Help needed with TestDisk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
will007
Posts: 33
Joined: 19 Sep 2015, 10:10

Re: Help needed with TestDisk

#11 Post by will007 »

What do I do next? I don't think I can see this in the step by step.
Last edited by will007 on 01 Nov 2015, 12:01, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk

#12 Post by Fiona »

Can you upload another photo from TestDisk / Analyse?
I'd like to check your current partition table (current partition structure and partitions.
The message structure bad often appears, if partitions overlap.
Runnung chkdsk on RAW partitions will only work if you have a valid boot sector.
Boot sector could be repaired, but if you're able to list your files, you should copy/backup your data first before you run chkdsk.
Please let me know, which partition contains your important data.

Fiona

will007
Posts: 33
Joined: 19 Sep 2015, 10:10

Re: Help needed with TestDisk

#13 Post by will007 »

testdisk8.jpg
testdisk8.jpg (52 KiB) Viewed 4421 times
The above screenshot shows the screen I see after clicking on "Analyse" on the "Disk /dev/sdb - 1000 GB / 931 GiB" drive.
testdisk9.jpg
testdisk9.jpg (48.13 KiB) Viewed 4421 times
The above screenshot shows the screen I see after clicking on "Quick search".
The partition that contains all my files is the middle partition, as highlighted in green in the above screenshot.
I have also attached the testdisk log below:

Thu Oct 1 22:49:17 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6001) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=311681875968
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=974864252928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=419430400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=24507318272
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096
Drive C: - 311 GB / 290 GiB - CHS 37893 255 63, sector size=512
Drive E: - 974 GB / 907 GiB - CHS 14815 255 63, sector size=4096
Drive F: - 419 MB / 400 MiB - CHS 6 255 63, sector size=4096
Drive G: - 24 GB / 22 GiB - CHS 372 255 63, sector size=4096

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 819200, partition 102400
NTFS at 12/146/7
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 1904031744, partition 238003968
NTFS at 14827/161/55
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 47865856, partition 5983232
Current partition structure:
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
1 P HPFS - NTFS 0 4 5 6 99 29 102400
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
2 * HPFS - NTFS 12 146 7 14827 161 54 238003968
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
3 P HPFS - NTFS 14827 161 55 15200 18 50 5983232


Thank you for your help.
Attachments
testdisk7.jpg
testdisk7.jpg (52.53 KiB) Viewed 4421 times
Last edited by will007 on 01 Nov 2015, 12:04, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk

#14 Post by Fiona »

Can you use the latest version of TestDisk 7.1WIP?
Your disk is recognized with 4096 Byte sector size, but your partitions with 512 Bytes only.
In rare cases it can cause that data are not recognized correctly.
Can you run another diagnose to test sector size of 512 Bytes on your disk?
You'll find it under the menu geometry.
Only change sector size.
Nothing else.
Please watch the message very dangerous at the bottom of the screen.
It means, that you shouldn't use Write under TestDisk nor Repair MFT to avoid any changes!
I strongly recommend it!
If you don't write something to your disk, you will not change nor modify something.
So you can change the value and it will be not written to your disk.
If you close TestDisk all settings will be lost.
At least it will be a try to list your data.
If they are listed, please let me know!

If it's successful, sector size could be written.
But only in case and info will follow.

Fiona

will007
Posts: 33
Joined: 19 Sep 2015, 10:10

Re: Help needed with TestDisk

#15 Post by will007 »

Hi Fiona, yes ok, I will try using the latest beta version of TestDisk 7.1-WIP tonight and let you know the result.
Last edited by will007 on 01 Nov 2015, 12:05, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk

#16 Post by Fiona »

If you've already recovered your data, there is no necessity to run another diagnose again.
Sector size message can appear if you use a disk on another PC, because disk controller is different.
Did you create your Recover-DVD's?
Laptops are a kind of tricky.
Manufacturer often use a different partition type instead of FAT or NTFS to hide partitions.
It's intended that user can't change anything.
Often the first partition contains some utilities that you can start diagnostic etc..
The last partition ist mostly recovery.
Also the partition table is sometimes modified, so that you can press a certain key during startup to get to diagnostic and recovery.
TestDisk works Intel or GPT-standard and if you write a partition, you can override modification in your partition table.
But it's only valid for modified partition tables.

