Strange results - deep search finds partition but can't read data

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
willigar
Posts: 2
Joined: 16 Jul 2016, 17:50

Strange results - deep search finds partition but can't read data

#1 Post by willigar »

Can this disk be saved? I don't know what to do next.

This is on a Windows 10 system that bluescreened and then wouldn't reboot. I tried some Windows recovery and boot repair options before I ran GParted and then TestDisk, which helped me figure out that the partition tables were messed up.

In GParted, I got a message "Can't have a partition outside the disk!"

I switched to TestDisk. At first, only the recovery partition could be reached, and the other partitions in TestDisk looked completely wacky.

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63

     Partition                  Start        End    Size in sectors
> 1 P HPFS - NTFS          29127 190 56 29185  29 28     921600
  2 P VMFS                 192563  63 13 192571 186 62     136319
  3 P OnTrack DM WO ???    225981 233 45 225987   0 36      81703
  4 P Sys=33               259400 149 14 259409 103 25     141699
Deep search found the other missing partition information, though, and it looked like the disk was all better - except that I can't access the data on that second partition. Test disk just shows "." and "..".

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
     Partition               Start        End    Size in sectors
>* HPFS - NTFS             12 223 20 29127 190 55  467730432
 P HPFS - NTFS          29127 190 56 29185  29 28     921600
What do I do now? I have a backup of the data in the cloud but my internet connection is super slow so I would rather not do a full reinstall. Windows thinks the drive is locked and won't let me "refresh" the install, unfortunately, so I will have to do a full reinstallation. I'm also worried that some small amount of info may not have been backed up, again due to my poor connection speed.

What do I do? What is going on with the wacky partition info that's larger than my whole disk?

I normally have another disk installed but I unplugged that altogether so I couldn't mess it up accidentally. I can't see that showing up as a partition of /dev/sda though.


---
testdisk.log below
---


Sat Jul 16 03:22:21 2016
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-37-generic (#64-Ubuntu SMP Mon Sep 22 21:28:38 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size 468862128 sectors
/dev/sda: user_max 468862128 sectors
/dev/sda: native_max 468862128 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SV300S37A240G, S/N:50026B724B0ABD19, FW:600ABBF0
Disk /dev/sdf - 4099 MB / 3910 MiB - CHS 1016 127 62, sector size=512 - Generic Flash Disk, FW:8.00

Partition table type (auto): Intel
Disk /dev/sda - 240 GB / 223 GiB - KINGSTON SV300S37A240G
Partition table type: Intel

Analyse Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 29127/190/56
BAD_RS LBA=3093528576 6819658
check_part_i386 2 type FB: no test
BAD_RS LBA=3630399488 7333738
check_part_i386 3 type 53: no test
BAD_RS LBA=4167270400 7847818
check_part_i386 4 type 33: no test
Current partition structure:
1 P HPFS - NTFS 29127 190 56 29185 29 28 921600
2 P VMFS 192563 63 13 192571 186 62 136319

Bad relative sector.
3 P OnTrack DM WO ??? 225981 233 45 225987 0 36 81703

Bad relative sector.
4 P Sys=33 259400 149 14 259409 103 25 141699

Bad relative sector.
No partition is bootable

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
NTFS at 29127/190/56
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB

Results
* HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
ntfs_device_testdisk_io_ioctl() unimplemented


dir_partition inode=5
* HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
Directory /
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 .
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 ..
35 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 Recovery
40 dr-xr-xr-x 0 0 0 27-Sep-2015 20:22 System Volume Information

dir_partition inode=35
* HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
Directory /Recovery
35 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 .
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 ..
36 dr-xr-xr-x 0 0 0 26-Nov-2015 12:17 WindowsRE
Directory /
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 .
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 ..
35 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 Recovery
40 dr-xr-xr-x 0 0 0 27-Sep-2015 20:22 System Volume Information

dir_partition inode=40
* HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
Directory /System Volume Information
40 dr-xr-xr-x 0 0 0 27-Sep-2015 20:22 .
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 ..
41 -r--r--r-- 0 0 20480 27-Sep-2015 20:22 tracking.log
Directory /
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 .
5 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 ..
35 dr-xr-xr-x 0 0 0 26-Nov-2015 11:44 Recovery
40 dr-xr-xr-x 0 0 0 27-Sep-2015 20:22 System Volume Information

interface_write()
1 * HPFS - NTFS 29127 190 56 29185 29 28 921600

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
NTFS at 29127/190/55
filesystem size 467730432
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 29127 190 55 467730432
NTFS found using backup sector, blocksize=4096, 239 GB / 223 GiB
NTFS at 29127/190/56
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 29185/29/28
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB

