Recover Partition (Extended LBA)

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover Partition (Extended LBA)

#11 Post by Fiona »

The problem is, TestDisk only found your empty partition.
That's why it looks like your formatting was overridding your previous file system.
In this case, you'll always get an empty partition.
But your data should be still in your underlying sectors!
That's why you need datarecovery software.
Datarecovery software reads your data in your underlying sectors and let you copy it to another intact partition, disk or directory.
Please don't write anything to your affected disk anymore.
Otherwise, you'd overwrite your data.

PedroMendes
Posts: 14
Joined: 06 Apr 2012, 19:40

Re: Recover Partition (Extended LBA)

#12 Post by PedroMendes »

ok, i'll left testdisk apart from now on and concentrate recovering my data with a another software.. which data recovery application do you recommend? i'm already scanning with photorec, but it will take more than 2 weeks to end..
Image

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover Partition (Extended LBA)

#13 Post by Fiona »

It's unusual that PhotoRec takes as long.
Should be probably a couple of ours but not 2 weeks?
I assume, it's depend on read errors that PhotoRec hangs?

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Recover Partition (Extended LBA)

#14 Post by remy »

Yes, probably many bad sectors there. Duplication of the disk should be done before trying direct carving.

PedroMendes
Posts: 14
Joined: 06 Apr 2012, 19:40

Re: Recover Partition (Extended LBA)

#15 Post by PedroMendes »

well, i made a quick search and a deeper search with testdisk and the application did not recognize any error, but took +- 24hours to finish..
how can i duplicate the disk before the data recovery?
can someone explain the steps to be made for a correct data recovery?
thanks in advance

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover Partition (Extended LBA)

#16 Post by Fiona »

If you don't get any read errors anymore, then you can scan your drive directly.
But only, if your read errors were depend on double run of TestDisk as described in this post;
http://forum.cgsecurity.org/phpBB3/reco ... html#p1413
But it's still unusual that a scan takes as long.

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Recover Partition (Extended LBA)

#17 Post by remy »

@Pedromendes, I did not read the whole post, so consider Fiona advices as priority on mine. My warning is just about unusual time taken for scanning and previous read errors.

Some precisions : There are at least 3 kinds of problem with sector reading. 1st, your sector is "bad", I mean not in good condition. The heads will read the sector, make a read error, then try again, and again (until 10 times) to try correcting this error with CRC code embedded for each sector. It could give a result, the reading go on to the next sector (but it takes many much time) or return an error. Then, let's say your sector is dead. it's the second kind of corruption. It's marked as "waiting for reallocation" : next time a writing try will be done, else the writing was good and sector is considered as good (previous false error detection) else it's again faulty and then it is reallocated (if possible) and marked as bad. Third kind of problem is when heads are damaged or if there's alignement problem or anything else preventing reading correctly a good sector. When you begin to have error readings, it could be because your platter surface is damaged. Continuous readings on these damaged zones may also damaged heads, and killing your drive. So, in datarecovery field, when a disk shows problems, first stage is always to try to duplicate it, as far as possible. Then working on the copy. To do a good copy, you have to use tools able to do a bit/bit copy (every bit, allocated or not, as far as you don't know what is usefull for your recovery at this stage). Command line tools like dd or gnuddrescue under gnu/linux. There's also a mac and a windows version for dd but I don't know how it works with bad sectors and reading errors. I don't know if there's a gnuddrecscue for windows or mac.

That was, according to me, for step zero of a good datarecovery (and, if your disk is in very bad condition, copy the copy, keep a master and work on the secondary copy). Step 1 is to work on filesystem : try to recover filesystem on your disk, access and repair if there's corruption. Step 2 is to work on file carving : when you are not able to recover filesystem, you'll have to extract files from the surface, loosing the structure and the names.

Testdisk is a (good !) filesystem recovery tool. Photorec is (the best !) file carving tool.

PedroMendes
Posts: 14
Joined: 06 Apr 2012, 19:40

Re: Recover Partition (Extended LBA)

#18 Post by PedroMendes »

First of all, let me just thanks remy and fiona for the support.. without you i might had give up and all my data would be lost forever, but for now i still have hope for recovering them thanks to you both.

i did two deeper scans with testdisk, one of them gave me read errors, don't know why, but since the computer stopped recognized the disk at the time, i rebooted and it recognized again.. so the second deeper scan went ok, took a bit of time, but finished without read errors, so i presume the disk was fine, unfortunately it found only the partitions that were empty and i discard the possibility to recover my old partition and started thinking about data recovery, as recommended
in my external hard drive there is only personal files and not system files, which i hope it would be easier to recovering them

i am now using the photorec and another data recovery application (i cutted the name of the program because i didn't know if i could show it here), those are the results so far:
Image
(more than a month to finish)
Image
(5 months and 12days to finish? found 2 NTFS MFT File entries, is this a good sign?)

as you can see, both of them will take a long time to finish, does my computer (only 768mb of RAM and 1.80 GHz of CPU) as any negative influence on the estimated time?
and if i need to turn off the computer some day (since it will take some weeks, thats a long time without turning it off), will i be able to resume those scans? even if i disconnect the disk from the computer when its turned off?
the more time that the disk is turned on as some reduce of possibility to recover my files?
thanks again

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Recover Partition (Extended LBA)

#19 Post by remy »

Emergency stop photorec just now.... You are trying to do recovery with 2 softwares at the same time. This may kill even a disk in good condition, what is not the case for you.

The other software is good solution for your case. It's off topic, so I won't give assistance with it, but let you know that :
you can save your scan to continue it later.
Scanning first 10Gigs should be enough to have MFT and MFT mirror, and the to have a good recovery without scanning all. If not, then you will have to continue for the full scan.

But please : Don't stress your disk !

PedroMendes
Posts: 14
Joined: 06 Apr 2012, 19:40

Re: Recover Partition (Extended LBA)

#20 Post by PedroMendes »

ok, i stopped photorec.. anyway, since i could continue the scan later, i stopped the other application just to check the files that it had found so far (in the previous image it says that found more than 600 specific file documents, thats supposed to be files found, right?).. but for my surprise this was the result:

Image

13hours of scan and 0 bytes!? the disk was almost full, it should have found at least one file..
what should i do?

Locked