Can see files from one partition but not the other

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zachiepie
Posts: 12
Joined: 08 Dec 2015, 04:27

Can see files from one partition but not the other

#1 Post by zachiepie »

Hello,

I have a 1tb WD Blue that was split into two partitions (Win 7 on one, data on the other) both in NTFS. The drive died and I'm trying to recover what I can. Using TestDisk, I was able to view and copy some files from the smaller OS partition but not the data partition. I get the error "Filesystem seems damaged". I also can't repair the MFT or NTFS BS, those details are in the log.
Other info: I'm using Pmagic 32 with default, RAM-loaded settings. I haven't have better luck running in LIVE mode. The HDD is in the laptop I'm using, attached via SATA.
If I can easily files from one, shouldn't I be able to get files from the other?

LOG:


Wed Mar 30 00:44:45 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.3.2-pmagic (#1 SMP Fri Dec 11 11:01:04 CST 2015) i686
Compiler: GCC 4.9
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: 20140608, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10JPVT-22A1YT0, S/N:WD-WX31A23H7280, FW:01.01A01
Disk /dev/sdb - 15 GB / 14 GiB - CHS 14907 64 32, sector size=512 - SanDisk Cruzer Switch

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10JPVT-22A1YT0
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 12748/53/42
file_pread(4,1023,buffer,211094529(13140/6/52)) read err: Input/output error
NTFS: Can't read MFT
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 204593152
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,1024,buffer,211094528(13140/6/51)) read err: Input/output error
file_pread(4,1,buffer,211094528(13140/6/51)) read err: Input/output error
NTFS: Can't read MFT
HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sda 2048" | dmsetup create test0
echo "0 204593152 linear /dev/sda 206848" | dmsetup create test1
echo "0 1748721664 linear /dev/sda 204800000" | dmsetup create test2

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 12748/53/42
file_pread(4,1024,buffer,211094528(13140/6/51)) read err: Input/output error
file_pread(4,1,buffer,211094528(13140/6/51)) read err: Input/output error
NTFS: Can't read MFT
1 * HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB

ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,16,buffer,211091456(13139/213/3)) read err: Input/output error
file_pread(4,1,buffer,211091456(13139/213/3)) read err: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,1,buffer,211091457(13139/213/4)) read err: Input/output error
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
file_pread(4,16,buffer,211091466(13139/213/13)) read err: Input/output error
file_pread(4,1,buffer,211091466(13139/213/13)) read err: Input/output error
NTFS Can't read "root directory" in MFT

ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 12748/53/42
file_pread(4,1023,buffer,211094529(13140/6/52)) read err: Input/output error
NTFS: Can't read MFT
file_pread(4,4094,buffer,211091458(13139/213/5)) read err: Input/output error
Can't read NTFS MFT.
Can't read NTFS MFT.

ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Can't open filesystem. Filesystem seems damaged.

TestDisk exited normally.

User avatar
CaptainWD
Posts: 3
Joined: 08 Apr 2016, 07:34

Re: Can see files from one partition but not the other

#2 Post by CaptainWD »

Hey there zachiepie,

I'm sorry for the situation.
What was the reason for the drive failure? Do you have a S.M.A.R.T. status with the raw values that you can post?

Have in mind that if it was something physical like a scratch on the platter or a bad head/actuator/spindle any further attempt to get your data back may further damage the drive beyond any chance of getting your data back. If the data is truly valuable your best bet would be to contact a data recovery company, but have in mind that their services can be quite costly.

Captain_WD.

Locked