looked it using GParted, same report, ran gpart recover without any luck.

after googling for a while, I tried this; http://www.rodsbooks.com/missing-parts/ without luck.

I then found testdisk and this long log below shows the mess I am now in.

Is there anyway to restore the previous file system on sdc1 to recover the original data or can I recover the partition and data from sdb? Any help is greatly appreciated, I have a very unhappy wife atm. I apologise for the long log, I am not sure what information is required and not and it shows the mess I have got myself into. I have left out a file list as the file names have sensitive names.

Re: Help, sorry story, wife wants her pictures back

Posted: 23 Dec 2012, 08:32
by Kirk

Code: Select all

Sun Dec 23 10:37:21 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.0-21-generic (#32-Ubuntu SMP Tue Dec 11 18:52:46 UTC 2012) i686
Compiler: GCC 4.7
Compilation date: 2012-10-01T12:56:22
ext2fs lib: 1.42.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       500118192 sectors
/dev/sda: user_max   500118192 sectors
/dev/sda: native_max 500118192 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       1953525168 sectors
/dev/sdb: user_max   1953525168 sectors
/dev/sdb: native_max 1953525168 sectors
/dev/sdb: dco        1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - LZT-256, S/N:002226106791, FW:ZZA3
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SI, S/N:S1VSJ9CS910381, FW:1AG01118
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WD Ext HDD 1021, FW:2021
Disk /dev/mapper/cryptswap1 - 3082 MB / 2940 MiB - CHS 6021120 1 1, sector size=512
Disk /dev/dm-0 - 3082 MB / 2940 MiB - CHS 6021120 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - SAMSUNG HD103SI
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=27 sector=57
check_part_i386 failed for partition type 83
Current partition structure:
No ext2, JFS, Reiser, cramfs or XFS marker
 1 * Linux                    0  32 31    31  26 57     497664
 1 * Linux                    0  32 31    31  26 57     497664
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size           3907022848
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               244188927
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  13 12 3907022848
     NTFS, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907022848, end=3907024895, disk end=1953536130)

block_group_nr 25

recover_EXT2: "e2fsck -b 204801 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=25/30, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=4016
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 248832
recover_EXT2: part_size 497664
     Linux                    0  32 31    31  26 57     497664
     EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB

LVM2 magic value at 31/59/29
part_size 1953021952
     Linux LVM               31  59 29 121601  57 56 1953021952
     LVM2, 999 GB / 931 GiB
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
     HPFS - NTFS              0  32 33 243201  13 12 3907022848
     NTFS, 2000 GB / 1863 GiB

Results
   * Linux                    0  32 31    31  26 57     497664
     EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
   P Linux LVM               31  59 29 121601  57 56 1953021952
     LVM2, 999 GB / 931 GiB

interface_write()
 1 * Linux                    0  32 31    31  26 57     497664
 2 P Linux LVM               31  59 29 121601  57 56 1953021952

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size           3907022848
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               244188927
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  13 12 3907022848
     NTFS, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=2048, size=3907022848, end=3907024895, disk end=1953536130)

block_group_nr 25

recover_EXT2: "e2fsck -b 204801 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=25/30, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=4016
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 248832
recover_EXT2: part_size 497664
     Linux                    0  32 31    31  26 57     497664
     EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB

block_group_nr 27

recover_EXT2: "e2fsck -b 221185 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=27/30, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=4016
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 248832
recover_EXT2: part_size 497664
     Linux                    0  32 31    31  26 57     497664
     EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB

LVM2 magic value at 31/59/29
part_size 1953021952
     Linux LVM               31  59 29 121601  57 56 1953021952
     LVM2, 999 GB / 931 GiB
NTFS at 31/91/61
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size           1946902528
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               121681407
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             31  91 61 121220 111 43 1946902528 [New Volume]
     NTFS, 996 GB / 928 GiB
BAD_RS LBA=2994796758 10956425
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                186417 121 31 371271  71 43 2969676373
This partition ends after the disk limits. (start=2994796758, size=2969676373, end=1669505834, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7429, s_mnt_count=84/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 243437312
recover_EXT2: part_size 1947498496
     Linux                60590 149 40 181816 194 10 1947498496
     EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
This partition ends after the disk limits. (start=973387776, size=1947498496, end=2920886271, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7429, s_mnt_count=84/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 243437312
recover_EXT2: part_size 1947498496
     Linux                60595 239 61 181822  29 31 1947498496
     EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
This partition ends after the disk limits. (start=973473792, size=1947498496, end=2920972287, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7426, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 243362816
recover_EXT2: part_size 1946902528
     Linux                60621 176 36 181810 196 18 1946902528
     EXT4 Large file Sparse superblock Recover, 996 GB / 928 GiB
This partition ends after the disk limits. (start=973887488, size=1946902528, end=2920790015, disk end=1953536130)
NTFS at 63740/254/63
filesystem size           1023999102
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               63999943
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 63740 254 63 1023999102
     NTFS found using backup sector!, 524 GB / 488 GiB

