Damaged Partition Structure

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
entier
Posts: 6
Joined: 21 Sep 2015, 00:10

Damaged Partition Structure

#1 Post by entier »

Hello, guys. I lost access to the hard drive of my Acer Aspire 5715z laptop due to Calculate Linux Mate 18.12 (cldm-18.12) faulty installation. I have Windows 7 - Ubuntu dual boot on it. sudo fdisk /dev/sda -l output shows the partitions of the hard drive:
Disk /dev/sda: 160.0 GB, 160041885696 bytes, 312581808 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x3bf54493

Device Boot Start End Blocks Id System
/dev/sda1 63 20447231 10223584+ 7 HPFS/NTFS/exFAT
/dev/sda2 * 20447232 137990136 58771452+ 7 HPFS/NTFS/exFAT
/dev/sda3 137990144 202256151 32133004 f W95 Ext'd (LBA)
/dev/sda4 202256152 312576704 55160276+ 7 HPFS/NTFS/exFAT
/dev/sda5 138016768 166780927 14382080 83 Linux
/dev/sda6 166807552 182761471 7976960 83 Linux
/dev/sda7 182765568 184197071 715752 82 Linux swap / Solaris
/dev/sda8 189982720 202256151 6136716 83 Linux
The Linux /home partition is /dev/sda6. Ubuntu root partition is /dev/sda8. cldm-18.12 was installed on /dev/sda5.
Windows 7 Emergency disk indicated during recovery process that the boot sector and the partition table were damaged and recovered.
So I tried to install cldm-18.12 the second time. Tis time I was not as lucky as the first time and Windows 7 Emergency disk couldn't restore the partition structure. It was able to chkdsk /dev/sda1 and found no errors there. Chkdsk found mft damaged on /dev/sda2 and couldn't restore it. Chkdsk found filesystem RAW on /dev/sda4.
TestDisk found out all the partitions on the disk and wrote the partition table to the disk. But after reboot Windows 7 starts from /dev/sda1 instead of /dev/sda2. TestDisk finds out Invalid NTFS or exFAT boot error on /dev/sda4 and the boot sector and its backup copy bad and non identical. Rebuild BS operation failed.
Last time I ran TestDisk 6.14, created new log file, chose /dev/sda and Partition type Intel detected by TestDisk. I set Align partition to No in Options. In Analyse Testdisk showed all the partitions with Invalid NTFS or exFAT error on /dev/sda4. In Advanced menu when trying to list the files and directories on /dev/sda2, I got the message from TestDisk that the partition maybe damaged. Here is testdisk.log:


Fri May 3 06:02:34 2019
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.10.35-std420-i586 (#2 SMP Wed Apr 2 18:49:42 UTC 2014) i686
Compiler: GCC 4.4
Compilation date: 2014-04-12T00:10:53
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 312581808 sectors
/dev/sda: user_max 312581808 sectors
/dev/sda: native_max 312581808 sectors
/dev/sda: dco 312581808 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Warning: can't get size for Disk /dev/md0 - 0 B - CHS 1 2 4, sector size=512
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - Hitachi HTS542516K9SA00, S/N:080223BB0C00WGKMEM3A, FW:BBCOC31P
Disk /dev/sdb - 16 GB / 14 GiB - CHS 15263 64 32, sector size=512 - Lexar USB Flash Drive, FW:1100
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - Seagate FA GoFlex Desk, FW:0158

Partition table type (auto): Intel
Disk /dev/sda - 160 GB / 149 GiB - Hitachi HTS542516K9SA00
Partition table type: Intel
New options :
Dump : No
Align partition: No
Expert mode : No

Analyse Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 1272/199/16
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
2 * HPFS - NTFS 1272 199 16 8589 124 40 117542905
3 E extended LBA 8589 124 48 12589 220 7 64266008
Invalid NTFS or EXFAT boot
4 P HPFS - NTFS 12589 220 8 19456 254 63 110320553
4 P HPFS - NTFS 12589 220 8 19456 254 63 110320553
5 L Linux 8591 37 23 10381 161 20 28764160
X extended 10383 72 1 11376 95 47 15954041
6 L Linux 10383 73 59 11376 95 47 15953920
X extended 11376 159 1 11465 188 3 1431615
7 L Linux Swap 11376 160 49 11465 188 3 1431504
X extended 11825 222 1 12589 220 7 12273541
8 L Linux 11825 223 47 12589 220 7 12273432

