write error recoverying NTFS partition on drive

[peterg]

I have a Crucial M4 SSD which I use as a boot drive for Windows server 2008. Occasionally it will fail to boot or freeze. I foolishly update the firmware, will load the windows boot record but does not boot windows.

It shows as a RAW drive when I plug into a windows 10 laptop via SATA.

I have run testdisk 7.1 (on wodnows 10), using a deep search I can see my file in the 2008 root directory. I have selected this second 2008 partition and set as bootable primary and tried to write but get a write error. I have selected advanced and tried to recover the the Boot but this fails with a write error.

The drive has had boot issues occasionally in the past, usually after the machine has been put into a sleep mode. I suspect it has had some anomalie with partition table for a whie.

Should I setup as a extended partition, primary or bootable primary?

If I cannot restore to bootable.

I would be happy to recover the partition as a Logical partition and backup to another drive.

I attached a log file and would be grateful for any advice.

Tue Mar 17 22:16:12 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319045176320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=256059113472
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST9320423AS, S/N:5VH1STPC, FW:0002SDM1
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - M4-CT256M4SSD2, S/N:0000000011100303E0CB, FW:070H

Partition table type (auto): Intel
Disk /dev/sdb - 256 GB / 238 GiB - M4-CT256M4SSD2
Partition table type: Intel

Analyse Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Error: size boot_sector 500115457 > partition 500115456
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 500115457 > partition 500115456
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 31130 223 5 500115456
1 * HPFS - NTFS 0 32 33 31130 223 5 500115456

search_part()
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/1/1
filesystem size 500087322
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 31128 254 63 500087322
NTFS, blocksize=4096, 256 GB / 238 GiB
file_pread(5,2,buffer,500119551(31131/0/37)) lseek err Invalid argument
file_pread(5,1,buffer,500119551(31131/0/37)) lseek err Invalid argument
file_pread(5,2,buffer,500119552(31131/0/38)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 31128 254 63 500087322
NTFS, blocksize=4096, 256 GB / 238 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 31128 254 63 500087322

search_part()
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/1/1
filesystem size 500087322
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 31128 254 63 500087322
NTFS, blocksize=4096, 256 GB / 238 GiB
NTFS at 0/32/33
filesystem size 500115457
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 31130 223 6 500115457
NTFS, blocksize=4096, 256 GB / 238 GiB

recover_EXT2: s_block_group_nr=0/55, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1834752
recover_EXT2: part_size 14678016
Filesystem created: Thu Feb 6 21:55:57 2014
Last mount time: Thu Feb 6 22:30:43 2014
Linux 13468 123 32 14382 37 55 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB

recover_EXT2: s_block_group_nr=0/55, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1834752
recover_EXT2: part_size 14678016
Filesystem created: Thu Feb 6 21:55:57 2014
Last mount time: Thu Feb 6 22:30:43 2014
Linux 13520 0 1 14433 169 24 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB

recover_EXT2: s_block_group_nr=0/55, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1834752
recover_EXT2: part_size 14678016
Filesystem created: Thu Feb 6 21:55:57 2014
Last mount time: Thu Feb 6 22:30:43 2014
Linux 13560 101 46 14474 16 6 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB

recover_EXT2: s_block_group_nr=0/55, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1834752
recover_EXT2: part_size 14678016
Filesystem created: Thu Feb 6 21:55:57 2014
Last mount time: Thu Feb 6 22:30:43 2014
Linux 13560 134 15 14474 48 38 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB

recover_EXT2: s_block_group_nr=0/55, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1834752
recover_EXT2: part_size 14678016
Filesystem created: Thu Feb 6 21:55:57 2014
Last mount time: Thu Feb 6 22:30:43 2014
Linux 13564 89 30 14478 3 53 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB
file_pread(5,2,buffer,500119551(31131/0/37)) lseek err Invalid argument
file_pread(5,1,buffer,500119551(31131/0/37)) lseek err Invalid argument
file_pread(5,2,buffer,500119552(31131/0/38)) lseek err Invalid argument
file_pread(5,1,buffer,500119554(31131/0/40)) lseek err Invalid argument
file_pread(5,2,buffer,500119610(31131/1/33)) lseek err Invalid argument
file_pread(5,1,buffer,500119610(31131/1/33)) lseek err Invalid argument
file_pread(5,2,buffer,500119616(31131/1/39)) lseek err Invalid argument
file_pread(5,1,buffer,500119616(31131/1/39)) lseek err Invalid argument
file_pread(5,2,buffer,500119673(31131/2/33)) lseek err Invalid argument
file_pread(5,1,buffer,500119673(31131/2/33)) lseek err Invalid argument
file_pread(5,8,buffer,500118272(31130/235/18)) lseek err Invalid argument
file_pread(5,1,buffer,500118272(31130/235/18)) lseek err Invalid argument
file_pread(5,8,buffer,500118400(31130/237/20)) lseek err Invalid argument
file_pread(5,8,buffer,500118528(31130/239/22)) lseek err Invalid argument
file_pread(5,8,buffer,500118656(31130/241/24)) lseek err Invalid argument
file_pread(5,2,buffer,500118762(31130/243/4)) lseek err Invalid argument
file_pread(5,8,buffer,500118784(31130/243/26)) lseek err Invalid argument
file_pread(5,2,buffer,500118825(31130/244/4)) lseek err Invalid argument
file_pread(5,2,buffer,500118888(31130/245/4)) lseek err Invalid argument
file_pread(5,8,buffer,500118912(31130/245/28)) lseek err Invalid argument
file_pread(5,8,buffer,500119040(31130/247/30)) lseek err Invalid argument
file_pread(5,8,buffer,500119168(31130/249/32)) lseek err Invalid argument
file_pread(5,8,buffer,500119296(31130/251/34)) lseek err Invalid argument
file_pread(5,8,buffer,500119424(31130/253/36)) lseek err Invalid argument
file_pread(5,1,buffer,500119514(31130/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,500119515(31131/0/1)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=3
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=3