recover_EXT2: s_block_group_nr=0/3703, s_mnt_count=35/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 121341440
recover_EXT2: part_size 970731520
     Linux                90850 12ntfs_mst_post_read_fixup_warn: magic: 0xe956b207  size: 1024   usa_ofs: 9140  usa_count: 19765: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x89215c45  size: 1024   usa_ofs: 17574  usa_count: 19662: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x064cc1b8  size: 1024   usa_ofs: 14906  usa_count: 37342: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x1021cc78  size: 1024   usa_ofs: 2020  usa_count: 51759: Invalid argument
$MFTMirr does not match $MFT (record 0).
8 31 151275 190 19  970731520
     EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
This partition ends after the disk limits. (start=1459513344, size=970731520, end=2430244863, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/3703, s_mnt_count=35/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 121341440
recover_EXT2: part_size 970731520
     Linux                90852 138 39 151277 200 27  970731520
     EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
This partition ends after the disk limits. (start=1459546112, size=970731520, end=2430277631, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/3703, s_mnt_count=35/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 121341440
recover_EXT2: part_size 970731520
     Linux                90854  51 14 151279 113  2  970731520
     EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
This partition ends after the disk limits. (start=1459572736, size=970731520, end=2430304255, disk end=1953536130)
NTFS at 121220/111/43
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size           1946902528
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               121681407
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             31  91 61 121220 111 43 1946902528 [New Volume]
     NTFS found using backup sector!, 996 GB / 928 GiB
NTFS at 121601/57/56
filesystem size           1953521664
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               122095103
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  57 56 1953521664
     NTFS found using backup sector!, 1000 GB / 931 GiB
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3053 GB / 2844 GiB)
The following partitions can't be recovered:
     HPFS - NTFS              0  32 33 243201  13 12 3907022848
     NTFS, 2000 GB / 1863 GiB
     Linux                60590 149 40 181816 194 10 1947498496
     EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
     Linux                60595 239 61 181822  29 31 1947498496
     EXT4 Large file Sparse superblock Recover, 997 GB / 928 GiB
     Linux                60621 176 36 181810 196 18 1946902528
     EXT4 Large file Sparse superblock Recover, 996 GB / 928 GiB
     Linux                90850 128 31 151275 190 19  970731520
     EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
     Linux                90852 138 39 151277 200 27  970731520
     EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
     Linux                90854  51 14 151279 113  2  970731520
     EXT4 Large file Sparse superblock Recover, 497 GB / 462 GiB
     FAT12                186417 121 31 371271  71 43 2969676373
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
     HPFS - NTFS              0   1  1 63740 254 63 1023999102
     NTFS found using backup sector!, 524 GB / 488 GiB
     Linux                    0  32 31    31  26 57     497664
     EXT2 Sparse superblock Backup superblock, 254 MB / 243 MiB
     HPFS - NTFS              0  32 33 121601  57 56 1953521664
     NTFS found using backup sector!, 1000 GB / 931 GiB
     Linux LVM               31  59 29 121601  57 56 1953021952
     LVM2, 999 GB / 931 GiB
     HPFS - NTFS             31  91 61 121220 111 43 1946902528 [New Volume]
     NTFS, 996 GB / 928 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem nntfs_mst_post_read_fixup_warn: magic: 0x92be7b4a  size: 4096   usa_ofs: 781  usa_count: 57046: Invalid argument
Actual VCN (0x4e423a22f1610ca5) of index buffer is different from expected VCN (0x0) in inode 0x5.
eed to be repaired.


dir_partition inode=5
     HPFS - NTFS              0   1  1 63740 254 63 1023999102
     NTFS found using backup sector!, 524 GB / 488 GiB
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 26-Nov-2012 09:12 .
       5 dr-xr-xr-x     0      0         0 26-Nov-2012 09:12 ..

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Re: Help, sorry story, wife wants her pictures back

Posted: 23 Dec 2012, 21:02
by Kirk
I think the best option may be to try and recover the original files from the external hdd sdc1.

Any thoughts?

Re: Help, sorry story, wife wants her pictures back

Posted: 20 Feb 2013, 14:51
by edu4rd
Did u manage to recover your data ?