Second partition not accessible after hibernation, shown raw

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Biff
Posts: 7
Joined: 16 Dec 2015, 11:31

Second partition not accessible after hibernation, shown raw

#1 Post by Biff »

In the column "File System" in computer management for I: is shown "RAW" and no problems, for C: still is displayed "NTFS": http://i.imgur.com/0NngltF.jpg.

How could I recover the files / repair the drive? There are over a million files on I: so it would be could if the folder structure would be kept.

The drive letter(s) of the partition kept staying the same like before, and the partition C: obviously kept staying untouched, completely working.

Can or should I (better chances?) generally disassemble the internal drive and put it in its original enclosure I disassembled it from and then connect it with a USB 3.0 connection to repair the partition with TestDisk / Chkdsk and / or try to recover the data with a recover program? The Notebook with the defect drive runs instable and causes corrupted files when copying / moving them to an external drive.

When I try to repair (with TestDisk or Chkdsk using “CHKDSK I: /f /v /r /x” of Win7) the defect partition, will there be anything (my own data / own files) that will be overwritten then? So, is there any risk to lose data irreversibly, to make files unrecoverable? So should I do a recovery before I start any command just for safety reasons (if the command fails and files are overwritten irreversibly)?

PhotoRec mainly is useful to recover images, but it recovers files with other extensions also (I would have supposed regarding its name it is designed to just recover fotos)? About 2 to 5 % of my (lost) files are images. So should I use it at all? And if yes, should I use the command line version (qphotorec_win.exe) or the Win version (photorec_win.exe). Does PhotoRec keep the file structure?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Second partition not accessible after hibernation, shown

#2 Post by Fiona »

PhotoRec renames files and doesn't recover directories.
Would be appropriate for pictures etc..
Something what should be done first is a boot sector diagnose.
TestDisk 7.1WIP 32bit is recommended.
Run TestDisk on your affected disk and run Advanced (select your affected partition) and confirm at Boot!
Upload another snapshot.
Until yet, don't use Write nor RepairMFT, to avoid modifying your file system!
When the menu List is available, try to list your files.
Info will follow.

Fiona

Biff
Posts: 7
Joined: 16 Dec 2015, 11:31

Re: Second partition not accessible after hibernation, shown

#3 Post by Biff »

Thank you very much, Fiona.
TestDisk 7.1WIP 32bit is recommended.
So, the beta version of TestDisk: http://www.cgsecurity.org/testdisk-7.1-WIP.win.zip
Run TestDisk on your affected disk and run Advanced (select your affected partition) and confirm at Boot!
I am not quite sure if I have found the correct options / way: I double click testdisk_win.exe and go:

Image
Image
Image
Image
Image

At the bottom (last screen shot) it says "Boot sector recovery". Am I right here? It sounds like there will be overwritten anything?
And I am not sure which partition / option to choose (last screen shot), I assume, the last one (marked) as the affected one is the biggest partition (about 850 GB). Is that correct? So now just confirm "Boot"?

Sorry for my bad understanding and many thanks again.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Second partition not accessible after hibernation, shown

#4 Post by Fiona »

The third partition looks like the right one!
The menu List already appears there but it has not as much significance.
Your affected partition is already selected.
Easily confirm at Boot and upload another snapshot.
Have a try to list your files and let me know, did it work for you?
The procedure is intended as a diagnose only.
You shouldn't use Write nor RepairMFT.
So you'll not change anything!

Fiona

Biff
Posts: 7
Joined: 16 Dec 2015, 11:31

Re: Second partition not accessible after hibernation, shown

#5 Post by Biff »

Many thanks.
The third partition looks like the right one!
The menu List already appears there but it has not as much significance.
Ah, sorry for my density, I have the identical drive on another computer and to just show the way I have gone I have made screen shots of that drive, I forgot to mention it, sorry again. The Notebook with the affected drive runs very sluggish (one click some minutes, but suddenly, now it runs better), I am in safe mode there. but from now on I have original screen shots of course.
Easily confirm at Boot and upload another snapshot.
Here it is: Image
Have a try to list your files and let me know, did it work for you?
Yes, it seems to work, there are over a million files on that partition, so I am not sure if all of them are still there / shown, but it looks good:
Image
A sub folder, own files:
Image

When I mark all of the files / folders here I can copy all of the folders / files / sub folders to another drive? Could / should I do it (now)? I assume when I enter "c" and confirm I will have to enter a path to an external drive to where the files (all files being on that drive?) will be copied (by keeping the folder structure?)?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Second partition not accessible after hibernation, shown

#6 Post by Fiona »

When your affected disk makes some noise and clicking, you shouldn't stress it anymore.
It's rather a case for datarecovery companies.
So it's up to you on your own risk.

