Deleted volume from HDD

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
perdomojc
Posts: 1
Joined: 11 Apr 2015, 14:41

Deleted volume from HDD

#1 Post by perdomojc »

Hello!

I accidentily deleted a simple volume from my data drive. I used testdisk, and it show me the partition, but i cant recover it.

HPFS - NTFS 2610 245 4 63411 195 16 976764928 [DataDrive]

Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 521 GB / 485 GiB)
The following partition can't be recovered:
HPFS - NTFS 2610 245 4 63411 195 16 976764928 [DataDrive]
NTFS, blocksize=4096, 500 GB / 465 GiB

What do i can do to recover de partition? Can yo help me?

Here'S the log (I used version 6.14)

Thank you so much

regards

Juan

LOG

Sat Apr 11 13:47:15 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1073741824000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=426556522496
filewin32_getfilesize(\\.\F:) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\H:) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\J:) GetFileSize err Función incorrecta.

filewin32_setfilepointer(\\.\J:) SetFilePointer err Función incorrecta.

Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=0
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=0
Warning: can't get size for \\.\N:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500320AS, S/N:2020202020202020202020205135334d38594237, FW:SD1A
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST31500341AS, S/N:202020202020202020202020563930534b534a58, FW:SD17
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500320AS, S/N:2020202020202020202020205135334d305a4735, FW:SD1A

Partition table type default to Intel
Disk /dev/sda - 500 GB / 465 GiB - ST3500320AS
Partition table type: Intel

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 41943040
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 2610 245 3 41943040 [SWAP]
NTFS, blocksize=4096, 21 GB / 20 GiB
NTFS at 2610/245/4
filesystem size 976764928
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2610 245 4 63411 195 16 976764928 [DataDrive]
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=41945088, size=976764928, end=1018710015, disk end=976773168)

recover_EXT2: s_block_group_nr=0/140, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4605952
recover_EXT2: part_size 36847616
Linux 3836 48 53 6129 216 39 36847616
ext4 blocksize=4096 Large file Sparse superblock Recover, 18 GB / 17 GiB

recover_EXT2: s_block_group_nr=0/400, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13107200
recover_EXT2: part_size 104857600
Linux 7200 113 18 13727 134 39 104857600
ext4 blocksize=4096 Large file Sparse superblock Recover, 53 GB / 50 GiB

recover_EXT2: s_block_group_nr=0/400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13107200
recover_EXT2: part_size 104857600
Linux 14190 8 27 20717 29 48 104857600
ext4 blocksize=4096 Large file Sparse superblock Recover, 53 GB / 50 GiB

recover_EXT2: s_block_group_nr=0/400, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13107200
recover_EXT2: part_size 104857600
Linux 21556 117 2 28083 138 23 104857600
ext4 blocksize=4096 Large file Sparse superblock Recover, 53 GB / 50 GiB

recover_EXT2: s_block_group_nr=0/242, s_mnt_count=17/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7937024
recover_EXT2: part_size 63496192
Linux 47358 213 24 51311 74 27 63496192
ext4 blocksize=4096 Large file Sparse superblock Recover, 32 GB / 30 GiB
file_pread(4,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(4,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(4,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(4,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(4,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(4,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(4,13,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(4,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(4,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(4,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(4,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(4,2,buffer,976777215(60801/145/16)) lseek err Invalid argument
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 521 GB / 485 GiB)
The following partition can't be recovered:
HPFS - NTFS 2610 245 4 63411 195 16 976764928 [DataDrive]
NTFS, blocksize=4096, 500 GB / 465 GiB

Results
* HPFS - NTFS 0 32 33 2610 245 3 41943040 [SWAP]
NTFS, blocksize=4096, 21 GB / 20 GiB
P Linux 3836 48 53 6129 216 39 36847616
ext4 blocksize=4096 Large file Sparse superblock Recover, 18 GB / 17 GiB
P Linux 7200 113 18 13727 134 39 104857600
ext4 blocksize=4096 Large file Sparse superblock Recover, 53 GB / 50 GiB
L Linux 14190 8 27 20717 29 48 104857600
ext4 blocksize=4096 Large file Sparse superblock Recover, 53 GB / 50 GiB
L Linux 21556 117 2 28083 138 23 104857600
ext4 blocksize=4096 Large file Sparse superblock Recover, 53 GB / 50 GiB
L Linux 47358 213 24 51311 74 27 63496192
ext4 blocksize=4096 Large file Sparse superblock Recover, 32 GB / 30 GiB

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deleted volume from HDD

#2 Post by cgrenier »

Using the arrow keys, set the partition you want to recover as P(rimary). On next screen, choose Write, confirm, Quit

Locked