Results
HPFS - NTFS 0 1 1 31128 254 63 500087322
NTFS, blocksize=4096, 256 GB / 238 GiB
HPFS - NTFS 0 32 33 31131 0 37 500117504
NTFS, blocksize=4096, 256 GB / 238 GiB
Linux 13468 123 32 14382 37 55 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB
Linux 13520 0 1 14433 254 63 14683410
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7517 MB / 7169 MiB
Linux 13560 101 46 14474 16 6 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB
Linux 13560 134 15 14474 48 38 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB
Linux 13564 89 30 14478 3 53 14678016
ext4 blocksize=4096 Large_file Sparse_SB Recover, 7515 MB / 7167 MiB


dir_partition inode=5
* HPFS - NTFS 0 32 33 31131 0 37 500117504
NTFS, blocksize=4096, 256 GB / 238 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Feb-2020 09:34 .
5 dr-xr-xr-x 0 0 0 11-Feb-2020 09:34 ..
57 dr-xr-xr-x 0 0 0 12-Nov-2010 16:19 $Recycle.Bin
115089 dr-xr-xr-x 0 0 0 21-Nov-2011 23:15 4Stroke
104379 dr-xr-xr-x 0 0 0 31-May-2013 14:01 Audio
66330 dr-xr-xr-x 0 0 0 21-Apr-2016 09:53 Boot
945 dr-xr-xr-x 0 0 0 30-Mar-2011 15:36 DB
130763 dr-xr-xr-x 0 0 0 2-Feb-2015 21:59 Dell
13449 dr-xr-xr-x 0 0 0 14-Jul-2009 06:06 Documents and Settings
128822 dr-xr-xr-x 0 0 0 2-Feb-2015 21:59 Intel
85257 dr-xr-xr-x 0 0 0 25-Mar-2010 10:28 MSOCache
103438 dr-xr-xr-x 0 0 0 7-May-2011 16:08 MurexCrossReferencev1
127993 dr-xr-xr-x 0 0 0 30-Sep-2011 12:43 OCBC
69303 dr-xr-xr-x 0 0 0 16-Apr-2013 22:38 PIPE385
90874 dr-xr-xr-x 0 0 0 2-Jun-2013 22:13 PIPE39
58 dr-xr-xr-x 0 0 0 14-Jul-2009 04:20 PerfLogs
60 dr-xr-xr-x 0 0 0 12-Dec-2016 09:12 Program Files
141 dr-xr-xr-x 0 0 0 7-Oct-2019 19:09 Program Files (x86)
179 dr-xr-xr-x 0 0 0 15-Mar-2020 11:09 ProgramData
58437 dr-xr-xr-x 0 0 0 10-Jan-2011 14:08 REP_2_1_1
19783 dr-xr-xr-x 0 0 0 19-Mar-2010 00:14 Recovery
85244 dr-xr-xr-x 0 0 0 15-Apr-2011 03:56 RfaGetHost_test
14187 dr-xr-xr-x 0 0 0 1-Feb-2011 14:18 System Volume Information
241 dr-xr-xr-x 0 0 0 28-Apr-2010 12:06 Users
61092 dr-xr-xr-x 0 0 0 27-Mar-2010 05:36 VProRecovery
375 dr-xr-xr-x 0 0 0 28-Apr-2019 17:43 Windows
44017 dr-xr-xr-x 0 0 0 27-Dec-2014 17:15 inetpub
69668 dr-xr-xr-x 0 0 0 11-Oct-2010 12:08 licence
129579 dr-xr-xr-x 0 0 0 8-Apr-2019 21:28 local
58653 dr-xr-xr-x 0 0 0 4-Jun-2018 13:50 tmp
107255 dr-xr-xr-x 0 0 0 29-Apr-2011 13:56 watchlist
134114 -r--r--r-- 0 0 1578496 6-Sep-2017 07:01 Photo.scr
57636 -r--r--r-- 0 0 20480 21-Apr-2010 18:08 RFAGetHost.exe
14657 -r--r--r-- 0 0 383786 20-Nov-2010 12:40 bootmgr
172047 -r--r--r-- 0 0 3782214 30-Aug-2012 00:15 chatzum_nt.exe
68790 -r--r--r-- 0 0 383 6-Jul-2015 08:59 ftconfig.ini
15415 -r--r--r-- 0 0 4177440768 15-Mar-2020 14:32 pagefile.sys
93401 -r--r--r-- 0 0 8114176 12-Dec-2010 09:27 sqlncli.msi
72819 -r--r--r-- 0 0 165 6-Jun-2012 14:37 ~$Book1.xlsx
104370 -r--r--r-- 0 0 165 6-Jun-2012 13:48 ~$throats.xlsx


