Is there any hope in getting back my data?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kwxvii
Posts: 3
Joined: 21 Jan 2015, 01:47

Is there any hope in getting back my data?

#1 Post by kwxvii »

AfterDeeperSearch.PNG
AfterDeeperSearch.PNG (22.92 KiB) Viewed 2663 times
Tried to restore partition using testdisk but I think I have written the wrong partition as after doing so, my 1.5TB (which is around 98% full) became 250GB (the rest are unallocated according to Windows Disk Manager). So I "expanded" the allocation thinking that it will magically bring my files back, but didn't. Please note that the files seem to be there as well but most of them (around 90%) are 0 bytes in sizes. And every time I try to navigate to each folder I get this message as well: "The Recycle Bin on W:\ is corrupted. Do you want to empty the Recycle Bin for this drive?" Of course I always click No as I do not want to make matters worse. I have tried running testdisk again (deep search) and the following is the log:



Mon Jan 19 20:36:39 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239502098432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000397884928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1500298346496
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:X3DPP40YT, FW:AX001C
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD3, S/N:1347095AE1A1, FW:MU03
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78XQAK, FW:0143
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST315003 41AS, S/N:9344EFFFFFFF
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Desktop, S/N:2GHKBBPP, FW:0130

Partition table type (auto): Intel
Disk /dev/sdd - 1500 GB / 1397 GiB - ST315003 41AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open inode: Input/output error.
repair_MFT
NTFS at 0/32/33
ntfs_readdir failed for cluster 5
NTFS listing using MFT:
Directory /
5 dr-xr-xr-x 0 0 0 17-Jan-2015 02:45 .
5 dr-xr-xr-x 0 0 0 17-Jan-2015 02:45 ..
14984 dr-xr-xr-x 0 0 0 30-Nov-2010 22:39 H_Blog
NTFS filesystem need to be repaired.
ntfs_dir: ntfs_inode_open failed
Don't fix MFT mirror.

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

Any comments or guidance on what to do next will be much appreciated. Thanks in advance.

Elmer
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Is there any hope in getting back my data?

#2 Post by cgrenier »

The partition table is ok but the MFT is corrupted.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
Top
kwxvii
Posts: 3
Joined: 21 Jan 2015, 01:47

Re: Is there any hope in getting back my data?

#3 Post by kwxvii »

cgrenier wrote:The partition table is ok but the MFT is corrupted.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
Hi, thanks for the reply. After running chkdsk /f as suggested, the result is still the same: meaning most of my files are still 0 byte in size. I ran another "deeper search" and the following is the log:

-------------------------------------------------------------------------------------------------------------------------------------
Wed Jan 21 21:01:52 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239502098432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000397884928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8002732032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1500298346496
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:X3DPP40YT, FW:AX001C
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD3, S/N:1347095AE1A1, FW:MU03
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78XQAK, FW:0143
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST315003 41AS, S/N:9344EFFFFFFF
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Desktop, S/N:2GHKBBPP, FW:0130
Disk /dev/sdf - 8004 MB / 7633 MiB - CHS 973 255 63, sector size=512 - SanDisk Cruzer Glide, S/N:4C532000020926104521, FW:1.26

Partition table type (auto): Intel
Disk /dev/sdd - 1500 GB / 1397 GiB - ST315003 41AS
Partition table type: Intel

Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
Attachments
&quot;Unrecoverable&quot; partition 1
"Unrecoverable" partition 1
AfterDeeperSearch1.PNG (15.6 KiB) Viewed 2639 times
&quot;Unrecoverable&quot; partition 2
"Unrecoverable" partition 2
AfterDeeperSearch2.PNG (13.76 KiB) Viewed 2639 times
&quot;Unrecoverable&quot; partition 3
"Unrecoverable" partition 3
AfterDeeperSearch3.PNG (13.85 KiB) Viewed 2639 times
Top
kwxvii
Posts: 3
Joined: 21 Jan 2015, 01:47

Re: Is there any hope in getting back my data?

#4 Post by kwxvii »

Ok then, I guess there's no more hope in recovering my data...thanks anyway for the help.
Top
europanorama
Posts: 75
Joined: 18 Dec 2014, 10:44

Re: Is there any hope in getting back my data?

#5 Post by europanorama »

If you can see your files wiht testdisk you would rather save them with knoppix live-dvd. its much easier and quicker. try it out. nothing can be destroyed.
http://forum.cgsecurity.org/phpBB3/back ... t4690.html
if not successful try to restore with phototec.
Top
Locked

Return to “Partition Recovery”