search_part()
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/1/1
filesystem size 20447169
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1279171
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
NTFS, blocksize=4096, 10468 MB / 9983 MiB
NTFS at 1272/199/16
filesystem size 117542905
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1272 199 16 8589 124 40 117542905
NTFS, blocksize=4096, 60 GB / 56 GiB

recover_EXT2: s_block_group_nr=0/109, s_mnt_count=0/32, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3595520
recover_EXT2: part_size 28764160
Linux 8591 37 23 10381 161 20 28764160
ext3 blocksize=4096 Large file Sparse superblock, 14 GB / 13 GiB

recover_EXT2: s_block_group_nr=0/60, s_mnt_count=2/25, s_blocks_per_group=32768, s_inodes_per_group=8032
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1994240
recover_EXT2: part_size 15953920
Linux 10383 73 59 11376 95 47 15953920
ext3 blocksize=4096 Large file Sparse superblock, 8168 MB / 7790 MiB
Linux Swap 11376 160 49 11465 187 50 1431488
SWAP2 version 1, pagesize=4096, 732 MB / 698 MiB

recover_EXT2: s_block_group_nr=0/46, s_mnt_count=9/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1534179
recover_EXT2: part_size 12273432
Linux 11825 223 47 12589 220 7 12273432
ext3 blocksize=4096 Large file Sparse superblock, 6283 MB / 5992 MiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 16.

Results
* HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
NTFS, blocksize=4096, 10468 MB / 9983 MiB
P HPFS - NTFS 1272 199 16 8589 124 40 117542905
NTFS, blocksize=4096, 60 GB / 56 GiB
P Linux 8591 37 23 10381 161 20 28764160
ext3 blocksize=4096 Large file Sparse superblock, 14 GB / 13 GiB
L Linux 10383 73 59 11376 95 47 15953920
ext3 blocksize=4096 Large file Sparse superblock, 8168 MB / 7790 MiB
L Linux Swap 11376 160 49 11465 187 50 1431488
SWAP2 version 1, pagesize=4096, 732 MB / 698 MiB
L Linux 11825 223 47 12589 220 7 12273432
ext3 blocksize=4096 Large file Sparse superblock, 6283 MB / 5992 MiB
Change partition type:
HPFS - NTFS 12589 220 8 19456 254 63 110320553
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
1 P HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
2 * HPFS - NTFS 1272 199 16 8589 124 40 117542905
3 E extended LBA 8589 124 48 12589 220 7 64266008
4 P HPFS - NTFS 12589 220 8 19456 254 63 110320553
5 L Linux 8591 37 23 10381 161 20 28764160
6 L Linux 10383 73 59 11376 95 47 15953920
7 L Linux Swap 11376 160 49 11465 187 50 1431488
8 L Linux 11825 223 47 12589 220 7 12273432
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 8589/124/48,lba=137990144
write_all_log_i386: CHS: 10383/72/1,lba=166807431
write_all_log_i386: CHS: 11376/159/1,lba=182765457
write_all_log_i386: CHS: 11825/222/1,lba=189982611

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 1272/199/16
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 P HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
NTFS, blocksize=4096, 10468 MB / 9983 MiB
2 * HPFS - NTFS 1272 199 16 8589 124 40 117542905
NTFS, blocksize=4096, 60 GB / 56 GiB
3 E extended LBA 8589 124 48 12589 220 7 64266008
5 L Linux 8591 37 23 10381 161 20 28764160
ext3 blocksize=4096 Large file Sparse superblock, 14 GB / 13 GiB
X extended 10383 72 1 11376 95 47 15954041
6 L Linux 10383 73 59 11376 95 47 15953920
ext3 blocksize=4096 Large file Sparse superblock, 8168 MB / 7790 MiB
X extended 11376 159 1 11465 188 3 1431615
7 L Linux Swap 11376 160 49 11465 188 3 1431504
SWAP2 version 1, pagesize=4096, 732 MB / 698 MiB
X extended 11825 222 1 12589 220 7 12273541
8 L Linux 11825 223 47 12589 220 7 12273432
ext3 blocksize=4096 Large file Sparse superblock, 6283 MB / 5992 MiB
4 P HPFS - NTFS 12589 220 8 19456 254 63 110320553

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
NTFS, blocksize=4096, 10468 MB / 9983 MiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 20447169
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1279171
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_device_testdisk_io_ioctl() unimplemented

