Lost the partition/mft/boot sectors

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#11 Post by malstrom »

I'm using testdisk7.1WIP 32 now.

In test disk i only see 2 disks, the internal ones, and the external as a drive only, see picture:
Image

This is my diskmanagement view:
Image

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#12 Post by malstrom »

the logfile is at 50mb, by just starting quickscan and aborting directly, is that normal? after running for a day it's well over 300gb. it reads:

("felaktig funktion" means erroneous/bad function).

--------------------------------


Thu Nov 26 00:11:32 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, Cygwin32 2002.0
Compilation date: 2015-11-14T13:49:32
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
filewin32_getfilesize(/dev/sdd) GetFileSize err Felaktig funktion.

filewin32_setfilepointer(/dev/sdd) SetFilePointer err Felaktig funktion.

Warning: can't get size for Disk /dev/sdd - 0 B - 0 sectors, sector size=512 - Seagate Backup+ Desk
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Felaktig funktion.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Felaktig funktion.

Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=419431145472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=580771841024
filewin32_getfilesize(\\.\F:) GetFileSize err Felaktig funktion.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Felaktig funktion.

Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\G:) GetFileSize err Felaktig funktion.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Felaktig funktion.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=3000579915776
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 258401 240 63, sector size=512 - WDC WD2002FAEX-007BA0, S/N:WD-WCAY01505149, FW:05.01D05
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SJ, S/N:S246J9BZ605512, FW:1AJ10001
Drive H: - 3000 GB / 2794 GiB - CHS 1565540352 1 1, sector size=512 - Seagate Backup+ Desk, S/N:NA5JQSD0, FW:0503

Partition table type default to None
Drive H: - 3000 GB / 2794 GiB - Seagate Backup+ Desk
Partition table type: None

Interface Advanced
file_win32_pread(548,7,buffer,1565540225(1565540225/0/1)) read err: read after end of file
P Unknown 0 5860507647 5860507648

Analyse Drive H: - 3000 GB / 2794 GiB - CHS 1565540352 1 1
Current partition structure:
P Unknown 0 5860507647 5860507648

search_part()
Drive H: - 3000 GB / 2794 GiB - CHS 1565540352 1 1
file_win32_pread(548,8,buffer,79(79/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,19(19/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,66(66/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,87(87/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,137(137/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,2050(2050/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,20(20/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,67(67/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,88(88/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,138(138/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,2051(2051/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,3(3/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,4(4/0/1)) read err: read after end of file
file_win32_pread(548,14,buffer,5(5/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,21(21/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,68(68/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,89(89/0/1)) read err: read after end of file

----------------------------------
plus ALOT of the same, then even more of this:
-----------------------------------
(9982/0/1)) read err: read after end of file
file_win32_pread(548,14,buffer,9983(9983/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,9999(9999/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,10046(10046/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,10067(10067/0/1)) read err: read after end of file
file_win32_pread(548,11,buffer,10107(10107/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,12030(12030/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,9997(9997/0/1)) read err: read after end of file

----------------------------------
and ends with this:
----------------------------------

(548,11,buffer,98430(98430/0/1)) read err: read after end of file
file_win32_pread(548,1,buffer,100353(100353/0/1)) read err: read after end of file
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

TestDisk exited normally.
Last edited by malstrom on 26 Nov 2015, 00:42, edited 1 time in total.

malstrom
Posts: 9
Joined: 20 Nov 2015, 22:16

Re: Lost the partition/mft/boot sectors

#13 Post by malstrom »

this is what i'm presented with selecting the Drive, None, then advanced and analyze respectively:

Image

Image

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost the partition/mft/boot sectors

#14 Post by Fiona »

When a disk appears as RAW means that you have a partition in your partition table.
Running TestDisk on a "Drive" will display the whole available disk space as Unknown.
Using the menu Type you could add a file system.
But ist doesn't help as much because a drive has no partition table and a partition starts at the boot sector.
When the start and size of a partition doesn't match, you won't get a reliable result.
RAW means that you have a partition, but either your boot sector is BAD, your partition is not formatted or the file system is faulty or not recognized.
That's why selecting your disk and confirming at Analyse will display your current partition structure (partition table).
When your correct partition is still in your partition table, it'd be possible to run a boot sector diagnose.
It wouldn't stress your disk as much.
On a Drive with partition table type None it's not possible.
Please copy and paste the content of your testdisk.log into your next post.
At the first you'd only need to confirm at Analyse and I'd like to watch only your current partition structure (partition table).

Fiona

monkey
Posts: 4
Joined: 10 Jan 2016, 07:36

Re: Lost the partition/mft/boot sectors

#15 Post by monkey »

I have a very similar situation. My disk shows up under Disk Management as RAW. When I run TestDisk (v7.0) it only shows up as a Drive, not a Disk. When I choose the Drive, the default partition is None. I've tried choosing all of the different partition types, but it always says that no partition is found. Attached is the log file from when I tried a Quick Search (it has a lot of the read err lines that the previous poster also saw). Note that I have two USB hard drives attached. The one I'm trying to recover is the 320 GB drive. Also, I previously let the Quick Search go to completion and it created a 177 GB log file with many, many of the same read error messages (unfortunately I wrote over that log file). Also, I think I accidentally pressed enter too many times. I did not mean to execute write_mbr_i386.

Any suggestions would be very much appreciated!

