Page 1 of 2

Filesystem corrupted, partition OK

Posted: 28 Apr 2014, 17:28
by paulkinzelman
My 1TB NTFS drive (not the boot disk) all of a sudden is inaccessible, wIndows wants to format it.

I ran testdisk on it and the partition seems OK, but the filesystem is gone:
Drive E: - 1000 GB / 931 GiB - CHS 15200 255 63
Partition Start End Size in sectors
> HPFS - NTFS 0 4 5 15200 35 3 244189952
HPFS - NTFS 0 4 5 15200 35 4 244189952

Is it possible to recover the file system somehow and retrieve filenames and directories?
TIA!

The log file says:

TestDisk 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-04-28T11:22:53
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=101948850176
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=130970288128
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000204886016
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SanDisk SD6SN1M256G1002, S/N:133910400919, FW:X231202
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - TOSHIBA DT01ACA100, S/N:152D20337A0C
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - TOSHIBA DT01ACA100, S/N:152D20337A0C
Drive E: - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - TOSHIBA DT01ACA100, S/N:152D20337A0C

Partition table type (auto): Intel
Drive E: - 1000 GB / 931 GiB - TOSHIBA DT01ACA100
Partition table type: Intel

Analyse Drive E: - 1000 GB / 931 GiB - CHS 15200 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
No partition is bootable
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.

search_part()
Drive E: - 1000 GB / 931 GiB - CHS 15200 255 63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 4 5 15200 35 3 244189952
NTFS, blocksize=4096, 1000 GB / 931 GiB
Search for partition aborted

Results
* HPFS - NTFS 0 4 5 15200 35 3 244189952
NTFS, blocksize=4096, 1000 GB / 931 GiB
Not an exFAT boot sector.

Re: Filesystem corrupted, partition OK

Posted: 02 May 2014, 08:59
by cgrenier
Please use the PhysicalDrive, not the drive letter.

Re: Filesystem corrupted, partition OK

Posted: 02 May 2014, 16:33
by paulkinzelman
Sorry, I didn't understand the distinction between Phys drive and logical drive.
Below I've posted the log resulting from the physical drive.

I tried running the GetDataBack tool (evaluation) and I get what looks like a
significant portion of the file tree structure and filenames look correct, but
all the files seem to be corrupted.

On the other hand, I run your photorec tool and I get no filenames, but I
do seem to recover actual in-tact files (via spot-check), but no valid file names
and no structure. The other problem is that after 2 days of running, it's
estimating that it'll take about 2 months to process the entire disk. :-(

It seems like there should be a way to get files back *and* their filenames?
Even the names without the structure would be a help.

-------------------------
Fri May 2 07:25:10 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-04-28T11:22:53
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=101948850176
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=130970288128
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=500105217024
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SanDisk SD6SN1M256G1002, S/N:133910400919, FW:X231202
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - TOSHIBA DT01ACA100, S/N:152D20337A0C
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63 (RO), sector size=512 - ST350083 0AS, S/N:152D20329000
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - TOSHIBA DT01ACA100, S/N:152D20337A0C
Drive E: - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - TOSHIBA DT01ACA100, S/N:152D20337A0C

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - TOSHIBA DT01ACA100
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 4 5 15200 35 3 244189952
NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
* HPFS - NTFS 0 4 5 15200 35 3 244189952
NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
1 * HPFS - NTFS 0 4 5 15200 35 3 244189952

Re: Filesystem corrupted, partition OK

Posted: 03 May 2014, 09:44
by cgrenier
It looks like your disk is using 4096 bytes sector (4k) but was previously using 512 bytes sectors.
Run TestDisk, after QUick Search, choose Write and confirm, go in Advanced, select the NTFS partition, choose Boot, RebuildBS, List. If you can see your files, choose Write and confirm. Quit and reboot

Re: Filesystem corrupted, partition OK

Posted: 03 May 2014, 15:57
by theboytony
What do you do if you get to this point but when going to list no files come up is just gives a filesystem error

Re: Filesystem corrupted, partition OK

Posted: 04 May 2014, 20:45
by paulkinzelman
I think I did what you suggested, here are my notes from what I tried. However it still says bytes per sector mismatch. Shouldn't that warning go away? Did I not follow your instructions correctly?
TIA!

TestDisk:
Selected PhysicalDrive1 | proceed
Selected Intel partition
Selected Analyze | Quick Search
Found Partition HPFS - NTFS | Enter to continue
Selected 'Write' and Rebuild
Write partition table confirm: Y
[but it didn't give me the option of fixing the bytes per sector problem]
REBOOT
Select PhysicalDrive2
Intel
Analyze
Still says Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Quick Search
Enter to continue

Still says I need to format the drive before I use it.
Doesn't look like there was any change.

Re: Filesystem corrupted, partition OK

Posted: 06 May 2014, 18:12
by paulkinzelman
Is there something I can do manually to change the bytes per sector mismatch?
It doesn't look like the steps you suggested seemed to do that unless I followed them incorrectly.
Any help would be appreciated.
TIA!

Re: Filesystem corrupted, partition OK

Posted: 07 May 2014, 07:31
by cgrenier
Run TestDisk, go in Advanced, select the NTFS partition, choose Boot, RebuildBS, List. If you can see your files, choose Write and confirm. Quit and reboot.

Re: Filesystem corrupted, partition OK

Posted: 07 May 2014, 14:34
by paulkinzelman
I tried that (to the 'List' item) and it still says" "Can't open filesystem. Filesystem seems damaged."

Is there some way I can go in there manually and fix the bytes-per-sector problem?

What's strange is that one tool out there (GetDataBack) can recover the structure of the directories but not the files themselves, and your tool photorec seems to be able to recover the files, but not the directory structure. That makes me think that there should be some way to recover both.

This is what I get when I try your sequence:
ntfs_boot_sector
1 * HPFS - NTFS 0 4 5 15200 35 3 244189952
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 1953519616, partition 244189952
filesystem size 1953519616 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Re: Filesystem corrupted, partition OK

Posted: 13 May 2014, 19:26
by cgrenier
Run TestDisk, select the disk, go in the Geometry menu, set the sector size to 512, go back in Advanced, choose Boot, List. Does it work this time ?