Results
* HPFS - NTFS 12 223 20 29127 190 55 467730432
NTFS found using backup sector, blocksize=4096, 239 GB / 223 GiB
P HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB

interface_write()
1 * HPFS - NTFS 12 223 20 29127 190 55 467730432
2 P HPFS - NTFS 29127 190 56 29185 29 28 921600
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 29127/190/56
BAD_RS LBA=3093528576 6819658
check_part_i386 2 type FB: no test
BAD_RS LBA=3630399488 7333738
check_part_i386 3 type 53: no test
BAD_RS LBA=4167270400 7847818
check_part_i386 4 type 33: no test
Current partition structure:
1 P HPFS - NTFS 29127 190 56 29185 29 28 921600
2 P VMFS 192563 63 13 192571 186 62 136319

Bad relative sector.
3 P OnTrack DM WO ??? 225981 233 45 225987 0 36 81703

Bad relative sector.
4 P Sys=33 259400 149 14 259409 103 25 141699

Bad relative sector.
No partition is bootable

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
NTFS at 29127/190/56
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB

Results
* HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB

interface_write()
1 * HPFS - NTFS 29127 190 56 29185 29 28 921600
ntfs_mst_post_read_fixup_warn: magic: 0x880c3c0c size: 1024 usa_ofs: 21003 usa_count: 8494: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0xf70d4a53 size: 1024 usa_ofs: 2831 usa_count: 1551: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x0bee064c size: 1024 usa_ofs: 5925 usa_count: 2830: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x00f00b06 size: 1024 usa_ofs: 5912 usa_count: 60688: Invalid argument
$MFTMirr error: Invalid mft record for '$MFT'.
ntfs_mst_post_read_fixup_warn: magic: 0x00000000 size: 4096 usa_ofs: 0 usa_count: 65535: Invalid argument
Actual VCN (0xe000b6e4c540fffb) of index buffer is different from expected VCN (0x0) in inode 0x5.

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
NTFS at 29127/190/55
filesystem size 467730432
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 29127 190 55 467730432
NTFS found using backup sector, blocksize=4096, 239 GB / 223 GiB
NTFS at 29127/190/56
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 29185/29/28
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB

Results
* HPFS - NTFS 12 223 20 29127 190 55 467730432
NTFS found using backup sector, blocksize=4096, 239 GB / 223 GiB
P HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.


dir_partition inode=5
* HPFS - NTFS 12 223 20 29127 190 55 467730432
NTFS found using backup sector, blocksize=4096, 239 GB / 223 GiB
ntfs_readdir failed for cluster 5
Directory /
5 dr-xr-xr-x 0 0 0 24-Jun-2016 03:37 .
5 dr-xr-xr-x 0 0 0 24-Jun-2016 03:37 ..

interface_write()
1 * HPFS - NTFS 12 223 20 29127 190 55 467730432
2 P HPFS - NTFS 29127 190 56 29185 29 28 921600
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New options :
Dump : No
Align partition: Yes
Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 29127/190/56
BAD_RS LBA=3093528576 6819658
check_part_i386 2 type FB: no test
BAD_RS LBA=3630399488 7333738
check_part_i386 3 type 53: no test
BAD_RS LBA=4167270400 7847818
check_part_i386 4 type 33: no test
1 P HPFS - NTFS 29127 190 56 29185 29 28 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
2 P VMFS 192563 63 13 192571 186 62 136319
3 P OnTrack DM WO ??? 225981 233 45 225987 0 36 81703
4 P Sys=33 259400 149 14 259409 103 25 141699
SIGINT detected! TestDisk has been killed.
Last edited by willigar on 18 Jul 2016, 04:30, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Strange results - deep search finds partition but can't read data

#2 Post by cgrenier »

Run TestDisk, Analyse, Quick Search, Write, confirm, Quit
Next, run PhotoRec (if possible 7.1-WIP) to recover your data. You need enough free space to store the recovered data.

willigar
Posts: 2
Joined: 16 Jul 2016, 17:50

Re: Strange results - deep search finds partition but can't read data

#3 Post by willigar »

Many thanks for the help, Christophe. I'm sorry I messed up the formatting of the post and I want to double check one thing that ended up in the code block.

Quick search shows four partitions, and some of them apparently bigger than the disk. Deep search shows two partitions, which is what I would expect. In neither case could I see data in the other partitions.

Should I write after deep search instead of quick search? I don't know if this is a dumb question, I'm just afraid that I can't go back and try the writing the deep search results later if it turns out quick search is wrong.

Locked