File system repair of damaged partitions

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

File system repair of damaged partitions

#1 Post by BRAC »

Hello,

This is a continuation of the issue posted here viewtopic.php?f=4&t=7223. Since the topic was closed I'm opening a new one.

The concerned external disk has been behaving strangely over the last few weeks although all tests come up normal. Further to the recovery of data from the damaged veracrypt container, I recreated the partitions (using Mini tool Partition Wizard) to my requirement as shown below.

Partition 1: Dell utility - 39 MB
Partition 2: Recovery - 12.25 GB ...DiskCryptor Partition
Partition 3: 'L: ' - 143 GB ...Unencrypted
Partition 4: 'J:' - 242 GB ...DiskCryptor Partition
Partition 5: 'N:' - 25 GB ...Unencrypted
Partition 6: 'O:' - 42 GB ...DiskCryptor Partition

There are two 1 MB unallocated space separating J from N and N from O -- Created by 'Mini Tool' above. Had no control over it.

The issue last time was partitions 4,5 & 6 conking out for whatever reasons. This time however, the three DiskCryptor partitions are in tact and functioning. L: & N: are marked 'Raw' and not accessible. I would like to be able to recover L:, if possible, i.e. by repairing the file system. I followed the pdf tutorial but can't seem to get anywhere. Ran the 'Rebuild BS' -- Main disk>Advanced>Boot>RebuildBS on L: but the result says both the Boot Sector and its backup are identical (confirmed via dump) but MFT and its mirror are damaged and consequently can't list the files.

I'm posting screenshots of the main disk which is rather puzzling (to me). I would appreciate a little enlightenment as to which partition (L:) of the multiple listings (sector size 299902976) I need to select for a rewrite of file system that would put it back in order as per the tutorial. If that's not possible, at least be able to access the files for undelete, which isn't happening now even after a BS rebuild. There's also a mention of space conflict between L: and the rest of the extension in the results.

A quick search yielded only four partitions ( Dell utility, L:,N: & O:). Recovery Old and J: are not listed. Tried load backup after the 'Quick' search and the results are in the screenshot below (marked as 'structure bad'). I would like to know if I should continue to a deep search or something else altogether.

Also, if my understanding is right, once you find the partitions to retain (after a quick/deep search), the 'Write' command lets you register the selected partitions to the table and all other partitions are rendered redundant, right?

Awaiting your reply.

PS: The log file isn't been refreshed for some reason.

Thanks in advance
Attachments
Whole Disk Post RebuldBS-15-8.png
Whole Disk Post RebuldBS-15-8.png (67.14 KiB) Viewed 3722 times
capture-20170816-002800.png
capture-20170816-002800.png (15.08 KiB) Viewed 3722 times
Analyse.png
Analyse.png (59.17 KiB) Viewed 3722 times

BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Re: File system repair of damaged partitions

#2 Post by BRAC »

Screenshots that didn't fit above.
Attachments
Quick Search.png
Quick Search.png (33.73 KiB) Viewed 3721 times
Load Backup.png
Load Backup.png (42.43 KiB) Viewed 3721 times

BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Re: File system repair of damaged partitions

#3 Post by BRAC »

I’ve since gone ahead and done with the deep search too. It mentions something about hard disk size been too small, check jumper settings… Please see the attached screenshots.

The first three NTFS partitions belong to L. I’m spelling out the details of each partition in the listing below:

First one (299902976): NTFS blocksize=4096, 143 GB [Drive L:]
Second partition (299900921): NTFS found using backup sector, blocksize=4096, 153 GB / 143 GiB [Drive L:]
Third partition (299902969): NTFS found using backup sector, blocksize=4096, 153 GB / 143 GiB
Fourth partition (41949184): NTFS, blocksize=4096, 21 GB / 20 GiB [Not sure – presumably an old deleted partition]
Fifth partition (508995584): 260 GB / 242 GiB [Drive J:]
Sixth partition (41943040): NTFS found using backup sector, blocksize=4096, 21 GB / 20 GiB
Seventh partition (52428800): NTFS found using backup sector, blocksize=4096, 26 GB / 25 GiB [Drive N:]
Eight partition (52424704): 26 GB / 24 GiB [Something to do with the 1 Mb unallocated space]
Ninth partition (52424697): NTFS found using backup sector, blocksize=4096, 26 GB / 24 GiB
Tenth partition (91150336): NTFS, blocksize=4096, 46 GB / 43 GiB
Eleventh partition (89673728): 45 GB / 42 GiB [Drive O:]

I would like to know how to go about setting the partition table right from this point forward. None of the partitions can list files. The encrypted ones understandably won’t list its contents. But the other two drives (L & N) are the ones I’m trying to set right. Any advice is appreciated.

Sadly, can't include the log file since it isn't even being generated. No idea why.

edit: The logs weren't being generated because I was running TestDisk from a separate elevated CMD. Running the program from the right click menu solves the issue.

I'm attaching the logs for your reference.