I achieved best results to recover data of a disk after a head crash on Knoppix.
I've created a Knoppix USB flash drive with 63 GB and used 9 GB for Knoppix and the remained space for an overlay to copy data to.
But you can test it on windows first?
In my case, disk was under windows not accessible anymore.

Copying files will keep file names and directories.
It's a safe solution to copy/backup files first.
Your boot sector and its backup looks OK.
Probably your file system is faulty?
Standard path to copy your files to, is the testdisk folder.
If you'd like to copy your files to another destination, you can select these two dots in the upper area of the display and press enter.
Each time you'll get 1 directory up until you get to your disk selection.
You can select another disk or partition to use it as a destination.
Some users created in advance a folder on the target drive to copy their files to.
To navigate into a folder, you can select it and using the right arrow key on your keyboard will open it.
Capital letter C will start the copying process.

After copying files, you can consider to run chkdsk driveletter: /r to have a try to repair your file system.

Fiona

Biff
Posts: 7
Joined: 16 Dec 2015, 11:31

Re: Second partition not accessible after hibernation, shown

#7 Post by Biff »

Copying files will keep file names and directories.
That is very great.
It's a safe solution to copy/backup files first.
So, I have started the copying, I guess, it will last until tonight / tomorrow or even longer:
Image
I will copy all of the data twice at least, because the Notebook with the affected drive (and my other one) partially causes corrupted files when transferring them to another drive, do not know why. And after check the files by its content or check sum.
After copying files, you can consider to run chkdsk driveletter: /r to have a try to repair your file system.
Yes, I will do it in any case. I could assume - if it won't fail - it might bring back all of the files without a missing one.
Then I will have to enter "chkdsk driveletter: /r" in TestDisk? But where? Or in Win?
Probably your file system is faulty?
But why can TestDisk find the files - like it did - then?

Could I create an image of partition I: with this option on another drive:
Image
Would that be recommended?

Many thanks.

Biff
Posts: 7
Joined: 16 Dec 2015, 11:31

Re: Second partition not accessible after hibernation, shown

#8 Post by Biff »

It appears it will last some days more, at the moment about 100.000 files are copied out of about 1 Million after about 20 hours. Is that time usual? Or might there be anything going wrong?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Second partition not accessible after hibernation, shown

#9 Post by Fiona »

Your boot sector and its backup looking OK.
That's why I assume that your file system is faulty.
A faulty file system and read errors can decrease scan speed drastically.
Also, copying a huge amount of small files takes longer than large files.
After copying your files, you can try to run chkdsk driveletter: /r to have a try to repair your file system.

Fiona

Biff
Posts: 7
Joined: 16 Dec 2015, 11:31

Re: Second partition not accessible after hibernation, shown

#10 Post by Biff »

Ah, you are back again, very happy about that.
When your affected disk makes some noise and clicking, you shouldn't stress it anymore.
It's rather a case for datarecovery companies.
So it's up to you on your own risk.

I achieved best results to recover data of a disk after a head crash on Knoppix.
I've created a Knoppix USB flash drive with 63 GB and used 9 GB for Knoppix and the remained space for an overlay to copy data to.
But you can test it on windows first?
In my case, disk was under windows not accessible anymore.
Very strange, I cannot remember to have seen this part of the post, sorry. No, no noises from the disk, sounds like usual, thank goodness.

A head crash means, the head once or more times crashed on that - how do you call it - medium, while reading, writing or else, I assume. So the head is still working (more or less).

Alright, good to know for the next time (which hopefully never will come) with that Knoppix.
Your boot sector and its backup looking OK.
The boot sector on C:? So that's why Windows still starts at all? Or is there a boot sector on I:?
That's why I assume that your file system is faulty.
A faulty file system and read errors can decrease scan speed drastically.
Also, copying a huge amount of small files takes longer than large files.
OK, I understand, that will be the explanation for the slowness. It is finished now, over a million files saved, obviously. Looks good. I will try another recovery program and after it will have finished may be another one and then compare the content of the recovered files.
After copying your files, you can try to run chkdsk driveletter: /r to have a try to repair your file system.
Yes, I will do it at the end. May be I should do the comparison by content after that try, because if it passes and the system would be like it was before there would be no need to compare all of the recovered files / duplicates then.

To run chkdsk driveletter: /r I would have to open this window - http://i.imgur.com/bJla6Sc.png - and enter the command or this window and enter the command like this: http://i.imgur.com/n5iXpgY.png? Is it right? And after the Notebook will be restarted, I assume?

What is the difference between:

chkdsk I: /r
and
chkdsk I: /f /v /r /x

Could / should I create an image of partition I: with this option on another drive:
Image
Would that be recommended?

Very many thanks.

Locked