The log file was too large. Excerpt is below:

Code: Select all

Sat Jan  9 23:28:22 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
filewin32_getfilesize(/dev/sdb) GetFileSize err Incorrect function.

filewin32_setfilepointer(/dev/sdb) SetFilePointer err Incorrect function.

Warning: can't get size for Disk /dev/sdb - 0 B - 0 sectors, sector size=512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=320062063104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000364240896
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 500 GB / 465 GiB - CHS 60788 255 63, sector size=512
Drive E: - 320 GB / 298 GiB - CHS 625121217 1 1, sector size=512
Drive F: - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512

Partition table type default to None
Drive E: - 320 GB / 298 GiB
Partition table type: Intel

Analyse Drive E: - 320 GB / 298 GiB - CHS 625121217 1 1
Current partition structure:

Partition: Read error

search_part()
Drive E: - 320 GB / 298 GiB - CHS 625121217 1 1
file_win32_pread(580,1,buffer,19(19/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,66(66/0/1)) read err: read after end of file
file_win32_pread(580,8,buffer,80(80/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,137(137/0/1)) read err: read after end of file
.
.
.
file_win32_pread(580,1,buffer,32833(32833/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,32854(32854/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,32904(32904/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,34817(34817/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,625121215(625121215/0/1)) read err: read after end of file
file_win32_pread(580,1,buffer,625121216(625121216/0/1)) read err: read after end of file
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
file_win32_pread(580,1,buffer,0(0/0/1)) read err: read after end of file

Partition: Read error
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Lost the partition/mft/boot sectors

#16 Post by cgrenier »

Can you try TestDisk 7.1-WIP ?
If the problem is Windows related, it's better to also try under Linux.

monkey
Posts: 4
Joined: 10 Jan 2016, 07:36

Re: Lost the partition/mft/boot sectors

#17 Post by monkey »

Thank you for the response. I tried TestDisk 7.1-WIP and got the same results. Does the error that it keeps repeating give any clue about what the problem might be with the drive?
file_win32_pread(580,1,buffer,19(19/0/1)) read err: read after end of file

monkey
Posts: 4
Joined: 10 Jan 2016, 07:36

Re: Lost the partition/mft/boot sectors

#18 Post by monkey »

Anyone have a response to my inquiry about the error message I'm seeing:

file_win32_pread(580,1,buffer,19(19/0/1)) read err: read after end of file

My log file repeats this message over and over (~300 GB worth). Does this indicate any specific problem or how I might proceed?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Lost the partition/mft/boot sectors

#19 Post by cgrenier »

This error message can be caused by
- a Windows problem, it's why I recommanded you to try under Linux. There are various Linux LiveCD/USB solution...
- a hardware problem. In this case, you need to contact a data recovery company.
As Fiona has already explained, it's better to use the PhysicalDrive (/dev/sda, /dev/sdb...) than the drive letter.

monkey
Posts: 4
Joined: 10 Jan 2016, 07:36

Re: Lost the partition/mft/boot sectors

#20 Post by monkey »

Thank you again for your response. I thought I had tried previously on Linux, but it was a different tool. Also, I saw Fiona's suggestion to use the drive, rather than Disk letter, but when I ran TestDisk in windows, it didn't show up as a physical drive.

I just now tried TestDisk 7.1-WIP under Linux. It recognized the disk as a physical drive (/dev/sda), but it was still unable to find a partition. I tried a Quick Search and also a Deeper Search, but it did not find a partition. It produced a large log file (~400 MB) that had a lot of errors like the following:
file_pread(4,11,buffer,625141885(38913/72/5)) read err: Input/output error

Below is an excerpt from the log file:

Code: Select all

Thu Sep 28 22:52:25 2006
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, February 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.9.6 (#25 SMP PREEMPT Sat Jun 15 15:27:01 CEST 2013) i686
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib:
20120504, curses lib: ncurses 5.7
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ATA ST9320423AS
Disk /dev/sdb - 3909 MB / 3728 MiB - CHS 1017 121 62, sector size=512 - IVR37600
innovera, FW:0009
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My
Passport 083A, FW:1065

Partition table type defaults to Intel
Disk /dev/sda - 320 GB / 298 GiB - ATA ST9320423AS
Partition table type: Intel

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:

Partition: Read error

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
file_pread(4,16,buffer,32(0/0/33)) read err: Input/output error
file_pread(4,3,buffer,48(0/0/49)) read err: Input/output error
file_pread(4,3,buffer,95(0/1/33)) read err: Input/output error
file_pread(4,8,buffer,111(0/1/49)) read err: Input/output error
file_pread(4,11,buffer,158(0/2/33)) read err: Input/output error
file_pread(4,2,buffer,2080(0/33/2)) read err: Input/output error

<< many, many more lines like this>>

file_pread(4,11,buffer,625141885(38913/72/5)) read err: Input/output error
file_pread(4,1,buffer,625141778(38913/70/24)) read err: Input/output error
file_pread(4,1,buffer,625141825(38913/71/8)) read err: Input/output error
file_pread(4,1,buffer,625141846(38913/71/29)) read err: Input/output error
file_pread(4,1,buffer,625141896(38913/72/16)) read err: Input/output error

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
file_pread(4,1,buffer,0(0/0/1)) read err: Input/output error

Partition: Read error
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
I would greatly appreciate it if you had any further suggestions.

Locked