Code: Select all


Thu Aug 17 21:25:59 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, July 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107860992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107860992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=189503897600
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=260628646400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=36776706048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=134217728
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=260605722624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=153550323712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=13153337344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=26841448448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=45912948736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=64424247296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=10737156096
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-1DG142, S/N:S3P91AC6, FW:0001SDM1
Disk /dev/sdc - 500 GB / 465 GiB - CHS 476940 64 32, sector size=512 -    Mass Storage Device, S/N:116AC2101219
Drive G: - 134 MB / 128 MiB - CHS 32 64 32, sector size=2048 - HUAWEI Mass Storage, FW:2.31

Interface Advanced
NTFS at 0/0/1
filesystem size           125828608
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 0/0/1
   P NTFS                           0  125828607  125828608
     NTFS, blocksize=4096, 64 GB / 59 GiB

Partition table type (auto): Intel
Disk /dev/sdc - 500 GB / 465 GiB -    Mass Storage Device
Partition table type: Intel

Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 476940 64 32
Geometry from i386 MBR: head=64 sector=32
check_part_i386 1 type DE: no test
check_part_i386 failed for partition type 07
NTFS at 12584/0/1
Info: size boot_sector 299902969, partition 299902976
BAD_RS LBA=325675008 32
check_part_i386 failed for partition type 07
BAD_RS LBA=834672640 32
NTFS at 407555/0/1
Info: size boot_sector 52424697, partition 52424704
BAD_RS LBA=887099392 32
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=64 nbr=9
get_geometry_from_list_part_aux head=8 nbr=9
get_geometry_from_list_part_aux head=16 nbr=9
get_geometry_from_list_part_aux head=32 nbr=9
get_geometry_from_list_part_aux head=64 nbr=9
get_geometry_from_list_part_aux head=128 nbr=5
Current partition structure:
 1 P Dell Utility             0   1 32    39  14  5      80262
Invalid NTFS or exFAT boot
 2 * HPFS - NTFS             40   0  1 12583  63 32   25690112
 2 * HPFS - NTFS             40   0  1 12583  63 32   25690112
 3 P HPFS - NTFS          12584   0  1 159020  63 32  299902976
 4 E extended LBA         159020  63  1 476939  63 32  651098144
Space conflict between the following two partitions
 3 P HPFS - NTFS          12584   0  1 159020  63 32  299902976
 4 E extended LBA         159020  63  1 476939  63 32  651098144
Invalid NTFS or exFAT boot
 5 L HPFS - NTFS          159021   0  1 407553  62 32  508995552
 5 L HPFS - NTFS          159021   0  1 407553  62 32  508995552

Bad relative sector.
   X extended             407554  63  1 433152  63 32   52424736
 6 L HPFS - NTFS          407555   0  1 433152  63 32   52424704

Bad relative sector.
   X extended             433153  63  1 476939  63 32   89673760
Invalid NTFS or exFAT boot
 7 L HPFS - NTFS          433154   0  1 476939  63 32   89673728
 7 L HPFS - NTFS          433154   0  1 476939  63 32   89673728

Bad relative sector.

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 476940 64 32
FAT16 at 0/1/32
FAT1 : 1-79
FAT2 : 80-158
start_rootdir : 159
Data : 191-80258
sectors : 80262
cluster_size : 4
no_of_cluster : 20017 (2 - 20018)
fat_length 79 calculated 79
heads/cylinder 16383 (FAT) != 64 (HD)
sect/track 63 (FAT) != 32 (HD)

FAT16 at 0/1/32
     FAT16 >32M               0   1 32    39  14  5      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
NTFS at 12584/0/1
filesystem size           299902969
sectors_per_cluster       8
mft_lcn                   417486
mftmirr_lcn               317395
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          12584   0  1 159020  63 25  299902969
     NTFS, blocksize=4096, 153 GB / 143 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=1

Results
   * FAT16 >32M               0   1 32    39  14  5      80262 [DellUtility]
     FAT16, blocksize=2048, 41 MB / 39 MiB
   P HPFS - NTFS          12584   0  1 159020  63 32  299902976
     NTFS, blocksize=4096, 153 GB / 143 GiB

interface_write()
 1 * FAT16 >32M               0   1 32    39  14  5      80262 [DellUtility]
 2 P HPFS - NTFS          12584   0  1 159020  63 32  299902976
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
I would like to know which of the three listed partitions (299902976,299900921,299902969) to select for a rewrite to the partition table since none can list files. Also, since every partition is listed as (D)eleted, do I have to change their types (particularly J & O) to logical or can I leave them as is. Or, does not selecting them make those no longer accessible after a table update. I'm a little unsure as to how to go about this.

Thank you.
Attachments
Post Deep Search 1.jpg
Post Deep Search 1.jpg (62.1 KiB) Viewed 3708 times
Post Deep Search 2.jpg
Post Deep Search 2.jpg (104.4 KiB) Viewed 3708 times

Sarah
Posts: 1
Joined: 29 Apr 2018, 14:53

Re: File system repair of damaged partitions

#4 Post by Sarah »

Hi Brac, I am having the same problem. Where you able to fix it? If you did please share with me your steps, it will be a great help. Thanks :)

Locked