Page 1 of 1

I Would Have Shot Myself!

Posted: 10 Feb 2014, 03:31
by titogrande
Hello everyone (I'm new here), and I am not too sure if this is the right forum for my issue (Admins please move this post if necessary, thanks).

One day while shutting down my Desktop PC I noticed it was taking too long, so I ran out of patience and held the power button in until I forced the PC to shut down (a moment of madness I know), I had also forgotten to realise that I had recently installed Acronis True Image and its 'Try & Decide' function had been running already for a few hours as I was monitoring the behaviour of my PC after I had upgraded the GPU Drivers (something that in the past had given me trouble and which this time with Try & Decide I was trying to avoid), so the long time it was taking to shut down, was probably because it was trying to save all my activity before it shut down, the next day it would not boot and only the Acronis Loader showed on screen, with its progress reporting 0% all the time (without change) - I would have shot myself!

My Desktop is a Windows 8.1 PC with a Corsair 120GB SSD drive with the (System Reserved) 'Boot' partition, and the (C:) 'Windows' partition, plus 2 other (single partitioned) HDDs, a 1TB (E:) 'Data' drive, and a 500GB (F:) 'Programs' drive.

1. Since I do not have another PC with SATA controllers to connect my SSD and run Testdisk on, I connected my SSD drive with a SATA to USB Bridge adapter to my Win7 Laptop, I am not sure if this is the right way to connect it for Testdisk to work correctly?

2. Or if maybe I should only connect my SSD to another PC's SATA port? (please advice)

3. But for now the test that I have made with Testdisk and whose resuts I am posting here, I have only done with the SSD connected to my Laptop through USB (as already explained).

4. By the way in the step where I have to select a media (as depicted in the 3rd image) '03 Select Media', did I do it right by selecting the 2nd entry (highlighted in the image) 'Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB', or should I have selected the 'Drive E: - 367 MB / 350 MiB' entry?

5. Please advice me if (going by my results) you think there is still hope in rescuing my PC, I am not sure if this is a Partition Recovery or Filesystem Repair (or/and File Undelete/Recovery) effort that is needed, and if you expect me to have to perform various other steps to achieve success?

6. But I can say that my Laptop's 'My Computer' and 'Disk Manager' views do not seem to show any anomally as shown in the first image '01 My Computer & Disk Management Views', although exploring into the SSD's 'Windows' partition, seems to find all files & folders.

7. Although exploring into the SSD's 'Boot' (System Reserved) partition only displays 2 files 'Recovery.txt' (0kbs), and 'rescuepe.log' (with the follwing text - "Macrium Reflect Boot Log------------------------Started 31/01/2013 2:06 AM v5.1.5529").


8. Nevertheless after the Testdisk's 'Deeper Search' on the SSD, and then the 'List Files' function, it seems to find all the files and directories and I can even find more files as I browse deeper into the directories too, so maybe after all the problem could simply be that the files have been deleted while the partition might be fine? (I really have no clue)

9. I am including here the 'testdisk.log' first, followed by the images of the Testdisk analysis in the order they were displayed.




Sun Feb 09 03:10:11 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=124955656192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=124683026432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=119664541696
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Drive C: - 124 GB / 116 GiB - CHS 15191 255 63, sector size=512
Drive D: - 124 GB / 116 GiB - CHS 15158 255 63, sector size=512
Drive E: - 367 MB / 350 MiB - CHS 44 255 63, sector size=512
Drive F: - 119 GB / 111 GiB - CHS 14548 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 44/190/19
Current partition structure:
1 * HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
2 P HPFS - NTFS 44 190 19 14593 33 32 233719808

search_part()
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63
NTFS at 0/32/33
filesystem size 716800
sectors_per_cluster 8
mft_lcn 29866
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size 233719808
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 14593 33 32 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB

Results
* HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS, blocksize=4096, 367 MB / 350 MiB
P HPFS - NTFS 44 190 19 14593 33 32 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
2 P HPFS - NTFS 44 190 19 14593 33 32 233719808

search_part()
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63
NTFS at 0/32/33
filesystem size 716800
sectors_per_cluster 8
mft_lcn 29866
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/18
filesystem size 716800
sectors_per_cluster 8
mft_lcn 29866
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size 233719808
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 14593 33 32 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB

HFS magic value at 7482/175/53
NTFS at 10122/150/12
filesystem size 233719808
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=83261128192, part_size=119664541696, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 14529/67/3
filesystem size 233719808
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 14529 67 3 29077 165 16 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB
This partition ends after the disk limits. (start=233412608, size=233719808, end=467132415, disk end=234441648)
NTFS at 14593/33/32
filesystem size 233719808
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 14593 33 32 233719808
NTFS found using backup sector, blocksize=4096, 119 GB / 111 GiB
Disk \\.\PhysicalDrive1 - 120 GB / 111 GiB - CHS 14593 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (120 GB / 111 GiB) seems too small! (< 239 GB / 222 GiB)
The following partition can't be recovered:
HPFS - NTFS 14529 67 3 29077 165 16 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB

