partition NTFS RECOVERY ..Signature is missing?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
User avatar
sixwerenine
Posts: 4
Joined: 02 Jul 2015, 22:06

partition NTFS RECOVERY ..Signature is missing?

#1 Post by sixwerenine »

showing unallocated space for windows partion that was partially formatted from a recover cd
Looking to recover NTFS partition or access files if possible
if not can i format that partition with out ruining the current Disk structure

Thank you for assistance.
logfile follows

Thu Jul 16 20:03:53 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-37-generic (#64-Ubuntu SMP Mon Sep 22 21:30:01 UTC 2014) i686
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-65A7B0, S/N:WD-WMASY1668882, FW:01.03B01

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000AAKS-65A7B0
Partition table type: Intel

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
1 P Linux 37419 112 6 58845 155 62 344211456
2 * Linux Swap 58845 188 32 59366 128 26 8366080
3 P Linux 59366 128 27 60801 15 14 23046144
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.
NTFS signature is missing.

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
check_part_i386 failed for partition type 07
HPFS - NTFS 19123 1 1 38895 254 63 317653182

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/1313, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 43026432
recover_EXT2: part_size 344211456
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 176 GB / 164 GiB
Linux Swap 58845 188 32 59366 128 10 8366064
SWAP2 version 1, pagesize=4096, 4283 MB / 4084 MiB

recover_EXT2: s_block_group_nr=0/87, s_mnt_count=133/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2880768
recover_EXT2: part_size 23046144
Linux 59366 128 27 60801 15 14 23046144
ext4 blocksize=4096 Large file Sparse superblock Recover, 11 GB / 10 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 19123 1 1 38895 254 63 317653182
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 176 GB / 164 GiB
* Linux Swap 58845 188 32 59366 128 26 8366080
SWAP2 version 1, pagesize=4096, 4283 MB / 4085 MiB
P Linux 59366 128 27 60801 15 14 23046144
ext4 blocksize=4096 Large file Sparse superblock Recover, 11 GB / 10 GiB
Not an exFAT boot sector.

HPFS - NTFS 19123 1 1 38895 254 63 317653182
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=2
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 176 GB / 164 GiB
Directory /
2 drwxr-xr-x 0 0 4096 4-Jan-2015 05:23 .
2 drwxr-xr-x 0 0 4096 4-Jan-2015 05:23 ..
11 drwx------ 0 0 16384 15-Mar-2013 14:38 lost+found
4718593 drwxr-xr-x 0 0 12288 14-Jul-2015 21:48 etc
9961473 drwxr-xr-x 0 0 4096 4-Mar-2015 19:07 media
7602177 drwxr-xr-x 0 0 4096 4-Jan-2015 07:33 bin
5505025 drwxr-xr-x 0 0 4096 4-Jan-2015 07:46 boot
6946817 drwxr-xr-x 0 0 4096 13-Feb-2013 15:10 dev
7077889 drwxr-xr-x 0 0 4096 9-Mar-2015 06:12 home
10485761 drwxr-xr-x 0 0 4096 4-Jan-2015 07:36 lib
4849665 drwxr-xr-x 0 0 4096 4-Jan-2015 05:08 lib64
1572865 drwxr-xr-x 0 0 4096 19-Apr-2012 02:32 mnt
7208961 drwxr-xr-x 0 0 4096 13-Feb-2013 15:07 opt
2883585 drwxr-xr-x 0 0 4096 19-Apr-2012 02:32 proc
10616833 drwx------ 0 0 4096 1-Feb-2014 07:04 root
6815745 drwxr-xr-x 0 0 4096 13-Feb-2013 15:10 run
3014657 drwxr-xr-x 0 0 12288 4-Jan-2015 07:39 sbin
X8781825 drwxr-xr-x 0 0 0 4-Jan-2015 05:23 selinux
8126465 drwxr-xr-x 0 0 4096 13-Feb-2013 15:07 srv
1703937 drwxr-xr-x 0 0 4096 14-Apr-2012 02:26 sys
6684673 drwxrwxrwt 0 0 4096 14-Jul-2015 21:48 tmp
3145729 drwxr-xr-x 0 0 4096 13-Feb-2013 15:07 usr
4325377 drwxr-xr-x 0 0 4096 4-Jan-2015 07:45 var
16 lrwxrwxrwx 0 0 29 31-Dec-2014 19:49 vmlinuz
6298 lrwxrwxrwx 0 0 33 31-Dec-2014 19:49 initrd.img
7340033 drwxr-xr-x 0 0 4096 15-Mar-2013 14:43 cdrom
12 -rw-rw---- 0 0 577404928 1-Jun-2013 11:20 sda5
2767 lrwxrwxrwx 0 0 33 29-Dec-2014 02:34 initrd.img.old
14 lrwxrwxrwx 0 0 30 29-Dec-2014 02:34 vmlinuz.old
X 14 lrwxrwxrwx 0 0 30 29-Dec-2014 02:34 vmlinuz.9448
Not an exFAT boot sector.

