The Thousandth Partition for you to help Answer

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

The Thousandth Partition for you to help Answer

#1 Post by Artfldgr »

hi,
pretty simple... i have a drive with a few terabytes of data. ntfs, no boot, and just files
i was trying to look at some vobs (video files), and for some odd reason, the program that was playing them suddently asked to write to the disk, and before i could think, i hit ok... it did what it did, and the system then hung (i fear a virus)... the disk became not to good.

so, i moved it to a different machine, plugged in the USB, and got to work with your excellent software
i was able to find the boot sector, but an analyse would take way too long...
so i looked to advanced and listed the files and was able to see a recycle.. and a file i created later
but was not able to see the directory with several gigs of movies..

so i eventually tried skipping deep search as the partition was there, it was not with other things, and so i wrote.
this did not work... then tried again, but that was a failure too... eventually i got to the area where one could dump the boot and see... but the only choices it gave me was to overwrite and to rebuild... not restore from the backup...

i ran the rebuild, but did not commit it.
and this is the response to list (i did NOT write):
Image

I am hoping to recover on the disk some of the files if not all that i can.
is it hopeless? you can tell me doc? :)

here are some more screens...
Image

here is the dump AFTER the rebuild, but before i hit write (because i am not hitting write till i hear back)
Image

given i am in the states (nyc), i figure your probably asleep as i write this :)
so i will leave the drive for tomorrow (or when you answer)

thanks so much as fixing this, as always, is a life saver...
thanks thanks thanks thanks!!!!
Attachments
testdiskcmd03.jpg
testdiskcmd03.jpg (242.41 KiB) Viewed 2852 times
testdiskcmd02.jpg
testdiskcmd02.jpg (74.4 KiB) Viewed 2852 times
testdiskcmd01.jpg
testdiskcmd01.jpg (97.64 KiB) Viewed 2852 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: The Thousandth Partition for you to help Answer

#2 Post by Fiona »

Looks like that your partition table type is Intel.
Might be possible with 4k sectors it might be supported?
Otherwise, Intel MBR supports disks up to 2.2 TB.
The alignement of your partition aren't Intel nor microsoft standard.
That's why you should consider to run a complete Deeper Search.
At least something to try.

Fiona

Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

Re: The Thousandth Partition for you to help Answer

#3 Post by Artfldgr »

Hi,
thanks for answering Fiona. I will run the scan as time allows then post the results.
the drive was formatted as ntfs by a windows xp system. it was clobbered by software running a win10 sys.
ah well... given the estimates from shorter runs that didnt finish due to time, it will take nearly 8 hours to run the whole drive. (ouch).

thanks again!

Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

Re: The Thousandth Partition for you to help Answer

#4 Post by Artfldgr »

Hi,
i set up the job this morning (nyc time), and had it run all day while at work...
when i came home, i was surprised to see the screen to the previous screen before the deep scan
however, i went to the log, opened it up and here is the information for you.
Wed Aug 5 08:16:00 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=82348277760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdh)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=82348277760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=320072933376
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=3000558944256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=48784103424
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=33550884864
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=83886211584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=84934950912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=81236606976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=3000557895680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=320070288384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=200047002624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=320070288384
Hard disk list
Disk /dev/sda - 82 GB / 76 GiB - CHS 10011 255 63, sector size=512
Disk /dev/sdb - 250 GB / 232 GiB - CHS 484521 16 63, sector size=512
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdd - 200 GB / 186 GiB - CHS 24321 255 63, sector size=512
Disk /dev/sde - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096
Disk \\.\PhysicalDrive7 - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096
Drive C: - 48 GB / 45 GiB - CHS 5930 255 63, sector size=512
Drive F: - 33 GB / 31 GiB - CHS 4078 255 63, sector size=512
Drive K: - 83 GB / 78 GiB - CHS 162539 16 63, sector size=512
Drive L: - 84 GB / 79 GiB - CHS 164572 16 63, sector size=512
Drive M: - 81 GB / 75 GiB - CHS 157406 16 63, sector size=512
Drive O: - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096
Drive V: - 320 GB / 298 GiB - CHS 38912 255 63, sector size=512
Drive X: - 200 GB / 186 GiB - CHS 24320 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdh - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 45599 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/4/5
heads/cylinder 1 (NTFS) != 255 (HD)
sect/track 1 (NTFS) != 63 (HD)
Current partition structure:
Warning: number of heads/cylinder mismatches 1 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 1 (NTFS) != 63 (HD)
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
No partition is bootable

search_part()
Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 45599 255 63
NTFS at 0/4/5
heads/cylinder 1 (NTFS) != 255 (HD)
sect/track 1 (NTFS) != 63 (HD)
filesystem size 732558080
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 366279039
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 4 5 45599 165 6 732558080
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(9,1,buffer,732558336(45599/165/7)) ReadFile The drive cannot find the sector requested.

file_pread(9,1,buffer,732558337(45599/165/8)) lseek err Invalid argument
file_pread(9,1,buffer,732558338(45599/165/9)) lseek err Invalid argument
file_pread(9,2,buffer,732558343(45599/165/14)) lseek err Invalid argument
file_pread(9,2,buffer,732558345(45599/165/16)) lseek err Invalid argument
file_pread(9,3,buffer,732558351(45599/165/22)) lseek err Invalid argument
file_pread(9,1,buffer,732558592(45599/169/11)) lseek err Invalid argument

Results
* HPFS - NTFS 0 4 5 45599 165 6 732558080
NTFS, blocksize=4096, 3000 GB / 2794 GiB

interface_write()
1 * HPFS - NTFS 0 4 5 45599 165 6 732558080
Image



also, when selecting which disk to scan, the disk came up three times, so i included a screen capture of that.
it comes up as
disk 0:\
disk ''.' physical drive 5
and disk /dev/sdf as well

the scan was run against the first one, in case that makes a difference.