Directory /
5 dr-xr-xr-x 0 0 0 25-Apr-2019 02:19 .
5 dr-xr-xr-x 0 0 0 25-Apr-2019 02:19 ..
9306 dr-xr-xr-x 0 0 0 19-Apr-2019 11:33 $RECYCLE.BIN
27 dr-xr-xr-x 0 0 0 10-Mar-2008 04:31 AUTORUN
80 dr-xr-xr-x 0 0 0 10-Mar-2008 04:31 BitLocker
28 dr-xr-xr-x 0 0 0 17-Apr-2019 00:21 Boot
42 dr-xr-xr-x 0 0 0 21-May-2008 16:03 D2D
9648 dr-xr-xr-x 0 0 0 25-Apr-2019 02:19 Downloads
461 dr-xr-xr-x 0 0 0 2-Nov-2006 10:23 Program Files
510 dr-xr-xr-x 0 0 0 2-Nov-2006 10:22 ProgramData
9355 dr-xr-xr-x 0 0 0 14-Jan-2016 17:22 RECYCLER
106 dr-xr-xr-x 0 0 0 10-Mar-2008 04:31 RYTOOLS
9124 dr-xr-xr-x 0 0 0 20-Feb-2014 22:26 System Volume Information
534 dr-xr-xr-x 0 0 0 2-Nov-2006 10:22 Users
571 dr-xr-xr-x 0 0 0 8-Aug-2016 18:18 Windows
9131 dr-xr-xr-x 0 0 0 12-Sep-2012 23:39 boot-sav
530 dr-xr-xr-x 0 0 0 15-May-2008 09:05 sources
62 -r--r--r-- 0 0 490 29-Sep-2005 09:35 ACERBP.P2
63 -r--r--r-- 0 0 356 15-Jul-2005 06:25 BACKUP.NAP
64 -r--r--r-- 0 0 259584 3-Nov-2006 01:44 BCDEDIT.EXE
65 -r--r--r-- 0 0 37376 30-Jul-2005 01:13 BOOT.DAT
67 -r--r--r-- 0 0 87552 2-Nov-2006 08:30 BootSect.exe
9122 -r--r--r-- 0 0 78 15-May-2008 09:16 DrAssign2C.ini
68 -r--r--r-- 0 0 6656 27-Jun-2005 17:28 FATBOOT.BIN
69 -r--r--r-- 0 0 153 15-Dec-2005 11:12 FmtFAT32.INI
70 -r--r--r-- 0 0 126976 30-Jan-2007 01:36 HiddenStart.exe
72 -r--r--r-- 0 0 512 26-Jun-2005 03:49 MBR.BIN
74 -r--r--r-- 0 0 67 16-Apr-2007 06:25 NAPP.DAT
9121 -r--r--r-- 0 0 329 15-May-2008 09:05 NewPartDisk.ini
9123 -r--r--r-- 0 0 232 1-Jan-2009 03:11 OBR3.acr
75 -r--r--r-- 0 0 70 12-Sep-2005 16:20 OBR3.ini
76 -r--r--r-- 0 0 11 8-Jul-2005 03:31 P1.DAT
77 -r--r--r-- 0 0 125 29-Dec-2005 04:12 PARTITION.ALL
460 -r--r--r-- 0 0 207 26-Jul-2007 16:32 RCD.DAT
78 -r--r--r-- 0 0 382 19-Dec-2005 14:54 RestoreFAT32.INI
151 -r--r--r-- 0 0 115 27-Aug-2007 01:17 SCD.DAT
152 -r--r--r-- 0 0 79 27-Aug-2007 04:20 SWCD.DAT
79 -r--r--r-- 0 0 131072 24-Aug-2005 03:02 UNICODE.BIN
9126 -r--r--r-- 0 0 28 31-Dec-2008 23:25 aimdrs.dat
66 -r--r--r-- 0 0 399860 23-Mar-2016 22:39 bootmgr
71 -r--r--r-- 0 0 69632 1-Oct-2003 06:29 int15.sys
73 -r--r--r-- 0 0 1359 13-Nov-2006 01:57 model.dat