dir_partition inode=5
* HPFS - NTFS 0 32 33 31131 0 37 500117504
NTFS, blocksize=4096, 256 GB / 238 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Feb-2020 09:34 .
5 dr-xr-xr-x 0 0 0 11-Feb-2020 09:34 ..
57 dr-xr-xr-x 0 0 0 12-Nov-2010 16:19 $Recycle.Bin
115089 dr-xr-xr-x 0 0 0 21-Nov-2011 23:15 4Stroke
104379 dr-xr-xr-x 0 0 0 31-May-2013 14:01 Audio
66330 dr-xr-xr-x 0 0 0 21-Apr-2016 09:53 Boot
945 dr-xr-xr-x 0 0 0 30-Mar-2011 15:36 DB
130763 dr-xr-xr-x 0 0 0 2-Feb-2015 21:59 Dell
13449 dr-xr-xr-x 0 0 0 14-Jul-2009 06:06 Documents and Settings
128822 dr-xr-xr-x 0 0 0 2-Feb-2015 21:59 Intel
85257 dr-xr-xr-x 0 0 0 25-Mar-2010 10:28 MSOCache
103438 dr-xr-xr-x 0 0 0 7-May-2011 16:08 MurexCrossReferencev1
127993 dr-xr-xr-x 0 0 0 30-Sep-2011 12:43 OCBC
69303 dr-xr-xr-x 0 0 0 16-Apr-2013 22:38 PIPE385
90874 dr-xr-xr-x 0 0 0 2-Jun-2013 22:13 PIPE39
58 dr-xr-xr-x 0 0 0 14-Jul-2009 04:20 PerfLogs
60 dr-xr-xr-x 0 0 0 12-Dec-2016 09:12 Program Files
141 dr-xr-xr-x 0 0 0 7-Oct-2019 19:09 Program Files (x86)
179 dr-xr-xr-x 0 0 0 15-Mar-2020 11:09 ProgramData
58437 dr-xr-xr-x 0 0 0 10-Jan-2011 14:08 REP_2_1_1
19783 dr-xr-xr-x 0 0 0 19-Mar-2010 00:14 Recovery
85244 dr-xr-xr-x 0 0 0 15-Apr-2011 03:56 RfaGetHost_test
14187 dr-xr-xr-x 0 0 0 1-Feb-2011 14:18 System Volume Information
241 dr-xr-xr-x 0 0 0 28-Apr-2010 12:06 Users
61092 dr-xr-xr-x 0 0 0 27-Mar-2010 05:36 VProRecovery
375 dr-xr-xr-x 0 0 0 28-Apr-2019 17:43 Windows
44017 dr-xr-xr-x 0 0 0 27-Dec-2014 17:15 inetpub
69668 dr-xr-xr-x 0 0 0 11-Oct-2010 12:08 licence
129579 dr-xr-xr-x 0 0 0 8-Apr-2019 21:28 local
58653 dr-xr-xr-x 0 0 0 4-Jun-2018 13:50 tmp
107255 dr-xr-xr-x 0 0 0 29-Apr-2011 13:56 watchlist
134114 -r--r--r-- 0 0 1578496 6-Sep-2017 07:01 Photo.scr
57636 -r--r--r-- 0 0 20480 21-Apr-2010 18:08 RFAGetHost.exe
14657 -r--r--r-- 0 0 383786 20-Nov-2010 12:40 bootmgr
172047 -r--r--r-- 0 0 3782214 30-Aug-2012 00:15 chatzum_nt.exe
68790 -r--r--r-- 0 0 383 6-Jul-2015 08:59 ftconfig.ini
15415 -r--r--r-- 0 0 4177440768 15-Mar-2020 14:32 pagefile.sys
93401 -r--r--r-- 0 0 8114176 12-Dec-2010 09:27 sqlncli.msi
72819 -r--r--r-- 0 0 165 6-Jun-2012 14:37 ~$Book1.xlsx
104370 -r--r--r-- 0 0 165 6-Jun-2012 13:48 ~$throats.xlsx

interface_write()
1 * HPFS - NTFS 0 32 33 31131 0 37 500117504
write!

write_mbr_i386: starting...
file_pwrite(5,1,buffer,0(0/0/1)) write err Input/output error
write_all_log_i386: starting...
No extended partition

Partition: Write error

TestDisk exited normally.

[cgrenier]

You should try to clone your disk to a new empty one using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, remove the original disk. Run TestDisk on the new disk, Advanced, Boot, BackupBS, confirm, Quit and restart your computer.