File recovery from broken NTFS partition

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
RGWPMI
Posts: 5
Joined: 05 Apr 2016, 20:03

File recovery from broken NTFS partition

#1 Post by RGWPMI »

Hello community,

I have a hard-disk of 500GB gone RAW where there were only data, no operating system.

When running Testdisk the file table is automatically recognised as "EFI GPT", when I confirm this, 2 partitions are found (one "Microsoft reserved partition" which is listed twice with identical data and one "Basic data partition"). However, when performing "Quick Search" with these settings nothing happens, Testdisk seems to be frozen.

When changing the type of partition table manually to "Intel", however, "Quick search" finds all folders and files that have been on the drive. With this as a result I tried to copy some of the most important files, like "Outlook.PST", to another hard-disk, with - at first glance - success. But then I saw that the copies to not have the same size as indicated for the originals in the file listing, but are very much smaller. Opening them they show up broken.

What might be the reason for this?
Should I ignore this behaviour and go and rewrite ("Write" option of Testdisk) the partition table to the original disk, thus regaining Windows access to the original data? Or should I refrain from writing to this disk anyway and try something else?

Who can help me?

Thanks a lot in advance!

Best regards
Rudi

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File recovery from broken NTFS partition

#2 Post by cgrenier »

What is the filesystem type ? Is it really NTFS or exFAT ?
What is the difference in file size ? If the size is divided by 8, it may be a problem of 4096 bytes sector versus 512 bytes sector.

RGWPMI
Posts: 5
Joined: 05 Apr 2016, 20:03

Re: File recovery from broken NTFS partition

#3 Post by RGWPMI »

Hello Christophe,

thank you very much for your reply. I had a "copy all files" task running, in order to save at least what I can recover at the actual state, and this has just been terminated right now so I now have access to the data again.

It seems that file size is always different, with no constant factor. Some files with originally 100kb are copied with slightly more than 200kb, bigger files are copied with very much less bytes, please refer to the following example screen shots.
File listing Testdisk.jpg
File listing Testdisk.jpg (102.87 KiB) Viewed 3422 times
File listing copies.jpg
File listing copies.jpg (123.32 KiB) Viewed 3422 times
I also tried if only the most recently changed files are altered because of an uncompleted write-to-disk action in the moment when the problem occured. But this is not the case. Even files that I did not access for years copy with different size (some smaller, some bigger).

Only very small files (about 1kb or so) copy with their original size.

Maybe this is due to choosing "Intel" as file table type instead of the default "EFI GPT". But with EFI GPT quick search didn't work, as mentioned before.

Concerning your question if the original filesystem really was NTFS:
The truth is that I don't know for sure. It's a brandnew ACER Aspire Switch 2-in-1 computer, having one SSD of 128GB with NTFS in the tablet part and one 500GB HDD in the docking (keyboard) part. I had never looked up the filesytem in detail, since my first aim was to migrate my data and start working again, but I suppose that the filesytem of this built-in HDD was the same as on the SSD. I might, of course, ask Acer support for this detail.

I hope there will be a solution, since a lot of emails have been downloaded to the outlook.pst while I was migrating other data. And it's such a bad feeling to see the file in the listing and thus be unable to recover it...

RGWPMI
Posts: 5
Joined: 05 Apr 2016, 20:03

Re: File recovery from broken NTFS partition

#4 Post by RGWPMI »

In the meantime I got somewhat further:

"Analyze" the 500GB HDD with "EFI GPT" as type of file table finds (as already before) these partitions:
EFI GPT Partitions.jpg
EFI GPT Partitions.jpg (76.51 KiB) Viewed 3415 times
"Quick Search" then results in the following "Read Error":
EFI GPT read error.jpg
EFI GPT read error.jpg (45.1 KiB) Viewed 3415 times
Is there anything I can do?

Thank you in advance for answering!

RGWPMI
Posts: 5
Joined: 05 Apr 2016, 20:03

Re: File recovery from broken NTFS partition

#5 Post by RGWPMI »

Come on, folks, don't leave me alone ;)
Nobody having a wise idea for a solution???

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File recovery from broken NTFS partition

#6 Post by cgrenier »

Clone your disk using gnu ddrescue to a new empty disk
https://www.cgsecurity.org/wiki/Damaged_Hard_Disk
Once it's done, remove the original disk and try to recover your data from the clone

Locked