Recovery of dynamic disks - Partition size issue

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
prodalpha
Posts: 7
Joined: 06 Jul 2014, 11:30

Recovery of dynamic disks - Partition size issue

#1 Post by prodalpha »

Hi,

These two 2Tb hard drives were originally basic drives and were later converted into dynamic drives in Windows 7.
They were originally used as internal hard drives. I have then changed to a laptop and tried to get access through a USB/SATA adaptor. Both hard drives are seen as "unvalid" in the disk management windows 7 software on my laptop. I have tried without success to recover the partitions with testdisk.

The first hard drive contained 2 volumes in 4 partitions
First volume was 598gb, in one partition.
Second volume was 1263gb, in three partitions (283gb, 390gb, 590gb).
The current partition structure after analysis in testdisk shows the two volumes I think:
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 0 32 32 1985
2 * W2K Dynamic/SFS 0 32 33 78162 53 35 1255673856
3 P W2K Dynamic/SFS 78162 53 36 243201 48 31 2651351216
From the result of the quick search it seems that I can only recover the first 598gb partition (confirmed after having listed the files in it through testdisk):
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4605 GB / 4289 GiB)
The following partitions can't be recovered:
HPFS - NTFS 166124 219 48 331163 114 23 2651344896
NTFS, blocksize=4096, 1357 GB / 1264 GiB
FAT16 LBA 170434 210 6 303570 232 16 2138831237
FAT12 454828 224 2 559925 61 18 1688373053
Results
* HPFS - NTFS 0 32 33 78162 53 35 1255673856
NTFS, blocksize=4096, 642 GB / 598 GiB

The second hard drive contained 2 volumes in 3 partitions
First volume was 1147gb, in two partitions (977gb, 170gb).
Second volume was 715gb, in one partitions.
Instead of showing 3 partitions, I get from the preliminary analysis:
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 243201 48 31 3907027057
No partition is bootable
After quick search, I get similar results to the first hard drive. Only the first 976gb partition can be read. (I can list all the files).


I have tried to understand from previous topics on this forum how to solve the fact that the partitions are seen as bigger as they really are ("seems to small" problem), but couldn't figure it out.
Should I try to change the geometry?
Should I rebuild the boot sector? Problem is that in the advanced menu, the option "boot" is not available (only "type", "image" and "quit")
I am a bit lost ... Could someone help me on this please?
Thanks!

First hard drive log file:

Code: Select all

Sun Jul  6 17:02:12 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104376303616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=22084059136
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG MZ7TD128HAFV-000, S/N:S14TNSADB23170, FW:DXT0
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL 003-9VT166

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - ST2000DL 003-9VT166
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=240 sector=63
check_part_i386 1 type 42: no test
check_part_i386 2 type 42: no test
check_part_i386 3 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P W2K Dynamic/SFS          0   1  1     0  32 32       1985
 2 * W2K Dynamic/SFS          0  32 33 78162  53 35 1255673856
 3 P W2K Dynamic/SFS      78162  53 36 243201  48 31 2651351216
Backup partition structure
partition_save

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           1255673856
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 78162  53 35 1255673856
     NTFS, blocksize=4096, 642 GB / 598 GiB
BAD_RS LBA=2738035445 6499327
check_part_i386 failed for partition type 0E
     FAT16 LBA            170434 210  6 303570 232 16 2138831237
This partition ends after the disk limits. (start=2738035445, size=2138831237, end=4876866681, disk end=3907029168)
NTFS at 166124/219/48
filesystem size           2651344896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          166124 219 48 331163 114 23 2651344896
     NTFS, blocksize=4096, 1357 GB / 1264 GiB
This partition ends after the disk limits. (start=2668795904, size=2651344896, end=5320140799, disk end=3907029168)
BAD_RS LBA=3011858637 3341521
file_pread(5,3,buffer,3011858637(454828/224/2)) lseek err Invalid argument
file_pread(5,1,buffer,3011858637(454828/224/2)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                454828 224  2 559925  61 18 1688373053
This partition ends after the disk limits. (start=7306825933, size=1688373053, end=8995198985, disk end=3907029168)
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(5,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(5,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(5,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4605 GB / 4289 GiB)
The following partitions can't be recovered:
     HPFS - NTFS          166124 219 48 331163 114 23 2651344896
     NTFS, blocksize=4096, 1357 GB / 1264 GiB
     FAT16 LBA            170434 210  6 303570 232 16 2138831237
     FAT12                454828 224  2 559925  61 18 1688373053

