boot sector and backup both OK but NOT identical.

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
oricooo
Posts: 2
Joined: 12 Feb 2013, 13:16

boot sector and backup both OK but NOT identical.

#1 Post by oricooo »

Hi,

I think I am not far from solving my issue but I guess I need a small help to fix the file system. I made both a short and long description to save your time if the problem is trivial. Thanks !

== SHORT STORY ==
I have used Testdisk to the best of my knowledge (so far) to recover a 1,8To ntfs partition. This data-only (no OS) 2Tb Barracuda has (normally) a single partition that went from ntfs to raw (cf below for context) for no identified reason (cf long desc). HDD seems in good physical shape.
Thanks to Deep Search, I finally found and reactivated the correct full disk 1,8Tb ntfs partition (that "seems" to be (partially/fully ?) recoverable by GetDataBAck Trial) but I can't still get the file listed in TestDisk. I'd rather fully fix the file system instead of just recovering.

The partition identified in the log as /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63

Log file http://pastebin.com/7NvH64G9

==> Where I'm stuck <==
As I still can't list the files, and I'd like to fix the file system. I tried to fix the boot but :
=> curiously boot sector and its backup are both considered OK although NOT identical. As it looks odd and is not documented, I avoided to make any stupid assumption, and ask for help on the right/safest way to cleanly fix the file system. This Can be seen at the very end of the log.

As the correct partition was found thanks to the backup boot sector, I guess this is the one to trust (I it would seem more logical), but :
1/ I'm not sure
+
2/ it's not clear to me whether overwriting the main boot sector (which is also marked as valid) with backup is irreversible or if it is just simulated by TestDisk until confirmed by WRITE.

Please find further description of the whole context below + log file at http://pastebin.com/7NvH64G9

Thanking you in advance.

NB: Anyways, even if my problem is not fully sorted yet, I really thank the Testdisk devs and community for this fantastic tool, as the tool itself + the docs already helped me to progress to the point where I "should" be able, at least, to recover (most or all, I don't know) of my data through another tool.

=== LONG VERSION WITH CONTEXT ===

= HOW IT HAPPENED =
I use a 2Tb barracuda with a single full disk ntfs partition for data only (no OS). I use it either at work via a sata bay, or at home via a usb 2-disk bay.
Last time I used it was plug through the usb bay, nothing special to report, I turned off the computer, then I turned off the usb bay.
=> Monday morning, after booting, Vista tells me to reformat this HDD, which offer that I gently declined. Whether I tried to access HDD through a usb or sata bay, same message ; HDD status switched to RAW ;
No physical shock, used Seatools to check HD status : SMART status PASS as well as Short Generic Test OK (random test) ;

= DISK HISTORY =
4-month old disk, in good shape according to Seatools SMART and short Generic test ;
The (workable) disk has a single full disk 1,8Tb ntfs partition.
FYI, when I bought it I (now) remember I first created a 700Gb partition that I quickly if not immediately deleted to create a single 1,8Tb ntfs partition for this data drive I use regularly ; I guess this old 700Gb partition went "undead" during the weekend and burried my belove live partition.

= WHAT I DID =
Tried to perform a chkdisk on Vista, but could'nt even access the disk ;
Checked the drive with Seatools : SMART status : pass, and Short Generic Test (random) OK as well. The hard is 4-month old so I doubt there is a physical failure.
On my Ubuntu box, I plugged the HD via SATA bay, disk utility showed an unmountable 700Gb ntfs partition (which I did not identify as not being being the current one, me stupid) ;

= FYI, WHAT I DID BEFORE DETECTING THE CORRECT FULL DISK PARTITION =
I used TestDisk Quick search, it showed only this same 700Gb partition.
As I thought it was the right partition (I tend to believe things when it's good news), I didn't proceed to Deep Search ;
(Naturally?) couldn't list files so I engaged in trying to fix the boot sector ;
boot sector marked as valid, backup boot sector as corrupted.
==> So I overwrote the backup boot sector with main boot sector, thinking it would maybe "unlock" the files. Couldn't list the files though.
==> tried to fix the MFT, but both declared damaged ... no good ;
Following this site instructions (and not thinking seriously I was not investigating the right partition), I tried GetDataBack Trial Preview with no result of course ;

= WHAT WORKED SO FAR : REACTIVATING THE CORRECT PARTITION =
So in last attempt, I finally told myself that the partition was maybe not the right one but just the 700Gb partition I deleted before creating my actual full disk 1,8Tb partition 4 month ago ;
==> Deep Search performed its magic and found the already mentioned 700Gb ntfs partition + my beloved full disk 1,8Tb partition, both beginning at the same sector (which I believe assert that they didn't sit on the disk at the same time ?) and set as Deleted ;
==> As I was 99% sure of which was my currenty partition, I set the 1,8Tb partition as primary and confirmed with a WRITE ;
==> Still I couldn't list files so engaged into fix boot ;

==> I AM STUCK HERE <==
Curiously boot sector and its backup are both declared valid by TesDisk altough NOT identical. So I beg for insights on this as I didn't think it would be possible that both boot sectors be OK but NOT identical.

The good news is that "reactivating" the right partition gave very encouraging results with GetDataBack Trial Preview even with the latest files I worked on, so no doubt the partition is the right one ; The fact that GetDataBack can get back the directory tree + files (most or all files i can't know) + crap stuff tells me I'm not that far from fully fixing the file system. But my progress reached the limits of my knowledge.

I'd really like to fix the file system with TestDisk, in order to avoid having to sort the "crap" GetDataBack recovered as well ; Once again you can find the whole TestDisk log for this HDD http://pastebin.com/7NvH64G9.

Thanks again

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: boot sector and backup both OK but NOT identical.

#2 Post by cgrenier »

Run TestDisk, Advanced, select the NTFS partition, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and reboot

Locked