Lost the partition/mft/boot sectors

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Lost the partition/mft/boot sectors

#1 Post by malstrom »

Hello!

Love the software, i was able to copy some of the files of my NTFS-gone-RAW disk. But then something happened, and i lost the partitions, and i am getting read-errors.

External Seagate Backup plus 3TB disk. Turned raw after not safely removing. No weird sounds, so i'm guessing software problem. I found the disk in testdisk (tried both windows, and finally in ubuntu), did a quick search and found all my files. I was able to copy files, but after a while i got some read-error and couldn't access the disk anymore. Then i disconnected the seagate, re connected, ran testdisk again and was able to copy some more files, before the errors came back. Then i did something, and i'm not sure what, but i suspect it got converted from MBR to GPT, can this be? (i think i ran ntfsfix and tried to mount the disk manually, in ubuntu. it did not work). In any case, after this i was able to find the disk in testdisk, but with wrong size info, and "EFI GPT" was highlighted, not "Intel" as it was before. After this i have been unable to find any files, and the quick/deep search just gives "read errors". I tried running testdisk thru windows, which showed the disk wrongly at 2TB, and just gave mentioned errors in searches.

back in ubuntu i choose the disk, "efi gpt" highlighted so i press enter. quick search gave "read error at..." and no partition, so i abort early. of curiosity i chose "Add partition" and (for some reason) chose "MBR" as type. then Loaded backup, which gave me a partition but named "mbr".

I now have the disk appear to be normal in testdisk in ubuntu, correct "HPFS NTFS" and size. i choose the disk and proceed. "EFI GPT" is highlighted, but should be Intel(!?) so i chose this instead, i get "partition read error", press quick search which gives read errors, i stop. then i got to chose "load backup" (i backed up before when i had the right partition showing, and could see the files). im presented with what looks right "hpfs ntfs...", i chose to Write, but get "Write error". Then to analyse, which now shows 2 identical "ntfs" partitions, but with "invalid NTFS or EXFAT boot".

I go back, chose Intel, advanced, which shows "no partition availiable". same when i try with efi-gpt. So i chose "None", which gives me "P unknown" partition. i chose Type, and NTFS, and now it shows as "P NTFS 0 0 1 357698 35 21 732566645". I try to view List, but it freezes. after some time i am able to try Boot instead, which states "cant read boot sector/backup boot sector", both being Bad and identical. I chose Rebuild BS, but it freezes. Earlier attempts at rebuilding boot sector (thru Intel i think, not "none"), gave me a screen "searching for MFT", and it searched for hours but only came to barely 1%, so i aborted.

----------------------------

this is the situation. what might have happened since i seem to have lost the partition, and ability to view the files? is it an MFT problem? MBR/GPT problem? Can i still recover the mft or boot sector somehow, so i can find the partition and files again??

Thanks in advance!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost the partition/mft/boot sectors

#2 Post by Fiona »

I'm concerned about your read errors?
In some cases and large disks, it helped to use an USB-Hub with power supply to stabilize the USB-connection.
Under windows:
The latest TestDisk 7.1WIP and 32bit version is recommended.
How ist your disk listed in your disk management console?
Select your disk and right click into the small square at the left side.
is there any description like convert it to GPT or MBR?
Please let me know.
Even if it's grayed out!
Check your disk unsing CrystalDiskInfo.
http://crystalmark.info/download/index-e.html
Please use the portable version!
Would it be possible that your partition table or partition got changed or modified?
Running TestDisk / Advanced and a boot sector repair on a modified or wrong partition in your partition table wouldn't help.
In case, Quick or Deeper Search can help to find the right partition, either by the boot sector or its backup.
Info will follow.

Fiona

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#3 Post by malstrom »

Thank you for the reply Fiona,

I have not yet tried thru USB-hub, will try in the coming week. Also i will try tonight with testdisk 7.1 (have been using 7.0).

in disk management it has gone thru changes. To begin with it looked more normal, but asked me to format, it had turned RAW. At this point i was able still to copy files with testdisk. After the problems it turned black, and disk management asked me to Initiate the disk. Now interestingly enough, after not having used the disk for a few days, it's greyed out again asking me not to Initiate but to Format, and is showing as RAW again, with the correct size! (it showed as 900TB or something a few days ago..).

The option to convert to GPR is greyed out. It is showing as active, primary, MBR type, 100% free space (not true of course). for some reason it is write-protected, not sure why, but that's something i wanted anyways i guess.

I am suspecting this, that something happened (i prob did something wrong), and the partition table/partition got changed/modified. I could see both partition and files perfectly to begin with, and then all was lost, and it wasnt recognized as "Intel" anymore, so i'm guessing i modified it by mistake. Is there a way to get back the original partition table, thru a backup, if this is the case?

The disk is unfortunately not recognized by CrystalDiskInfo. Should it work with a USB-drive?

I am now doing a quick scan with testdisk7.1, it will prob take days, is this my next step?
"None" was highlighted, i chose Intel instead (or should i try with None?). Advanced showed "no partition availiable". Analyse showed "partition: read error". quick scan is running now, but with "read error at...). Should i still let it run, or abort?