THANKS!!!

P.S. it may not have come up as a EFI GPT that may have changed by my idiocy trying to fix it before i contacted you.
Attachments
testdiskanalyse01.jpg
testdiskanalyse01.jpg (170.61 KiB) Viewed 2827 times

Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

Re: The Thousandth Partition for you to help Answer

#5 Post by Artfldgr »

Hi,
did i miss something?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: The Thousandth Partition for you to help Answer

#6 Post by cgrenier »

Run TestDisk, Advanced, select the NTFS partition, Boot, RebuildBS, List.
Can you see your files ?

Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

Re: The Thousandth Partition for you to help Answer

#7 Post by Artfldgr »

That is what i did before i ran the deep scan...
only a couple of files could be seen. if you look at the first post you can see the results of that.

oh... and thank you so much for answering... :)

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: The Thousandth Partition for you to help Answer

#8 Post by Fiona »

Did you run Deeper Search?
Your log file ends after Quick Search with the result and the menu Write.
Exactly there you'll find the menu Deeper Search.
You can watch your steps here:
Current partition structure:
Warning: number of heads/cylinder mismatches 1 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 1 (NTFS) != 63 (HD)
1 P HPFS - NTFS 0 4 5 45599 165 6 732558080
It's your current partition strucure.
Then Quick Search displays the following result:
Results
* HPFS - NTFS 0 4 5 45599 165 6 732558080
NTFS, blocksize=4096, 3000 GB / 2794 GiB
There is no difference to your current partition structure.
You confirmed with enter and testdisk stopped at the menu write.
interface_write()
1 * HPFS - NTFS 0 4 5 45599 165 6 732558080
Exactly at the menu Write, you'll find Deeper Search as I requested to run.
Deeper Search can find more partitions by the backup of the boot sector and recover them.
Always select any found partition and press p to have a try to list your files.

I've seen that you changed from EFI GPT to Intel.
To scan large GPT partitions is very time consuming because each sector will be scanned.
Using Intel is much faster but you can't write an Intel partition to a GUID partition table.
The only possibilty to use Intel and if partitions with data are found, would be to copy them to another intact disk or partition.

Fiona

Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

Re: The Thousandth Partition for you to help Answer

#9 Post by Artfldgr »

Hi
i did run the deeper search, it took over 8 hours to do that. and i put up the log file i had...
hmmm...

oh.. deepest apologies for not answering sooner as i had a business trip and just got back last night, and couldnt work on anything while i was away.

as far as the intel vs gpt... i originally formated this using XP.
the system that crabbed it, was win10 but was running an older piece of software
what REALLY REALLY stinks is that the software shouldnt have written anything, given it was just reading info.

so what your saying, allowing me to reiterate.
is that you need me to do a long long long GPT deep scan and save that log...
i guess i can set that up tonight, and while i sleep, have that get done and hopefully that will go faster.
in this case, i will move the scanning software to my other computer, and hook up the drive there, as that computer is a monster fast box, with usb 3 and the drive is also usb 3, so that (hopefully) should speed things up over the usb 2 of the xp box... (which i am getting rid of and this is part of that process)

i am also adding some drives today, so if the information comes up i can have a place to dump files to if we find them... i am hoping that i can get most of them, and would be very happy with that

oh.. i nearly forgot to mention, there are no other partitions on this drive..
ie. i formatted it as one large drive, not several partitions. :)
so in essence we are only trying to reconstruct the one partition and get files off of it.

THANKS SO MUCH FIONA!!!!!!!!!!!!
i greatly appreciate you taking the time out of your life to assist me and really cant say thanks enough.

Artfldgr
Posts: 18
Joined: 04 Aug 2015, 01:02

Re: The Thousandth Partition for you to help Answer

#10 Post by Artfldgr »

Well that was fun... NOT... :)

i set up the thing for overnight... and as you said GPT was slower...
then went snoozing.. when i woke up the log file was 100 gigs and filled the drive. HA!

I have gone into windows settings to prevent the drive from going to sleep, because it was not mounted when i returned in the morning. so i figured after a long while with the computer sitting, it disconnected the drive in the middle of the scan, and interpreted that as read errors, writing a line in the file for every sector that was considered "bad"

i cant even open this file... :)

I will retry again tonight with a bit of a different set up and see if i can get anywhere with that.

thanks Fiona!!!!!!!!!!!!!!!
Attachments
100gigtestdisk.jpg
100gigtestdisk.jpg (98.69 KiB) Viewed 2725 times

Locked