Results
   * HPFS - NTFS              0  32 33 78162  53 35 1255673856
     NTFS, blocksize=4096, 642 GB / 598 GiB


dir_partition inode=5
   * HPFS - NTFS              0  32 33 78162  53 35 1255673856
     NTFS, blocksize=4096, 642 GB / 598 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 23-Mar-2014 12:15 .
       5 dr-xr-xr-x     0      0         0 23-Mar-2014 12:15 ..
      37 dr-xr-xr-x     0      0         0  6-Jul-2014 01:06 $RECYCLE.BIN
   23011 dr-xr-xr-x     0      0         0  3-Jun-2013 03:03 FAMILLE_GALLAND
   23014 dr-xr-xr-x     0      0         0  3-Jun-2013 07:50 FAMILLE_LIGER
   23172 dr-xr-xr-x     0      0         0 20-Oct-2013 00:07 FILMS
    1155 dr-xr-xr-x     0      0         0 19-Oct-2013 16:16 MONTAGE_DOMINIQUE
    1332 dr-xr-xr-x     0      0         0 23-Mar-2014 12:15 Singing
      35 dr-xr-xr-x     0      0         0  2-Jun-2013 06:09 System Volume Information
      40 dr-xr-xr-x     0      0         0 17-Feb-2014 03:03 TV
    1167 dr-xr-xr-x     0      0         0 19-Oct-2013 16:25 UQBIGBAND
    1573 dr-xr-xr-x     0      0         0  5-Feb-2014 06:40 VIDEOS-GALLAND-1964-1965
    1541 dr-xr-xr-x     0      0         0  3-Feb-2014 23:39 VIDEOS-GALLAND-2001-2013
    1578 dr-xr-xr-x     0      0         0  5-Feb-2014 07:00 VIDEOS-LIGER-1973-1975
    1586 dr-xr-xr-x     0      0         0  5-Feb-2014 08:47 VIDEOS-LIGER-1989-1996
    1171 dr-xr-xr-x     0      0         0 20-Oct-2013 00:06 Video-MGTS7303
      83 dr-xr-xr-x     0      0         0  6-Feb-2014 04:13 dd-rouge
    1540 -r--r--r--     0      0       379 10-Dec-2013 12:19 MULTIBOOT (G) - Raccourci.lnk
      84 -r--r--r--     0      0   1852895  7-Aug-2012 17:31 Matthieu.prproj
      85 -r--r--r--     0      0 1487990338  7-Aug-2012 16:38 Matthieu_1977-1982.avi
      86 -r--r--r--     0      0 156366421  7-Aug-2012 18:16 Matthieu_1977-1982_H264.mp4
      87 -r--r--r--     0      0 1450471202  7-Aug-2012 17:34 Matthieu_1989-1992.avi
      88 -r--r--r--     0      0 147998787  7-Aug-2012 19:26 Matthieu_1989-1992_H264.mp4

interface_write()
 1 * HPFS - NTFS              0  32 33 78162  53 35 1255673856

Second hard-drive log file before quick search:

Code: Select all


Sun Jul  6 11:50:03 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104376303616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=22084059136
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG MZ7TD128HAFV-000, S/N:S14TNSADB23170, FW:DXT0
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-1CH164

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - ST2000DM 001-1CH164
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P W2K Dynamic/SFS          0   1  1 243201  48 31 3907027057
No partition is bootable

