Partitions recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
vtmike
Posts: 4
Joined: 07 Dec 2014, 02:23

Partitions recovery

#1 Post by vtmike »

Hello everyone

I am using testdisk 6.14 and after completing the deeper search and having the cylinders are analyzed I have three NTFS NTFS files all are denoted by a D Preceeding them.

Where im stuck is in trying to reciver each one individually and obtaining all if their photos. But one of the partitions(the middle parition) is giving me a "can't open filesystem, file sysrem seems damage"

When I try to "load backup" on that same partition it gives me a "no backup found!" Message.

please someone tell me there is a way for me to recover this partition or the rest of them as I am trying to get all my photos back of family from years and years of photo collecting.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partitions recovery

#2 Post by cgrenier »

Without the testdisk.log file, it's not easy to help you...

Set the 3 partitions to P(rimary), on next screen, choose Write, confirm, Quit and restart your computer.

vtmike
Posts: 4
Joined: 07 Dec 2014, 02:23

Re: Partitions recovery

#3 Post by vtmike »

I am trying to include screen shots of what is being displayed through the console but im either faced with a size restriction or a extension docx not allowed, so below you will find the log in its entirety after replicating the circumstances exactly the same way:




Sun Dec 7 13:01:29 2014
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-04-15T19:00:04
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=272706306048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=21419261952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4260364288
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=41940670464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=38074788864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=21473787904
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - TOSHIBA MK3276GSX, S/N:Z1S7SB2GS, FW:GS00
Disk /dev/sdb - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - SAMSUNG HD080HJ
Drive C: - 272 GB / 253 GiB - CHS 33154 255 63, sector size=512
Drive D: - 21 GB / 19 GiB - CHS 2604 255 63, sector size=512
Drive E: - 4260 MB / 4063 MiB - CHS 517 255 63, sector size=512
Drive Z: - 21 GB / 19 GiB - CHS 2610 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 80 GB / 74 GiB - SAMSUNG HD080HJ
Partition table type: Intel

Analyse Disk /dev/sdb - 80 GB / 74 GiB - CHS 9729 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 5099/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * HPFS - NTFS 0 1 1 5098 254 63 81915372
2 E extended LBA 5099 0 1 9727 254 63 74364885
5 L HPFS - NTFS 5099 1 1 9727 254 63 74364822
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/sdb - 80 GB / 74 GiB - CHS 9729 255 63
NTFS at 0/1/1
filesystem size 81915372
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 5119710
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5098 254 63 81915372
NTFS, 41 GB / 39 GiB
NTFS at 5099/1/1
filesystem size 74364822
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4647801
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5099 1 1 9727 254 63 74364822
NTFS, 38 GB / 35 GiB
file_pread(5,2,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(5,7,buffer,156303361(9729/110/47)) lseek err Invalid argument
file_pread(5,8,buffer,156303368(9729/110/54)) lseek err Invalid argument
file_pread(5,3,buffer,156303376(9729/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,156303423(9729/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,156303439(9729/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,156303486(9729/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,156305408(9729/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 5098 254 63 81915372
NTFS, 41 GB / 39 GiB
L HPFS - NTFS 5099 1 1 9727 254 63 74364822
NTFS, 38 GB / 35 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 1 1 5098 254 63 81915372
2 E extended LBA 5099 0 1 9727 254 63 74364885
5 L HPFS - NTFS 5099 1 1 9727 254 63 74364822

search_part()
Disk /dev/sdb - 80 GB / 74 GiB - CHS 9729 255 63
NTFS at 0/1/1
filesystem size 81915372
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 5119710
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5098 254 63 81915372
NTFS, 41 GB / 39 GiB
NTFS at 5098/254/63
filesystem size 81915372
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 5119710
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5098 254 63 81915372
NTFS found using backup sector!, 41 GB / 39 GiB
NTFS at 5099/1/1
filesystem size 74364822
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4647801
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5099 1 1 9727 254 63 74364822
NTFS, 38 GB / 35 GiB
NTFS at 9727/254/63
filesystem size 74364822
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4647801
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5099 1 1 9727 254 63 74364822
NTFS found using backup sector!, 38 GB / 35 GiB
NTFS at 9728/254/63
filesystem size 123202422
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 7700151
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2060 1 1 9728 254 63 123202422
NTFS found using backup sector!, 63 GB / 58 GiB
file_pread(5,2,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,156301515(9729/81/28)) lseek err Invalid argument
file_pread(5,8,buffer,156301643(9729/83/30)) lseek err Invalid argument
file_pread(5,8,buffer,156301771(9729/85/32)) lseek err Invalid argument
file_pread(5,8,buffer,156301899(9729/87/34)) lseek err Invalid argument
file_pread(5,8,buffer,156302027(9729/89/36)) lseek err Invalid argument
file_pread(5,8,buffer,156302155(9729/91/38)) lseek err Invalid argument
file_pread(5,8,buffer,156302283(9729/93/40)) lseek err Invalid argument
file_pread(5,8,buffer,156302411(9729/95/42)) lseek err Invalid argument
file_pread(5,8,buffer,156302539(9729/97/44)) lseek err Invalid argument
file_pread(5,8,buffer,156302667(9729/99/46)) lseek err Invalid argument
file_pread(5,8,buffer,156302795(9729/101/48)) lseek err Invalid argument
file_pread(5,8,buffer,156302923(9729/103/50)) lseek err Invalid argument
file_pread(5,8,buffer,156303051(9729/105/52)) lseek err Invalid argument
file_pread(5,8,buffer,156303179(9729/107/54)) lseek err Invalid argument
file_pread(5,8,buffer,156303307(9729/109/56)) lseek err Invalid argument
file_pread(5,1,buffer,156303359(9729/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6

Results
HPFS - NTFS 0 1 1 5098 254 63 81915372
NTFS, 41 GB / 39 GiB
HPFS - NTFS 2060 1 1 9728 254 63 123202422
NTFS found using backup sector!, 63 GB / 58 GiB
HPFS - NTFS 5099 1 1 9727 254 63 74364822
NTFS, 38 GB / 35 GiB

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

vtmike
Posts: 4
Joined: 07 Dec 2014, 02:23

Re: Partitions recovery

#4 Post by vtmike »

Also on a side note I am using BlacX to access the drive VIA my computer, so I am not sure if I can only save the files I want and not recreate the partition on my laptop as I fear it may have been compromised.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partitions recovery

#5 Post by cgrenier »

The partition "HPFS - NTFS 2060 1 1 9728 254 63 123202422" overlaps both "HPFS - NTFS 0 1 1 5098 254 63 81915372" and " "HPFS - NTFS 5099 1 1 9727 254 63 74364822".
So if one of the 2 partitions is correct, the partition beginning at 2060/1/1 is not.

vtmike
Posts: 4
Joined: 07 Dec 2014, 02:23

Re: Partitions recovery

#6 Post by vtmike »

So to confirm I should change those two partitions from "D"eleted to "P"rimary and proceed to collect the data?

Locked