Not sure how to proceed

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
junga
Posts: 7
Joined: 29 Jul 2015, 15:40

Not sure how to proceed

#1 Post by junga »

Hello,

I would like to have a much needed help if possible, I run test disk analysis and it showed a space conflict, at this point I am not exactly sure how to proceed to hopefully recuperate the family pictures. :cry:
windows indicates that the drive is not accessible, the parameter is incorrect.
Things I tried: changing the drive letter, try to boot from a linux live OS hoping to see the files, but unfortunately without success.

Thank you for reading.

Michel

Image

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Not sure how to proceed

#2 Post by Fiona »

Can you repeat your diagnose and selecting disk instead of a drive.
Disk looks like:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Drive C: - 981 GB / 913 GiB - CHS 119300 255 63, sector size=512
Drive E: - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive F: - 3000 GB / 2794 GiB - CHS 45598 255 63, sector size=4096
TestDisk 7.1WIP 32bit is recommended.

Fiona

junga
Posts: 7
Joined: 29 Jul 2015, 15:40

Re: Not sure how to proceed

#3 Post by junga »

Yes of course,

Image

Thank you.

Michel

junga
Posts: 7
Joined: 29 Jul 2015, 15:40

Re: Not sure how to proceed

#4 Post by junga »

a shy bump. :)

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Not sure how to proceed

#5 Post by Fiona »

You already have a partition in your partition table.
If this partition would be correct, you can have a try to run a boot sector diagnose.
Can you run testdisk, Advanced and Boot and upload another snapshot?
Can you use the menu List and have a try to list your files?
Until yet, don't use Write nor RepairMFT!
It's intended to avoid any changes to your file system.

Fiona

junga
Posts: 7
Joined: 29 Jul 2015, 15:40

Re: Not sure how to proceed

#6 Post by junga »

Thank you Fiona,

here are the screenshots:
Boot:
Image
List:
Image

Regards,

Michel

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Not sure how to proceed

#7 Post by Fiona »

Can you try to run on your current partition a RebuildBS and if the boot sector is different, you can have another try to list your files, using the menu List.
If it wouldn't help:
Can you run TestDisk Deeper Search?
The intention is, to find another partition by the backup of the boot sector.

Fiona

junga
Posts: 7
Joined: 29 Jul 2015, 15:40

Re: Not sure how to proceed

#8 Post by junga »

Thank you Fiona,

RebuildBS:

Image

Boot sectors identical could not list:

Image

Deep scan result:

Image

I could not see the back up of the boot sector.

Regards,

Michel

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Not sure how to proceed

#9 Post by Fiona »

Your current message displays only not recoverable partitions which end after disk limit.
Fat12 and FAT16 partitions are probably wrong.
At this display, when you press enter, you'll get to the results.
Did testdisk find another partition?
If not, you'll probably need datarecovery software which reads underlying data.
Can you copy and paste the content of your testdisk.log into your next post?
PhotoRec could help.
Info will follow.

Fiona

junga
Posts: 7
Joined: 29 Jul 2015, 15:40

Re: Not sure how to proceed

#10 Post by junga »

Thank you Fiona,

After continue on Fat12:

Image

seems like a boot partition found.

Image

Log:

Tue Aug 4 12:20:43 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, Cygwin 2000.4

Compilation date: 2015-07-30T21:13:54
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=64421363712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=55055966208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=2000396321280

Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 840 Series, S/N:*************, FW:DXT09B0Q
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-9YN164, S/N:**********
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20 EARS-00MVWB0, S/N:************
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=16 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 1 1 243201 0 63 3907024065

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/1/1
filesystem size 3907024065
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189004
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 243201 0 63 3907024065
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029183(243201/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,3907029311(243201/83/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029439(243201/85/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029567(243201/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029695(243201/89/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029823(243201/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029951(243201/93/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030079(243201/95/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030207(243201/97/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030335(243201/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030463(243201/101/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030591(243201/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030719(243201/105/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030847(243201/107/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030975(243201/109/44)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(5,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(5,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(5,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
* HPFS - NTFS 0 1 1 243201 254 63 3907040067
NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 243201 254 63 3907040067
***end of log***

Regards,

Michel

Locked