HPFS - NTFS 19123 1 1 38895 254 63 317653182
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * Linux Swap 58845 188 32 59366 128 26 8366080
2 P Linux 59366 128 27 60801 15 14 23046144
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New options :
Dump : No
Align partition: Yes
Expert mode : No

TestDisk exited normally.
Last edited by sixwerenine on 29 Jul 2015, 14:29, edited 1 time in total.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: partition NTFS RECOVERY ..Signature is missing?

#2 Post by Fiona »

I'll remove your second topic, next time it would be better to drop me a PM.

Can you run Deeper Search too?
Deeper Search looks additional for a backup of the boot sector and can find more partitions.
interface_write()
1 * Linux Swap 58845 188 32 59366 128 26 8366080
2 P Linux 59366 128 27 60801 15 14 23046144
simulate write!
Your Log file ends exactly at the Write menu, where the menu Deeper Search is available.

Fiona
Top
User avatar
sixwerenine
Posts: 4
Joined: 02 Jul 2015, 22:06

Re: partition NTFS RECOVERY ..Signature is missing?

#3 Post by sixwerenine »

Wonderful, good to hear.

Here's the Deeper Search
for some reason I did P for the HPFS NTFS

I chose not to "write" as it makes the system unbootable
It feels like we are so close to recovery but I am not grasping the sector, cylynder, FAT partition tables, boot loaders etc of disk management
I am interested and looking to learn more on my own
thank you for info





Sun Jul 26 23:04:59 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-37-generic (#64-Ubuntu SMP Mon Sep 22 21:30:01 UTC 2014) i686
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-65A7B0, S/N:WD-WMASY1668882, FW:01.03B01

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000AAKS-65A7B0
Partition table type: Intel

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
1 P Linux 37419 112 6 58845 155 62 344211456
2 * Linux Swap 58845 188 32 59366 128 26 8366080
3 P Linux 59366 128 27 60801 15 14 23046144

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
check_part_i386 failed for partition type 07
HPFS - NTFS 19123 1 1 38895 254 63 317653182

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/1313, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 43026432
recover_EXT2: part_size 344211456
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 176 GB / 164 GiB
Linux Swap 58845 188 32 59366 128 10 8366064
SWAP2 version 1, pagesize=4096, 4283 MB / 4084 MiB

recover_EXT2: s_block_group_nr=0/87, s_mnt_count=139/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2880768
recover_EXT2: part_size 23046144
Linux 59366 128 27 60801 15 14 23046144
ext4 blocksize=4096 Large file Sparse superblock Recover, 11 GB / 10 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 19123 1 1 38895 254 63 317653182
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 176 GB / 164 GiB
* Linux Swap 58845 188 32 59366 128 26 8366080
SWAP2 version 1, pagesize=4096, 4283 MB / 4085 MiB
P Linux 59366 128 27 60801 15 14 23046144
ext4 blocksize=4096 Large file Sparse superblock Recover, 11 GB / 10 GiB

interface_write()
1 P HPFS - NTFS 19123 1 1 38895 254 63 317653182
2 * Linux Swap 58845 188 32 59366 128 26 8366080
3 P Linux 59366 128 27 60801 15 14 23046144

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
check_part_i386 failed for partition type 07
HPFS - NTFS 19123 1 1 38895 254 63 317653182

recover_EXT2: s_block_group_nr=0/1313, s_mnt_count=71/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 43026432
recover_EXT2: part_size 344211456
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock, 176 GB / 164 GiB
Linux Swap 58845 188 32 59366 128 10 8366064
SWAP2 version 1, pagesize=4096, 4283 MB / 4084 MiB

recover_EXT2: s_block_group_nr=0/87, s_mnt_count=139/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2880768
recover_EXT2: part_size 23046144
Linux 59366 128 27 60801 15 14 23046144
ext4 blocksize=4096 Large file Sparse superblock Recover, 11 GB / 10 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
HPFS - NTFS 19123 1 1 38895 254 63 317653182
Linux 37419 112 6 58845 155 62 344211456
ext4 blocksize=4096 Large file Sparse superblock, 176 GB / 164 GiB
* Linux Swap 58845 188 32 59366 128 26 8366080
SWAP2 version 1, pagesize=4096, 4283 MB / 4085 MiB
P Linux 59366 128 27 60801 15 14 23046144
ext4 blocksize=4096 Large file Sparse superblock Recover, 11 GB / 10 GiB

interface_write()
1 P HPFS - NTFS 19123 1 1 38895 254 63 317653182
2 * Linux Swap 58845 188 32 59366 128 26 8366080
3 P Linux 59366 128 27 60801 15 14 23046144
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Top
Locked

Return to “Partition Recovery”