Kindly, Magnus

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost the partition/mft/boot sectors

#4 Post by Fiona »

After your disk asppeared as RAW with the correct size, have you been able to copy data again?
Perhaps a loose or defective contact?
Difficult to judge.
Did you try to use another cable etc..?
(it showed as 900TB or something a few days ago..).
Wrong size can also cause a wrong storage management (LBA) and read errors.
Initializing a disk is since W2k (Win 2000) required, so that windows can handle it.
It writes a 4 Bytes signatur (ID) into your partition table.
CrystalDiskInfo works only on initialized disks and supports USB too.
In any case, an USB-HUB with power supply can stabilize the USB connection.
I've often seen it, when formatting of a large disk stopped.
With an USB-HUB it was possible to solve the problem.

Currently it's most important when your disk appears as RAW again, to have another try to copy all data off of your disk.
As long you shouldn't initialze it or work on a disk with wrong size recognition.
At the moment I wouldn't stress the disk more than necessary.
Only to have a try to copy your data off.

Fiona

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#5 Post by malstrom »

No i wasn't able to access the data. I am running testdisk in windows10 now, i have not yet tried in ubuntu (but i doubt it will make all the difference?). The disk looks normal in testdisk, but the partition is not showing. And as i wrote it didn't detect as "Intel" but as "none".

I did change cable before i tried yesterday, it's possible it made some difference. But i have had luck before w both my cables, so i suspect i messed things up writing codes in ubuntu terminal to run ntfsfix/trying to mount the disk in ubuntu manually (i'm a real novice, and it was after this things turned ugly it seems). I'm sure you are right about usb-connection being unstable, i will try with an usb-hub once i can borrow one. But i think the main problem is me messing up the configuration of the disk somehow/losing the partition table? At the very beginning when things got bad, i noticed testdisk recognizing the disk as "efi gpt", being "Intel" just moments before when it all worked. Before disk management showed the disk as RAW and asked me to format, now since my troubles started it's asking me to initialize too. Is this a boot sector problem that has come up?

My quick scan is still running, still at 1%, still with "read error at...". Should i abort and try a different route, or should i let it scan? One question - as i said "None" is high lighted. this time i chose "Intel", just because it's what it SHOULD be, but am i better off running a quick scan thru "None" or "efi gpt"? Should i run quick scan at all, or rather Search for MFT/rebuild bs (which i'm able to access if i chose "None"..).

Another idea i had was to initialize, and perhaps even format, just to get the disk in working order, and then trying to search for the old partition table and files in testdisk, or is this a doomed idea?

it seems i need to get it back to being recognized as "Intel" type somehow to be able to find the partition and files. How i do this is the big mystery =) As i said, i'm sure a USB-hub could be a part of the solution, but doesn't it seem likely that ntfsfix, or me trying to manually mount did something to the software/converted the type somehow?

Thanks a million //Magnus

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#6 Post by malstrom »

also on a side note, i chose to create a log in testdisk, and it seems to be eating up my whole system drive of 390gb, is this to be expected? i'm currently running the quick scan..

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost the partition/mft/boot sectors

#7 Post by Fiona »

How is you disk listed in your disk management console.
Under windows you should use TestDisk 7.1WIP.
Currently it's important how is your disk recognized in your disk management console.
Do you think it would be possible to get your disk back as RAW and the correct disk size?

Fiona

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#8 Post by malstrom »

Last time i connected it was listed black, with wrong size (2gb at that time). Now it's listed as RAW again, at correct size, looking "good" in disk management. But i am unable to access the files, testdisk7.1WIP cannot find the partition, and i get the read errors running the quick scan.

the disk is showing at correct size in testdisk. if i chose "none", testdisk can find an "P UNKNOWN" partition. clicking Advanced i get "p unknown 0 5860507647 5860507648". chosing Analyse shows me the same info. Chosing Intel or EFI GPT shows me "no partition availiable" in Advanced, and "partition: read error" in Analyse. Somehow i need to get the disk to be recognized as Intel type again? It seems the partition is there still somewhere, but just unable to be recognized/read as Intel?

Magnus

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#9 Post by malstrom »

running quick scan now as both Intel and None, read errors on both, but still running.

In the quick scan window, the disk shows as: "Drive H: 3000GB / 2794GiB - CHS 1565540352 1 1",
does that help at all?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost the partition/mft/boot sectors

#10 Post by Fiona »

In the quick scan window, the disk shows as: "Drive H: 3000GB / 2794GiB - CHS 1565540352 1 1",
You shouldn't select Drive but Disk instead.
It looks like:
Disk /dev/sd* (*=abc)

TestDisk 7.1WIP 32bit is recommended.
Can you repeat your diagnose and select Disk instead of a drive?
Does your partition still appears as RAW?
Please copy and paste the content of your testdisk.log into your next post!
Selecting your Disk instead of a drive will autoselect your partition table type.
Should be either Intel or GPT.

Fiona

Locked