I've checked the whole topic to find more information.
On another PC, it would be possible that you have no ownership or administrator privileges on partitions?
But it's not advisable to change ownership nor privileges.
It can cause a lot of confusion.
To figure out what kind of partition types HP uses, you should call or write HP support.
The only affect would be that partitions under windows are visible.
You can have more drivelettes and drive letters can be changed.
But it could be done later.
Todays most used partition type to hide partitions is Windows REstore for recovery.
Boot partitions are often System Reserved and have no drive letter.
Efi partitions are often not visible either.

Also, I've seen that your first partition does not contain any boot files.
But the third partition contains some.
Have a look at your third partition:
http://forum.cgsecurity.org/phpBB3/down ... hp?id=3392
You can consider to make it bootable and test it.
Compare with your first partition it only contains a folder called recovery:
http://forum.cgsecurity.org/phpBB3/down ... hp?id=3392
There are no boot files but it was set to star for active and bootable.

It would be worth a try to change it and write your partitions using testdisk again.
You should run Analyse and Quick Search.
Set your third partition as described above to Star * for active.
Set the other two partitions to P for primary only.
Use TestDisk to write your partitions.
Put your disk back into your laptop and try to boot.
Please let me know.

There is still something what I don't know at the moment and would be important to clear:
Your boot partition contains some efi information.
But on your first photos before you used TestDisk to write your partitions, your partitions were displayed as Intel and not as EFI GPT (UEFI).
From your log file:
Partition table type default to Intel
Disk /dev/sdb - 1000 GB / 931 GiB
Partition table type: Intel
UEFI can work with Intel-MBR too.
If you experience any problems, please let me know.
A pretty good question would be, did you have an Intel or GPT-disk before?
It would be possible to convert your disk to GPT but it's not as easy.
It means:
You have to delete all partitions using your disk management console.
You have to rightclick into the small square at the left side at your disk in the disk management console and convert it to GPT.
Afterwards you have to run TestDisk Analyse and Quick Search again.
Setting your bootable partition to Star and the other ones to P for primary only and write the partition structure using Write into your GPT partition table.
But only in case you'll need it.

Fiona

will007
Posts: 33
Joined: 19 Sep 2015, 10:10

Re: Help needed with TestDisk

#17 Post by will007 »

Hi Fiona,

Ok, I will try to write the partition again, and set the 3rd partition as bootable.I will let you know the outcome ASAP.

You might be right, I haven't tried to put the hard disk back into my laptop yet, as I'm scared it might write things to it on boot up, but I might try that again. I did have a finger print security on my HP envy laptop (not the Bios log in thing).

Yes, you're right, the 1st partition only contains a "recovery" folder, whereas the 3rd partition contains lots of files, although I don't know what they're for.

With regards to your question about "on your first photos before you used TestDisk to write your partitions, your partitions were displayed as Intel and not as EFI GPT (UEFI).": I must admit, I don't really understand most of what you said as I'm only a beginner at this sort of things, but maybe it could be when my hard disk was first broken, I put the hard disk into a USB docking station and plugged it to my laptop, but because I couldn't see it under "My Computer" but I could see it under "Disk Management", and it said "unallocated" and also "uninitialized", it asked me to initialize and I think I selected "MBR (Master Boot Record)" and then clicked "OK", like this:
testDisk10.jpg
testDisk10.jpg (88.94 KiB) Viewed 4387 times
Sorry, I do not know what "UEFI" is or what GPT is, I just know there is two different type of partition called "MBR" and GPT".

All I have done since my hard disk was broken was the following steps:
1. Took Harddisk out of my laptop
2. Plugged it into a USB docking station and into a different computer
3. In Disk Management, it shows as uninitialized and unallocated, so I initialized it as selected "MBR (Master Boot Record)" and then clicked "OK" (This is probably a wrong move by me and maybe I shouldn't have done this without knowing what it actually does)
4. Used TestDisk to copy files back and backup everything I needed
5. Used TestDisk to set the middle partition as bootable, and then "Write" as per cgrenier's instructions

That is basically what I have done so far.