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 1272 199 15 20447169 [PQSERVICE]
NTFS, blocksize=4096, 10468 MB / 9983 MiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 20447169
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1279171
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
2 * HPFS - NTFS 1272 199 16 8589 124 40 117542905
NTFS, blocksize=4096, 60 GB / 56 GiB
NTFS at 1272/199/16
NTFS at 1272/199/16
filesystem size 117542905
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
search_superblock

recover_EXT2: s_block_group_nr=0/109, s_mnt_count=0/32, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3595520
recover_EXT2: part_size 28764160
Ext2 superblock found at sector 2 (block=0, blocksize=4096)
Linux 8591 37 23 10381 161 20 28764160
superblock 0, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext3 -p -b superblock -B blocksize device


dir_partition inode=2
5 L Linux 8591 37 23 10381 161 20 28764160
ext3 blocksize=4096 Large file Sparse superblock, 14 GB / 13 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /

TestDisk exited normally.
The mos troubling thing is the damage of the Windows system partition /dev/sda2 and Windows data partion /dev/sda4. Is it possible to recover them?
Last year, for some reason, I upgraded Windows 7 to Windows 10 and backed up Windows 10 partition /dev/sda2 with Partimage. Does it make sense to restore Windows 10 partition on the now damaged /dev/sda2 with Windows 7?
Your help is welcome.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Damaged Partition Structure

#2 Post by recuperation »

entier wrote: 08 May 2019, 21:57
TestDisk found out all the partitions on the disk and wrote the partition table to the disk. But after reboot Windows 7 starts from /dev/sda1 instead of /dev/sda2. TestDisk finds out Invalid NTFS or exFAT boot error on /dev/sda4 and the boot sector and its backup copy bad and non identical. Rebuild BS operation failed.
That sounds like you have two windows installations and not just one as suggested by the mentioned dual-boot structure above.
Last time I ran TestDisk 6.14,
Is there any reason you do not run the more recent version 7.0?
created new log file, chose /dev/sda and Partition type Intel detected by TestDisk. I set Align partition to No in Options. In Analyse Testdisk showed all the partitions with Invalid NTFS or exFAT error on /dev/sda4. In Advanced menu when trying to list the files and directories on /dev/sda2, I got the message from TestDisk that the partition maybe damaged.
Have you been able to see files and folders in sda2?

The mos troubling thing is the damage of the Windows system partition /dev/sda2 and Windows data partion /dev/sda4. Is it possible to recover them?
See my question above. As for sda4 you did not write anything about listing files and folders. If you fail with testdisk any photorec recovery might bring you files but not a working installation.
Last year, for some reason, I upgraded Windows 7 to Windows 10 and backed up Windows 10 partition /dev/sda2 with Partimage.
Why did you state then that you are running Windows 7 at the beginning of the thread?
Does it make sense to restore Windows 10 partition on the now damaged /dev/sda2 with Windows 7?
I have no experience. I would restore your saved partition to the partition where it came from. If your "Windows data"-partition contains profile information your backup might not fit to a profile which reflects the most current state of your dammaged installation. With your separation into two partitions and the lack of a simultaneous backup of the other partition I am in doubt.
If you don't get your installation back running the restore operation of your partition should not increase dammage. You might need to reinstall Windows anyway.
In Analyse Testdisk showed all the partitions with Invalid NTFS or exFAT error on /dev/sda4
/dev/sda4 represents just one partition. There are not various partitions inside /dev/sda4.

entier
Posts: 6
Joined: 21 Sep 2015, 00:10

Re: Damaged Partition Structure

#3 Post by entier »

Q.That sounds like you have two windows installations and not just one as suggested by the mentioned dual boot structure above.
A. /dev/sda1 is a manufacturer Vista recovery partition, and Windows 7 booting from it causes Windows 7 error message. Windows 7 boot partition is /dev/sda2, but its entry disappeared from the bootloader menu. Under normal circumstances, it contains both entries, from Vista recovery partition and from Windows 7 system partition.
Q.Last time I ran TesDisk 6.14. Is there any reasonyou do not runthe more recent version 7.0?
A.I ran Systemrescuecd-4.2.0 and it contained TestDisk 6.14.
Q. Have you been able to see files and folders in sda2?
A. No. I was not able to see files and folders in /dev/sda4 neither.
Q. Why did you state then that you are running Windows 7 at the beginning of the thread?
A. I tried Windows 10, it loaded much slower than Windows 7, so I returned to Windows 7.

After your questions and suggestions, I noticed that the affected Windows partitions /dev/sda2 and /dev/sda4 had lost their labels, ACER and DATA respectively. For the time being I am being getting ready to reinstall Windows 7. Thank you for your advice.

Locked