Problem recovering partition/filesystem

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
mwitt
Posts: 13
Joined: 31 Mar 2012, 21:38

Re: Problem recovering partition/filesystem

#11 Post by mwitt »

For some reason the pictures does not show up in the correct order in the post above, but I guess you get it.

This is the latest status from the deep check:
deep scan 2.GIF
deep scan 2.GIF (29.64 KiB) Viewed 6119 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Problem recovering partition/filesystem

#12 Post by Fiona »

10 TB last ages!
Would it be possible to get a screen from your Windows disk management console?
You don't need to interrupt your scan.

mwitt
Posts: 13
Joined: 31 Mar 2012, 21:38

Re: Problem recovering partition/filesystem

#13 Post by mwitt »

Fiona wrote:10 TB last ages!
Would it be possible to get a screen from your Windows disk management console?
You don't need to interrupt your scan.
See my earlier post, diskmanager included.
/Micke

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Problem recovering partition/filesystem

#14 Post by Fiona »

Sry, didn't see it! :)
Looks like your RAID is not initialized.
Windows can only handle initialized RAID or disk.
This behavior is since W2k.
TestDisk windows executable gets their infos from the OS.
Also it should be GPT.
How many partitions did you use on your RAID?

mwitt
Posts: 13
Joined: 31 Mar 2012, 21:38

Re: Problem recovering partition/filesystem

#15 Post by mwitt »

Fiona wrote:Sry, didn't see it! :)
Looks like your RAID is not initialized.
Windows can only handle initialized RAID or disk.
This behavior is since W2k.
TestDisk windows executable gets their infos from the OS.
Also it should be GPT.
How many partitions did you use on your RAID?
The raid is initialized (seé the raid manager info), thats handled by the dedicated raid-controller, but it is not initialized in the windows OS anymore and I guess that is based on the faulty GPT/filesystem. Initializing the drive in windows would create a new GPT/NTFS partition, I think that recovering the "old" partition after that would be very hard? Read alot of forums and it seems that most people are hard against initializing the drive in disk manager if they want to repair or save the data.

I was able to recover the disk once before using PartitionGuru (from within windows) by repairing the GPT/filesystem and it was then recognized by the OS. During my copying of files from the drive, a disk dropped out of the raid and it went south again (see my first post).

The array only contained one partition, Data1.

Best regards
/Micke

cdmccreary
Posts: 3
Joined: 02 Apr 2012, 04:54

Re: Problem recovering partition/filesystem

#16 Post by cdmccreary »

I don't know if this is helpful. But if you are having problems reading your drive. I have used Spinrite by grc.com to recover unreadable spots on drives. Running an analysis first then making sure all sectors are readable. Then maybe you can recover with the other tools available. I have used it and it reconditioned the drive (presumably) due to misalignment by wear.

FWIW.

Charles

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Problem recovering partition/filesystem

#17 Post by Fiona »

Spinrite tries to make unreadable sectors readable.
But it's possible, that it works as long as it's a soft bad and not a physically damaged sector.
If a file system or data get corrupted, spinrite doesn't repair it because it doesn't change anything to the file system and data.
But it can ease the use of datarecovery software, if datarecovery hangs due to errors of the file system or corrupted data.
Similar and still under development and maintenance would be HDD Regenerator.
But keep in mind, it doens't repair a physically damaged HDD.

This case requires probably datarecovery software, if file system is damaged.
The RAID appears as not initialized.
Any initializing using the RAID Controller can safe erase the RAID and makes data recovery impossible.
Windows initializing only writes a 4 Byte signatur that the disk or RAID is usable in windows.
Then, it would be possible to convert it to GPT like before and have a boot sector diagnose.
If it creates partitions, it would only write a partition into the GUID partition table.
If partitions would be equal to the previous situation, it might be possible to diagnose the boot sector and have a try to list data.
I've had another case here;
http://forum.cgsecurity.org/phpBB3/exte ... html#p1215
Otherwise datarecovery software would be a safe solution.
I never try , if a file system or data are corrupted, to touch underlying data nor the file system itself.
To recover a partition with corrupt file system can cause that OS hangs or doesn't response.

mwitt
Posts: 13
Joined: 31 Mar 2012, 21:38

Re: Problem recovering partition/filesystem

#18 Post by mwitt »

Thanks Fiona, but I think that I am but-slammed this time. Have done a complete analysis of the partition with R-studio, it detects multiple filesystems with varying size of partitions. One of the detected partitions seems to be the correct one, and I can browse the file system for that partition from within R-studio. Diong recovery does not work, though, have tried to recover 10 different files, but after recovering them to another drive they are all corrupt and can not be read by the appropriate program.

Might be that when the raid dropped a drive, something went wrong with that drive and the data read from that drive for some reason corrupts the files? The raid is 64K striped, so all files are written in 64K to each drive sequentially?

I will now go ahead and try to restore the partition using TestDisk, hope this works out...
/Micke

mwitt
Posts: 13
Joined: 31 Mar 2012, 21:38

Re: Problem recovering partition/filesystem

#19 Post by mwitt »

Just re-booted and ran TestDisk. Partition is found, boot-sector and back up boot sector ok. Both MFT and MFT mirror bad, rapair command gives back "Failed to repair them". Any idears on what to do?

Having a look in the Windows disk manager, this is what I see now:
disk manager 3.GIF
disk manager 3.GIF (20.3 KiB) Viewed 6090 times
I don´t understand what the 129 MB un-allocated disk are or where it comes from, also the disk is listed as RAW, does the disk manager read the boot sector or does it the try to read the MFT?

/Micke

mwitt
Posts: 13
Joined: 31 Mar 2012, 21:38

Re: Problem recovering partition/filesystem

#20 Post by mwitt »

Just did a recovery of a JPEG file with very interesting result. most of the files was not viewable at all, but the ones that are might give you some clue to what has happened?
PartitionGuru recovery example.GIF
PartitionGuru recovery example.GIF (227.15 KiB) Viewed 6068 times
Quite interesting as all data seems to be in there, just not in the right place???

/Micke

Locked