Messed up windows partitions, two became one.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
closedbob
Posts: 5
Joined: 29 Jul 2014, 18:14

Messed up windows partitions, two became one.

#1 Post by closedbob »

Hello to you all,
I am asking for advice or guidance in a difficult task, to retrieve some data from an Hard Disk with probably some parttions problems.
I'll describe what happened, and what I tried, thank you for your attention:)

I had:
A windows 8.1 PC
One 500GB hard-disk, with two logical partitions, C: where windows is installed, and D:. Both of them were circa 250GB in size.

A black-out shut down the PC while booting, probably during windows updates installation (the screen was black).
When we started the PC again, it was trying a system restore, but another black-out shut down the PC.

I think now there is a problem with partitions:
- Windows won't boot, It display the recovery options screen.
- Running notepad.exe on the command prompt in the recovery option and choosing "open" let me see this:
There is a logical drive with the name "System reserved" circa 130MB
There is drive D, with its data (I am not sure if there is everything) but instead of 250GB its size is displayed as almost 500GB!
Old drive C is lost, it seems it was merged with D.

Gparted show the same, plus an unallocated space of 1.1MB

I want to recover some data from drive C, I have burned a knoppix CD, a Gparted live CD and a System Rescue CD
I was hoping that testdisk could help me, but I'm not good using it.

There is a possibility that knowing an approximation of the original partitions I can retrieve my data?
If you need some logs of other data ask me:)

Thank you for your help!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Messed up windows partitions, two became one.

#2 Post by Fiona »

CD's are read only.
That's why it isn't possible to create a testdisk.log.
In case you can use a camera or smart phone to make some low resolution photos and have a try to upload them here.
Using Knoppix you can open a terminal or console within the menu / Knoppix with admin rights.
Write sudo testdisk to start testdisk with superuser rights.
I'd need some screenshots from Analyse (current partition structure)
Quick Search (results) and if nothing is found from Deeper Search also.
If any appropriate partitions are found, please mark them and press p to have a try to list your data.

Please let me know.

Fiona

closedbob
Posts: 5
Joined: 29 Jul 2014, 18:14

Re: Messed up windows partitions, two became one.

#3 Post by closedbob »

Thank you for your reply!

Yesterday I did a scan: I'll write the results because the photo I have are a little blurry:

Disk /dev/sda -500 GB / 465 GiB -CHS 60801 255 63

HPFS - NTFS 0 32 33 44 190 18 716800 [System reserved]
HPFS - NTFS 0 32 33 44 190 18 716800 [System reserved]
HPFS - NTFS 44 190 19 60801 47 46 976052224
HPFS - NTFS 31072 91 60 91828 204 24 976052224
HPFS - NTFS 31610 117 60 92366 230 24 976052224

After that I saw a message about the hard-disk being too small (749GB<500GB) and saying the last two partions could not be recovered. When I pressed P to list files the there was an error about "unsegmented disk" I think, and the terminal exited testdisk.

Should I retry? It's better if I clone the drive with some tool? How much space do I need?
Thank you very much:)

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Messed up windows partitions, two became one.

#4 Post by Fiona »

Your first partition System Reserved dispays a problem either with your boot sector or file system.
Disk CHS 60801 255 63
HPFS - NTFS 44 190 19 60801 47 46 976052224
Looks like your previous windows partition uses the whole space of your disk now.
The other two partitions end about 250 GB after disk limit.

Did you already run Deeper Search?
Deeper Search (not Quick Search) looks additional for a backup of a boot sector and can find more partitions.
It's intended to find your previous windows and data partition.
If more partitions are found please have a try to list your data!

Please let me know.

Fiona

closedbob
Posts: 5
Joined: 29 Jul 2014, 18:14

Re: Messed up windows partitions, two became one.

#5 Post by closedbob »

I'll launch another scan now.
I'll list the files it find, but I fear that it will say "unsegmented error" when clicking P to list files.
Thank you very much for your help, I will post the results after the scan:)

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Messed up windows partitions, two became one.

#6 Post by Fiona »

If you get this error again, I'll contact the developer!
It's unusual.
Maybe if a file system is damaged, you can get this error too?
If testdisk finds any partitions and the label is shown, you should try it first to list your data of these partitions.

Fiona

closedbob
Posts: 5
Joined: 29 Jul 2014, 18:14

Re: Messed up windows partitions, two became one.

#7 Post by closedbob »

After quick scan it found:
HPFS - NTFS 0 32 33 44 190 18 716800 [System reserved]
HPFS - NTFS 44 190 19 60801 47 46 976052224

List files for the first one does list files, on the second one it say "unsegmented fault" and the terminal show the command line, so I re-run testdisk and started the deep scan, if it shows another time this error can I tell the program where the partitions he found are without doing another deep scan?

closedbob
Posts: 5
Joined: 29 Jul 2014, 18:14

Re: Messed up windows partitions, two became one.

#8 Post by closedbob »

Finished the scan, the same results as before, but some numbers are a little different (less than 4 in absolute value), is it normal?
Trying to list files gave
szh: segmentation fault testdisk NTFS, blocksize=4096, 499 GB / 465GiB.

Locked