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery of dynamic disks - Partition size issue

#2 Post by Fiona »

Dynamic disks don't use a partition table.
That's why you can't write a dynamic volume into a partition table.
They're using some info and write them to the end of the disk.
Info:
http://technet.microsoft.com/en-us/libr ... 38492.aspx
The info like W2K Dynamic/SFS is only intended to avoid, that another OS/program will recognize your disk and repartition or use it.
It's practically like a dummy.
The most important question is:
Did you use a spanned volume over 2 disks?
If you converted a basic disk to dynamic and you didn't use a spanned volume, it might be possible to convert your disk back to a basic disk.

Please let me know did you use a spanned or striped volume?

Info will follow.

Fiona

prodalpha
Posts: 7
Joined: 06 Jul 2014, 11:30

Re: Recovery of dynamic disks - Partition size issue

#3 Post by prodalpha »

Hi Fiona, thank you very much for your help!

No I haven't used a spanned volume over the two disks. The two disks were completely independent.
In the first hard drive, there were 2 volumes, one volume was spanned over 3 "partitions".
In the first hard drive, there were 2 volumes, one volume was spanned over 2 "partitions".

I have tried to convert the disk to a basic disk with different software like partition wizard without success.
I get an error message.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery of dynamic disks - Partition size issue

#4 Post by Fiona »

I've no idea about different software.
Testdisk might be capable to convert your disk back to basic.
As far as I've seen, testdisk probably found one appropriate partition running "Quick Search".
If you're still missing your second partition, please run "Deeper Search", to have a try to find it too.

Fiona

prodalpha
Posts: 7
Joined: 06 Jul 2014, 11:30

Re: Recovery of dynamic disks - Partition size issue

#5 Post by prodalpha »

Hi Fiona,
I am not at home at the moment, but I launched a deeper search during the night.
The three partitions are visible, but whats strange is that I get the file list from the 598gb one on each partition.
This one to be precised :
Directory /
5 dr-xr-xr-x 0 0 0 23-Mar-2014 12:15 .
5 dr-xr-xr-x 0 0 0 23-Mar-2014 12:15 ..
37 dr-xr-xr-x 0 0 0 6-Jul-2014 01:06 $RECYCLE.BIN
23011 dr-xr-xr-x 0 0 0 3-Jun-2013 03:03 FAMILLE_GALLAND
23014 dr-xr-xr-x 0 0 0 3-Jun-2013 07:50 FAMILLE_LIGER
23172 dr-xr-xr-x 0 0 0 20-Oct-2013 00:07 FILMS
1155 dr-xr-xr-x 0 0 0 19-Oct-2013 16:16 MONTAGE_DOMINIQUE
1332 dr-xr-xr-x 0 0 0 23-Mar-2014 12:15 Singing
35 dr-xr-xr-x 0 0 0 2-Jun-2013 06:09 System Volume Information
40 dr-xr-xr-x 0 0 0 17-Feb-2014 03:03 TV
1167 dr-xr-xr-x 0 0 0 19-Oct-2013 16:25 UQBIGBAND
1573 dr-xr-xr-x 0 0 0 5-Feb-2014 06:40 VIDEOS-GALLAND-1964-1965
1541 dr-xr-xr-x 0 0 0 3-Feb-2014 23:39 VIDEOS-GALLAND-2001-2013
1578 dr-xr-xr-x 0 0 0 5-Feb-2014 07:00 VIDEOS-LIGER-1973-1975
1586 dr-xr-xr-x 0 0 0 5-Feb-2014 08:47 VIDEOS-LIGER-1989-1996
1171 dr-xr-xr-x 0 0 0 20-Oct-2013 00:06 Video-MGTS7303
83 dr-xr-xr-x 0 0 0 6-Feb-2014 04:13 dd-rouge
1540 -r--r--r-- 0 0 379 10-Dec-2013 12:19 MULTIBOOT (G) - Raccourci.lnk
84 -r--r--r-- 0 0 1852895 7-Aug-2012 17:31 Matthieu.prproj
85 -r--r--r-- 0 0 1487990338 7-Aug-2012 16:38 Matthieu_1977-1982.avi
86 -r--r--r-- 0 0 156366421 7-Aug-2012 18:16 Matthieu_1977-1982_H264.mp4
87 -r--r--r-- 0 0 1450471202 7-Aug-2012 17:34 Matthieu_1989-1992.avi
88 -r--r--r-- 0 0 147998787 7-Aug-2012 19:26 Matthieu_1989-1992_H264.mp4
Should I change the status of the three partitions from D to P ? I am afraid I will overwrite the infos.
I'll post a screenshot from deeper search later.

