Recovery after Dban

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
nickh
Posts: 6
Joined: 12 Apr 2012, 12:00

Recovery after Dban

#1 Post by nickh »

Hello All.

I have a situation where I accidentally Dban (Boot + Nuked) both my internal and external usb disk - the one being accidental and stopped after <10seconds - but still won't boot.

The PC had a single HDD partitioned into C: and D:

Deeper Search finds 3 partitions instead of 2 and only the D: drive is shown in green - the other two are shown as Deleted.

Here's the issue - the C: does not start at 1 0 0 but something like 12 24 380 - so how can I correct this and get this partition to be the boot partition?

Also if anyone can advise how you take a screenshot in this Windows Emulated Environment then that would also be interesting for me and others.

Thanks!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery after Dban

#2 Post by Fiona »

Also if anyone can advise how you take a screenshot in this Windows Emulated Environment then that would also be interesting for me and others.
Can you make a photo from your display and use low resolution jpg as a file format?
Then upload it using a another computer?

nickh
Posts: 6
Joined: 12 Apr 2012, 12:00

Re: Recovery after Dban

#3 Post by nickh »

Ok - i managed to do PrntScn to Paint and extracted this Jpeg...

Does the Start at 12 223 20 need correcting?
Also what is the mystery partition starting at 14076 1 1?
Attachments
TestDisk2.JPG
TestDisk2.JPG (61.66 KiB) Viewed 7106 times

nickh
Posts: 6
Joined: 12 Apr 2012, 12:00

Re: Recovery after Dban

#4 Post by nickh »

When I use the <> keys to change the first partition to * bootable a warning comes up at the bottom in red saying:
Structure: Bad.

nickh
Posts: 6
Joined: 12 Apr 2012, 12:00

Re: Recovery after Dban

#5 Post by nickh »

Ok here are two more screenshots to compare -
Attachments
This shows what TestDisk thinks is OK with ? a bootable Primary and a separate Primary Partition?
This shows what TestDisk thinks is OK with ? a bootable Primary and a separate Primary Partition?
TestDisk3b.JPG (60.65 KiB) Viewed 7102 times
This shows what I thought the structure should be... with bootable primary and logical partitions
This shows what I thought the structure should be... with bootable primary and logical partitions
TestDisk3a.JPG (65.76 KiB) Viewed 7102 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery after Dban

#6 Post by Fiona »

Thanks for your Infos! :)
To exactly judge your situation, I would need a screenshot from Analyse (current partition structur).
It displays your partition table.

It looks like that you're using Win7?
Dban probably caught your first 100 MB System Reserved-Partition?
That's why you can't boot.
This partition is not available anymore.
This partition contains your boot files and must be primary active.
It's a normal NTFS-partition but it has no drive letter, so that user can't access this partition and change it.
This behavior is on purpose.

Would it be possible that TestDisk found your partition without lable, based on any remnants?
In this case, you can ignore it!

You can use Deeper Search in TestDisk to have a look does TestDisk find your system reserved partition?
If TestDisk finds a required partition, you can press F to go to the end of that partition, so TestDisk will have a look for the next one.

Your screen;
http://forum.cgsecurity.org/phpBB3/down ... php?id=332
It looks like that TestDisk found both important partitions
That Windows Reserved Partition should be active and listed with a Star at the left (currently not available).
Please change your HP-Partition to P for primary only.
Your Factory_Image-partition is correct and doesn't require any action.

There might be another possibility to get your system bootable again.
I assume, that both partitions, HP and Factory_Image are correct and there is nothing to do, but to get your system bootable again.
Please start from your Win7-CD into your System Recovery Options.
Have a try to use Startup Repair.
Probably it creates another partition?

Fiona

nickh
Posts: 6
Joined: 12 Apr 2012, 12:00

Re: Recovery after Dban

#7 Post by nickh »

Hi Fiona thanks for that.
Yes it's a Windows 7 machine.

The first image download/file.php?id=330 is the result of the Deeper Search.
(Doing the Quick Search only brings up the [Factory Image] Partition)

When you said
TestDisk finds a required partition, you can press F to go to the end of that partition, so TestDisk will have a look for the next one.
I don't see an option F listed?

Also I'm finding that any wrong press and I have to go through the Analyse process again taking around 1 1/2 hours!!

Nick

nickh
Posts: 6
Joined: 12 Apr 2012, 12:00

Re: Recovery after Dban

#8 Post by nickh »

Would it be possible that TestDisk found your partition without lable, based on any remnants?
In this case, you can ignore it!
Are you referring to the partition with the red arrow here?
Attachments
TestDisk3b.JPG
TestDisk3b.JPG (93.36 KiB) Viewed 7096 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recovery after Dban

#9 Post by Fiona »

Are you referring to the partition with the red arrow here?
Yes I referred to this partition.
Looks like that this partition was only recognized based on remnants and should be ignored.

If TestDisk finds more partitions using Deeper Search, it will list all recoverable partitions (using their size).
If a partition ends after disk limit, TestDisk diplays a message, that it can't be recovered.
If partitions overlap you must decide to set one partition to primary, logical or primary active for recovery using your right or left arrow key on your keyboard.
That's easily depend on, two partitions cannot use the same space.
I don't see an option F listed?
There is nothing listed, but pressing F on your keyboard does it.
Unfortunately it's supported first since version 6.14 beta.
You're using version 6.13.
When I use the <> keys to change the first partition to * bootable a warning comes up at the bottom in red saying:
Structure: Bad.
It happens to partitions when they overlap.
For example a logical partitions lies in an extended partition.
An extended partition doesn't appear in Quick nor Deeper Search but at the menu Write, where you write your complete partition structur.
An extended partition requires some space, so partitions overlap.
That's why you've got this message.

Did you check your partitions HP and Factory_Image and did you press p (on your keyboard) to list your files?
Please let me know, did you see your data or an error message.
It provides infos about the condition of your file system.
A corrupt or damaged file system is different.
Also your partition HP was found using a backup of the boot sector.
So it might be possible that dban caught that partition also?
Hopefully not.
Can you check that partition after Deeper Search and press p to list your files?
Please let me know, did you see your data or an error message.
You can press q for quit to get back to the previous screen.
But be careful and don't loose your Deeper Search anymore.
It's easily intended to get out of the menu List to list your data.

If you've seen your data;
Check your partition HP.
Use your right or left arrow to set it to P for primary only..
Check your partition Factory_Image and set it to P for primary also.
Ignore that partition without label and keep it as D for deleted.
Then press Enter to proceed.
Check Write and press anter and y, to write your partitions into the partition table.
The boot sector of your HP-partition is damaged.
That's why the menu Advanced appears and offers you to repair the boot sector.
Please confirm there using Backup BS.
This will copy the backup of the boot sector over your boot sector.
Then it should be repaired.
Close TestDisk using Quit and restart.

Of course your Windows can't restart, because your boot partition is not there anymore.
Try this one like I already described;
There might be another possibility to get your system bootable again.
I assume, that both partitions, HP and Factory_Image are correct and there is nothing to do, but to get your system bootable again.
Please start from your Win7-CD into your System Recovery Options.
Have a try to use Startup Repair.
Probably it creates another partition?
If everything works right, you should be able to boot into your Windows again.

Locked