Results
* HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS, blocksize=4096, 367 MB / 350 MiB
P HPFS - NTFS 44 190 19 14593 33 32 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB


dir_partition inode=5
* HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS, blocksize=4096, 367 MB / 350 MiB
Directory /
5 dr-xr-xr-x 0 0 0 9-Feb-2014 03:23 .
5 dr-xr-xr-x 0 0 0 9-Feb-2014 03:23 ..
174 dr-xr-xr-x 0 0 0 9-Feb-2014 03:23 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 26-Nov-2013 01:17 Boot
162 dr-xr-xr-x 0 0 0 26-Nov-2013 10:37 Recovery
160 dr-xr-xr-x 0 0 0 21-Dec-2012 01:36 System Volume Information
155 -r--r--r-- 0 0 1 22-Aug-2013 15:45 BOOTNXT
159 -r--r--r-- 0 0 8192 26-Nov-2013 01:17 BOOTSECT.BAK
171 -r--r--r-- 0 0 0 9-Feb-2014 10:40 Recovery.txt
133 -r--r--r-- 0 0 398356 30-Sep-2013 05:51 bootmgr
170 -r--r--r-- 0 0 95 31-Jan-2013 02:06 rescuepe.log


dir_partition inode=5
P HPFS - NTFS 44 190 19 14593 33 32 233719808
NTFS, blocksize=4096, 119 GB / 111 GiB
Directory /
5 dr-xr-xr-x 0 0 0 7-Feb-2014 04:02 .
5 dr-xr-xr-x 0 0 0 7-Feb-2014 04:02 ..
141967 dr-xr-xr-x 0 0 0 2-Jan-2014 13:50 $Recycle.Bin
438314 dr-xr-xr-x 0 0 0 22-Aug-2013 16:45 Documents and Settings
154211 dr-xr-xr-x 0 0 0 27-Jan-2013 02:27 Downloads
156355 dr-xr-xr-x 0 0 0 23-Dec-2012 03:45 Intel
105567 dr-xr-xr-x 0 0 0 1-Mar-2013 12:03 MSI
91579 dr-xr-xr-x 0 0 0 24-Dec-2012 01:11 NVIDIA
99748 dr-xr-xr-x 0 0 0 31-Jul-2013 03:35 NvidiaLogging
141970 dr-xr-xr-x 0 0 0 22-Aug-2013 17:22 PerfLogs
141972 dr-xr-xr-x 0 0 0 1-Feb-2014 12:52 Program Files
356400 dr-xr-xr-x 0 0 0 3-Feb-2014 16:15 Program Files (x86)
356473 dr-xr-xr-x 0 0 0 3-Feb-2014 15:00 ProgramData
352662 dr-xr-xr-x 0 0 0 13-Nov-2013 12:47 Sandbox
77668 dr-xr-xr-x 0 0 0 4-Feb-2014 10:45 System Volume Information
356654 dr-xr-xr-x 0 0 0 3-Feb-2014 15:20 Users
113208 dr-xr-xr-x 0 0 0 4-Jan-2014 04:09 VueScan
356709 dr-xr-xr-x 0 0 0 3-Feb-2014 16:17 Windows
279315 dr-xr-xr-x 0 0 0 30-Jan-2013 01:42 boot
19 dr-xr-xr-x 0 0 0 5-Feb-2014 11:35 found.000
380887 -r--r--r-- 0 0 1 18-Jun-2013 14:18 BOOTNXT
82741 -r--r--r-- 0 0 567296 21-Dec-2012 01:53 My_WCP_Watermark_Editor.exe
583116 -r--r--r-- 0 0 0 7-Feb-2014 04:02 Recovery.txt
17801 -r--r--r-- 0 0 398156 26-Jul-2012 05:44 bootmgr
77684 -r--r--r-- 0 0 2550136832 4-Feb-2014 10:44 pagefile.sys
36706 -r--r--r-- 0 0 120003 31-Jan-2013 01:52 reflectv5.1-5529-x64-0.dmp
77685 -r--r--r-- 0 0 268435456 4-Feb-2014 10:44 swapfile.sys
41523 -r--r--r-- 0 0 47247360 3-Feb-2014 15:11 tnd.dat

interface_write()
1 * HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
2 P HPFS - NTFS 44 190 19 14593 33 32 233719808
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.




01 My Computer & Disk Management Views

Image



02 Log File Create

Image



03 Select Media

Image



04 Partition Table Type Selection

Image


05 Analyse

Image



06 Quick Search

Image



07 Quick Search Result

Image



08 Deeper Search

Image



09 Deeper Search 10 percent

Image



10 Deeper Search Result

Image



11 Continue

Image



12 List Files

Image



13 Next Partition

Image



14 List Files

Image



15 List Files Continued

Image



Please excuse my long post and don't be put off by its length, but since I am a noob at this 'HDD/Partition/Filesystem rescue business', I do not know what information might be relevant, therefore I am simply trying my best to give you as many details as possible, in fact I am sure you will quickly be able to fathom my problem, so please guide me on what steps I should take, thank you and I will be looking forward to your reply