Thank you Fiona for your kind help again.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk

#18 Post by Fiona »

I've seen that your third partition contains some files like efi.
That's why I assume that your disk was GPT.
I'd rather converting it.
I already wrote some info about it in my post above.
In case, please let me know, when I can guide you through.

Fiona

will007
Posts: 33
Joined: 19 Sep 2015, 10:10

Re: Help needed with TestDisk

#19 Post by will007 »

Hi Fiona,

This is what I tried tonight:

Before I follow your instructions, I thought I would try putting the hard disk back into my HP Envy laptop and see if it would work, but the message I got was this:
testdisk12.jpg
testdisk12.jpg (64.43 KiB) Viewed 4362 times
So "Boot Device Not found".

Then I tried your advise and used TestDisk to set my 3rd partition as * (Primary bootable), and then pressed "Write" and restarted my computer. I then put the hard disk back into the HP Envy and try again, but again, same result, "Boot Device Not found." :cry:

So now I don't know what to do...

I look into Disk Management, and this is what I see now:
testdisk10.jpg
testdisk10.jpg (76.54 KiB) Viewed 4362 times
and then I Googled what other people's HP Envy partitions look like and I found this image on the internet (http://h30434.www3.hp.com/t5/image/serv ... B?v=mpbl-1):
testdisk11.jpg
testdisk11.jpg (69.29 KiB) Viewed 4362 times
If you compare both screenshots, you will similarities:

- 1st partition in both screenshot is 400MB
- 2nd partition is slightly smaller, but my says "Unallocated"
- 3rd partition is the biggest, and contains all the files, including the OS
- 4th partition is the smallest and probably the recovery partition
- the 2nd partition has "EFI", I don't know what this means.

Does that give any clue as to what I should do next? Please help.

Why do i have a 388MB black "Unallocated" partition in Disk Management?

Thank you once again.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk

#20 Post by Fiona »

Looks like that the second partition is an EFI-Bootpartition.
Disk size is different, your one 1 TB and 500 GB.
Normally the file system of that efi partition is FAT?
It's not available on your disk.
You can try to convert your disk to GPT and start another diagnose using TestDisk and have a try to find it too.
You must use your disk management console to delete all partitions.
After deleting, rightclick into the left little square and convert it to GPT.
After converting, an applet of your disk management console will appear and suggest to create partitions.
Don't do it and stop it.
There is no necessity, because TestDisk should search for partitions and recover the original ones.
Please use the latest TestDisk 7.1WIP.
As far as I know, yesterday was a new beta released.
On GPT-partition TestDisk will scan each sector and might be a little bit time consuming.
The latest beta can be a faster.
Run TestDisk / Analyse and Quick Search.
GPT-Partitions under TestDisk appear with different names like MS Reserved and MS Data.
Keep an eye on that small missing efi partition.
If you still miss it, please run Deeper Search also.
I'd need the result of the Search.
Please copy and paste the content of your testdisk.log into your next post.
Don't use Write as far.
I've to check your efi-partition.
Might be possible that your efi-FAT-partition is listed as a normal FAT-Partition.
In case, it could be necessary to change the partition type to efi.
Info will follow.

Important:
I already asked you, did you create Recovery-DVD's
Should be the first thing after buying a laptop.
You should try to do something first.
Put your disk into your laptop.
Have a try to start into recovery mode.
Please let me know, did it work.
You'll find a description in your manual.
Then intention is, to create recovery-DVD's and is recovery available?
Manufacturer often offer that Recovery-DVD's can be ordered.
On the other hand:
Your partitions appear as RAW, but you can list all data.
Even the recovery data.
TestDisk could copy them off of your disk.
I've had one case, he was able to execute recovery and create Recovery-DVD's
Recovery will set back your laptop to factory settings.
Might be possible that you can start recovery after converting your disk back to gpt and create recovery-DVD's?
There are lots of questions.
But first of all try to boot into the recovery mode.
You can consider to copy recovery data.
Otherwise convert it to GPT and have another try after partition recovery.
Although I've no idea, did you create any recovery-DVD's?
Also I've no idea, did HP already deliver software and recovery-DVD's with your laptop?

Fiona

Locked