accidently wrote bad partition instead of healthy one Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Ultronium
Posts: 10
Joined: 10 Nov 2014, 09:01

accidently wrote bad partition instead of healthy one

#1 Post by Ultronium »

Hi!

as most poeple here, i had this RAW partition probleme, but when i runned testdisk, which im familir with, my partition was listed twice after depper search, and i think that i wrote the wrong one with the bad filesystem since i have "filesystem seems damaged " message.

does it mean i lost my healthy partition forever? :cry:
please help me im desperate ..

eclark461
Posts: 7
Joined: 17 Nov 2014, 21:36

Re: accidently wrote bad partition instead of healthy one

#2 Post by eclark461 »

You can navigate through the files of the drive and look for the ones that you are trying to read from and use that partition as a recovery and write the partition back to the hard drive.

However... In most cases when you have a lost partition, it makes more sense to copy all recoverable data off of the hard drive before attempting a re-write of the partition table.

Ultronium
Posts: 10
Joined: 10 Nov 2014, 09:01

Re: accidently wrote bad partition instead of healthy one

#3 Post by Ultronium »

i can't even acces the partion through testdisk because i get "filesystem damaged " message :/

eclark461
Posts: 7
Joined: 17 Nov 2014, 21:36

Re: accidently wrote bad partition instead of healthy one

#4 Post by eclark461 »

have you looked at the geometry section and checked that the data matches what is in the top portion of testdisk.

And be advised that TestDisk does not simply work in all cases and for everyone the same.

can you give me a pastebin of the log file that you are using as well ?

Ultronium
Posts: 10
Joined: 10 Nov 2014, 09:01

Re: accidently wrote bad partition instead of healthy one

#5 Post by Ultronium »

thank you !seem the only one to care here...

i m really messed up and here is why:
when i run testdisk with the HDD inside my laptop, (means that i boot from windows on my defected HDD ( the partition damaged is D: not windows partition)) the numbers of heads is set to 16, but when i remove it and run testdisk from another pc it set itself to 255...
OK, i ll run testdisk through the night and ill join the log file tomorrow, with heads = 255 set in geometry settings as mentioned by testdisk.

the real problem tht i think i fried my hdd: because in the first time, when i runned deep search, i found 2 similar results for the lost partition, and i wrote the one with the bad file system. i tried many recovery softs but most of my files are corrupeted, BUT THEY STILL THERE!

i still have hope to recover my partition, back up my files they wipe it off.

ill join the log file asap.

thank you.

Ultronium
Posts: 10
Joined: 10 Nov 2014, 09:01

Re: accidently wrote bad partition instead of healthy one

#6 Post by Ultronium »

Code: Select all


Tue Nov 18 23:38:37 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-11-02T16:15:34
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156372992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156372992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=164532060160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=335467773952
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=215821058048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=25037897728
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=104857600
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000BEVT-75A0RT0, S/N:2020202057202d44585731344141303031323635, FW:01.01A01
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 -    Mass Storage Device

Partition table type (auto): Intel
Disk /dev/sdb - 750 GB / 698 GiB -    Mass Storage Device
Partition table type: Intel

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Info: size boot_sector 421525497, partition 421525504
NTFS at 88157/48/20
Current partition structure:
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
 2 P HPFS - NTFS             12 223 20 26251 159 20  421525504
 3 P HPFS - NTFS          88157  48 20 91201  52 51   48902144

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           421525497
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 26251 159 13  421525497
     NTFS, blocksize=4096, 215 GB / 200 GiB
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 88157/48/20
filesystem size           48902144
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          88157  48 20 91201  52 51   48902144
     NTFS, blocksize=4096, 25 GB / 23 GiB
Search for partition aborted

Results
   * HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P HPFS - NTFS             12 223 20 26251 159 20  421525504
     NTFS, blocksize=4096, 215 GB / 200 GiB
   P HPFS - NTFS          88157  48 20 91201  52 51   48902144
     NTFS, blocksize=4096, 25 GB / 23 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
 2 P HPFS - NTFS             12 223 20 26251 159 20  421525504
 3 P HPFS - NTFS          88157  48 20 91201  52 51   48902144
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           421525497
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 26251 159 13  421525497
     NTFS, blocksize=4096, 215 GB / 200 GiB
file_pread(5,16,buffer,59912318(3729/94/12)) ReadFile Erreur de données (contrôle de redondance cyclique).

file_pread(5,1,buffer,59912318(3729/94/12)) ReadFile Erreur de données (contrôle de redondance cyclique).