prodalpha
Posts: 7
Joined: 06 Jul 2014, 11:30

Re: Recovery of dynamic disks - Partition size issue

#6 Post by prodalpha »

Hi again,
here is a screenshot after deeper search on the first disk.
As explained in my last emails, three partitions are shown.
First is 598gb (corresponds to the first volume on the disk),
second is 881gb (it doesn't correspond to a partition I had before failure),
a third one of 1272gb (corresponds to the second volume I had before failure on the hard drive sum of 283+390+590gb partitions).

There is a size pb (it exceeds 2Tb). I can only list the same list of files in the three partitions. This list of files should only appear on the 598gb partition.
Attachments
Deeper search on the first disk
Deeper search on the first disk
Deeper-search-disque-1.PNG (81.08 KiB) Viewed 7429 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery of dynamic disks - Partition size issue

#7 Post by Fiona »

Partitions found by testdisk starting with the same values (0, 32, 33,)
They overlap and can cause such behavior to list data only from one partition.

Normally if you run Deeper Search, testdisk searches for a boot sector and its backup.
TestDisk fetches information from your boot sector and its backup like start, end and size of your partition.
It also displays info from your MFT and you're able to list your data.
To recover your partitions, you'd need only to write them into your partition table.

Would it be possible that partition wizard already modified your disk and partitions to get such weird results?

The last thing to try might be a boot sector diagnose.
Your current partition table displays three partitions.
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 0 32 32 1985
2 * W2K Dynamic/SFS 0 32 33 78162 53 35 1255673856
3 P W2K Dynamic/SFS 78162 53 36 243201 48 31 2651351216
The first partition is a very small partition and probably wrong?
But your third partition is worth a try.

You can try testdisk / advanced.
Under advanced, mark your third partition and confirm with boot.
Please upload another screen shot.
If your boot sector and the backup of the boot sector are listed as "Bad", please run RebuildBS.
If it's successful, you should have a try to list your files using the menu List.

Please let me know.

Fiona

prodalpha
Posts: 7
Joined: 06 Jul 2014, 11:30

Re: Recovery of dynamic disks - Partition size issue

#8 Post by prodalpha »

Thanks for your message.

I don't think partition wizard modified anything.
I got an error message literally just after having tried to click onto "convert to basic disk".
The software was not able to start the conversion because it could only handle simple volume.

After Reading previous post on this forum, I wanted to give a try rebuilding boot sector, but I don't know why in the advanced menu I only have two options: "type" and "image creation". I can't access the boot option. Is there a reason why?
Last edited by prodalpha on 08 Jul 2014, 09:27, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery of dynamic disks - Partition size issue

#9 Post by Fiona »

Are your partitions are listed?
Please upload a schreen shot.
In case, there is a possibility to use the menu "Type" and add NTFS.

Fiona

prodalpha
Posts: 7
Joined: 06 Jul 2014, 11:30

Re: Recovery of dynamic disks - Partition size issue

#10 Post by prodalpha »

Should I add the last two partitions as NFTS?
Attachments
Menu advanced
Menu advanced
Advanced-disque-1.PNG (38.81 KiB) Viewed 7395 times

Locked