NTFS at 26251/159/20
filesystem size           421525497
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 27 26251 159 20  421525497
     NTFS found using backup sector, blocksize=4096, 215 GB / 200 GiB
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 88157/48/19
heads/cylinder 16 (NTFS) != 255 (HD)
filesystem size           994508592
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          26251 227 41 88157  48 19  994508592
     NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
NTFS at 88157/48/20
filesystem size           48902144
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          88157  48 20 91201  52 51   48902144
     NTFS, blocksize=4096, 25 GB / 23 GiB
NTFS at 91201/52/51
filesystem size           48902144
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          88157  48 20 91201  52 51   48902144
     NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
file_pread(5,2,buffer,1465149440(91201/85/21)) lseek err Invalid argument
file_pread(5,1,buffer,1465149440(91201/85/21)) lseek err Invalid argument
file_pread(5,2,buffer,1465149452(91201/85/33)) lseek err Invalid argument
file_pread(5,1,buffer,1465149452(91201/85/33)) lseek err Invalid argument
file_pread(5,2,buffer,1465149503(91201/86/21)) lseek err Invalid argument
file_pread(5,1,buffer,1465149503(91201/86/21)) lseek err Invalid argument
file_pread(5,2,buffer,1465149515(91201/86/33)) lseek err Invalid argument
file_pread(5,1,buffer,1465149515(91201/86/33)) lseek err Invalid argument
file_pread(5,8,buffer,1465149184(91201/81/17)) lseek err Invalid argument
file_pread(5,1,buffer,1465149184(91201/81/17)) lseek err Invalid argument
file_pread(5,8,buffer,1465149312(91201/83/19)) lseek err Invalid argument
file_pread(5,1,buffer,1465149439(91201/85/20)) lseek err Invalid argument
file_pread(5,1,buffer,1465149440(91201/85/21)) lseek err Invalid argument
file_pread(5,14,buffer,1465149441(91201/85/22)) lseek err Invalid argument
file_pread(5,3,buffer,1465149455(91201/85/36)) lseek err Invalid argument
file_pread(5,3,buffer,1465149502(91201/86/20)) lseek err Invalid argument
file_pread(5,8,buffer,1465149518(91201/86/36)) lseek err Invalid argument
file_pread(5,11,buffer,1465149565(91201/87/20)) lseek err Invalid argument
file_pread(5,2,buffer,1465151487(91201/117/52)) lseek err Invalid argument
NTFS at 12/223/19
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 12/223/20
filesystem size           421525497
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1

Results
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS             12 223 20 26251 159 20  421525504
     NTFS, blocksize=4096, 215 GB / 200 GiB
   * HPFS - NTFS          26251 227 41 88157  48 19  994508592
     NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
   P HPFS - NTFS          88157  48 20 91201  52 51   48902144
     NTFS, blocksize=4096, 25 GB / 23 GiB


dir_partition inode=5
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
Directory /
       5 dr-xr-xr-x     0      0         0 14-Nov-2014 12:55 .
       5 dr-xr-xr-x     0      0         0 14-Nov-2014 12:55 ..
     106 dr-xr-xr-x     0      0         0 17-Nov-2014 13:37 $RECYCLE.BIN
      36 dr-xr-xr-x     0      0         0  9-Nov-2014 23:40 BOOT
      99 dr-xr-xr-x     0      0         0 18-Nov-2014 13:56 System Volume Information
      35 -r--r--r--     0      0    383786 21-Nov-2010 04:23 bootmgr
Not an exFAT boot sector.


dir_partition inode=5
     HPFS - NTFS             12 223 20 26251 159 20  421525504
     NTFS, blocksize=4096, 215 GB / 200 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 18-Nov-2014 21:20 .
       5 dr-xr-xr-x     0      0         0 18-Nov-2014 21:20 ..
      35 dr-xr-xr-x     0      0         0 17-Nov-2014 13:37 $Recycle.Bin
   15441 dr-xr-xr-x     0      0         0 18-Nov-2014 13:56 Config.Msi
   13457 dr-xr-xr-x     0      0         0 14-Jul-2009 06:08 Documents and Settings
   44830 dr-xr-xr-x     0      0         0  9-Jan-2012 11:46 Intel
      36 dr-xr-xr-x     0      0         0 14-Jul-2009 04:20 PerfLogs
      38 dr-xr-xr-x     0      0         0 18-Nov-2014 13:44 Program Files
     210 dr-xr-xr-x     0      0         0 18-Nov-2014 13:56 Program Files (x86)
     325 dr-xr-xr-x     0      0         0 18-Nov-2014 13:42 ProgramData
   21360 dr-xr-xr-x     0      0         0  9-Nov-2014 14:45 Recovery
   90213 dr-xr-xr-x     0      0         0 14-Nov-2014 21:10 Riot Games
    1580 dr-xr-xr-x     0      0         0 18-Nov-2014 15:04 System Volume Information
     422 dr-xr-xr-x     0      0         0  9-Nov-2014 14:46 Users
     584 dr-xr-xr-x     0      0         0  9-Nov-2014 14:50 Windows
      17 dr-xr-xr-x     0      0         0 17-Nov-2014 21:07 found.000
   69393 -r--r--r--     0      0      2184  9-Jan-2012 11:49 RHDSetup.log
   58320 -r--r--r--     0      0       164  9-Nov-2014 14:49 Setup.log
   13761 -r--r--r--     0      0 4204314624 18-Nov-2014 23:27 hiberfil.sys
   17007 -r--r--r--     0      0 4204314624 18-Nov-2014 23:27 pagefile.sys
Not an exFAT boot sector.


   P HPFS - NTFS          26251 227 41 88157  48 19  994508592
     NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
   P HPFS - NTFS          88157  48 20 91201  52 51   48902144
     NTFS, blocksize=4096, 25 GB / 23 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 18-Nov-2014 15:04 .
       5 dr-xr-xr-x     0      0         0 18-Nov-2014 15:04 ..
      35 dr-xr-xr-x     0      0         0 17-Nov-2014 13:37 $RECYCLE.BIN
      51 dr-xr-xr-x     0      0         0 11-Jan-2012 00:25 EFI
   13628 dr-xr-xr-x     0      0         0 17-Sep-2014 09:32 Recovery
    5206 dr-xr-xr-x     0      0         0 11-Jan-2012 00:56 Restore
    5205 dr-xr-xr-x     0      0         0 18-Nov-2014 13:56 System Volume Information
      64 dr-xr-xr-x     0      0         0 11-Jan-2012 00:29 SystemSoftware
    4745 dr-xr-xr-x     0      0         0  9-Nov-2014 23:29 WinClon
      38 dr-xr-xr-x     0      0         0 11-Jan-2012 00:25 boot
      62 dr-xr-xr-x     0      0         0 11-Jan-2012 00:25 sources
    5199 -r--r--r--     0      0         0 24-Apr-2007 12:56 WinClon.WCL
      50 -r--r--r--     0      0    383786 19-Nov-2010 20:40 bootmgr
      61 -r--r--r--     0      0    481680 13-Jul-2009 23:10 imagex.exe
    5201 -r--r--r--     0      0 4293007160 11-Jan-2012 00:09 init.w01
    5202 -r--r--r--     0      0 4292989151 11-Jan-2012 00:15 init.w02
    5203 -r--r--r--     0      0 3295781930 11-Jan-2012 00:19 init.w03
    5200 -r--r--r--     0      0 4293002435 11-Jan-2012 00:19 init.wcl
    5204 -r--r--r--     0      0        44 11-Jan-2012 00:19 init.woo

interface_write()
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
 2 P HPFS - NTFS             12 223 20 26251 159 20  421525504
 3 P HPFS - NTFS          26251 227 41 88157  48 19  994508592
 4 P HPFS - NTFS          88157  48 20 91201  52 51   48902144
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

ntfs_boot_sector
 3 P HPFS - NTFS          26251 227 41 88157  48 19  994508592
     NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
NTFS at 26251/227/41
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 26251/227/41
heads/cylinder 16 (NTFS) != 255 (HD)
filesystem size           994508592
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Status: OK

Backup boot sector
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.


Ultronium
Posts: 10
Joined: 10 Nov 2014, 09:01

Re: accidently wrote bad partition instead of healthy one

#7 Post by Ultronium »

PS:

my drive is
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Mass Storage Device

and my lost partition is
HPFS - NTFS 26251 227 41 88157 48 19 994508592

and this is the problem :
P HPFS - NTFS 26251 227 41 88157 48 19 994508592
NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
Can't open filesystem. Filesystem seems damaged.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: accidently wrote bad partition instead of healthy one

#8 Post by Fiona »

TestDisk doesn't touch any data within your partition.
It only writes partitions into your partition table and in case testdisk repairs your boot sector.
Have you been able to list your files before?
Did you run a RebuildBS?

eclark461
Posts: 7
Joined: 17 Nov 2014, 21:36

Re: accidently wrote bad partition instead of healthy one

#9 Post by eclark461 »

Ok Once Again.

In order to really work with TestDisk on a hard drive, or anything that modifies your partition tables etc.

You must have these three scenarios before I would even begin to do anything

Your Hard Drive which is bad

A different hard drive - in which to store your critical data on

A working computer in which to run TestDisk and recover files.

I have found that sometimes after repeated attempts at writing / fixing / re-writing partitions you may wind up with some data loss. ( i myself recently lost over 3 TB of movies from a disk because I was stupid).

Ultronium
Posts: 10
Joined: 10 Nov 2014, 09:01

Re: accidently wrote bad partition instead of healthy one

#10 Post by Ultronium »

Fiona wrote:TestDisk doesn't touch any data within your partition.
It only writes partitions into your partition table and in case testdisk repairs your boot sector.
Have you been able to list your files before?
Did you run a RebuildBS?
yes i rebuilt the boot sector without succes :/

Locked