Testdisk 7.1 WIP Geometry error

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Testdisk 7.1 WIP Geometry error

#1 Post by gold333 »

I'm trying to recover a primary bootable partition that has turned RAW using Testdisk 7.1 WIP on a single physical hard drive.

The SMART info is Excellent.

I have not written anything to the problem partition yet.

Error background:
I got a 0x0000006b stop saying the bootcache.cat file needs to be deleted in system32/codeintegrity so it can respawn. But I can no longer access the partition to reach this file.


Method:
Testdisk geometry settings is giving me trouble.

This is one of the most common high end HD's (Western Digital Caviar Black 1TB).

It was split into 2 partitions using the Windows 7 installer.

1. An ~800GB partition with the main install (Win-7 64) (unbootable now and in RAW according to diskmgmt.msc.)
2. A ~100GB backup boot partition (Win-7 32) for moments like this when the primary won't boot.

The storage on the 800GB was 139GB free with the rest containing data.

Testdisk says the geometry may be wrong.

Details of the Western Digital Caviar Black 1TB (WDC WD10 01FALS-00J7B) connected via SATA:

My Bios says:

Cylinders 65535
Heads 16
Landing zone 65534
Sector 255

My usermanual says:

user sectors per drive 1,953,525,169
heads/disks 6/3
bytes per sector 512


Testdisk 7.1 WIP says:

Cylinders: 129201 (??)
Heads: 240
Sectors: 63
Sector size: 512

(To my amateur mind 240 or 255 heads is far too much for a HD isn't it, how are so many little mechanical heads going to fit in there?)

Anyhow, I clicked Analyse on the defailt Testdisk 7.1 WIP values and got:

Image


So it is saying the Heads for NTFS should be 255 but Testdisk 7.1 WIP is reading 240.

I then changed the Geometry by leaving everything on default and changing the heads to 255.

I clicked analyse and got this:

Image

I selected Quick Scan

This is while it was scanning:
Image

When it was finished (it is showing FAT16 and FAT32? Both these partitions were NTFS:

Image


After I clicked continue:

Image


Now trying to list the contents of the first partition using P key for List

Image

and the 2nd partition:

Image

Strangely these files appear to be correct.


Anyhow, so I need help here, the Hard drive data is evident, I just need to know what to put into the Testdisk geometry that is correct. I cannot work with 25 permutations which take 6 hours each to Quick Scan.

I know the drive was split into 3 partitions:

-NTFS ~100 MB System reserved
-NTFS ~800 GB Main Win-7 64 partition
-NTFS ~100 GB Backup Win-7 32 partition

This is the Disk management info:

Image


As a test I let Minitool Partition Wizard analyse the physical disk. This is what it found (which I really don't understand). Sure I had Deamon Tools installed on the main (and the backup) partition, but still why on Earth would it identify so many boot sectors???

Image


Here is additional data:

http://www.bleepingcomputer.com/forums/ ... tcachecat/

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk 7.1 WIP Geometry error

#2 Post by cgrenier »

Run TestDisk, Advanced, select the partition, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.
If it doesn't work, please copy and paste the testdisk.log file content.

gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Re: Testdisk 7.1 WIP Geometry error

#3 Post by gold333 »

Thank you for your help.

Sorry to be pendantic but I want to take the correct steps.

There is a "boot" option if I select advanced:

Image

But there are 3 partitions to choose from. Which do I choose? -> This is a multiboot Windows 7 system and eventhough I have this problem, the bootloader comes on the screen without problem after the BIOS splash screen. (With bootloader I mean the black DOS type screen where you can choose which of your partitions to boot from using the arrow keys. I believe this is the system reserved area? Which is the first partition in this list above.)

The one that won't boot is the 800gb partition which is the second partition in this list above.

PS: Did you read my personal email/private message to you?

PPS: It looks like Testdisk geometry was correct! MiniTool Partition Wizard and EaseUS Partition Master give me the properties of the physical drive and they both listed what Testdisk had listed without needing to change the geometry. (see image below)



Image

gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Re: Testdisk 7.1 WIP Geometry error

#4 Post by gold333 »

Hi,

Would a mod please be able to help me?

If acceptable, I will wire EUR50 via paypal if this can be solved.

I can pay half in advance half after success if possible.

If no solution is found I donate the EUR25 for your trouble.

Please help.

gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Re: Testdisk 7.1 WIP Geometry error

#5 Post by gold333 »

Is anyone here?

gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Re: Testdisk 7.1 WIP Geometry error

#6 Post by gold333 »

Is anyone here?

I apologise if it is inappropriate to offer financial donations in return for help.

But an answer would be nice.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk 7.1 WIP Geometry error

#7 Post by cgrenier »

To try to fix the partition listed as RAW by Windows, run TestDisk, Advanced, select the 800GB partition, Boot, RebuildBS, List.
If you can see your files, choose Write, confirm, Quit and restart your computer.
If it doesn't work, please copy and paste the testdisk.log file content.

gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Re: Testdisk 7.1 WIP Geometry error

#8 Post by gold333 »

Hi, I did exactly as you said...

I selected the 2nd partition, which although doesn't say 800gb, is that one.

I got:

Image

Upon clicking RebuildBS I got:

Image

After that, clicking LIST I got:

Image


I quit the program and the .log is:




Tue May 31 19:20:36 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, February 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.9, Cygwin32 2004.1
Compilation date: 2016-03-16T08:10:04
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107339579392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=892757606400
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 129201 240 63, sector size=512 - WDC WD10 01FALS-00J7B, S/N:WD-WMATV1397531, FW:05.0

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10 01FALS-00J7B
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=240 sector=63
NTFS at 0/32/33
heads/cylinder 255 (NTFS) != 240 (HD)
check_part_i386 failed for partition type 07
NTFS at 115335/140/29
1 * HPFS - NTFS 0 32 33 13 163 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
3 P HPFS - NTFS 115335 140 29 129201 40 24 209647616
NTFS, blocksize=4096, 107 GB / 99 GiB

ntfs_boot_sector
2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
NTFS at 13/163/20
filesystem size 1743667200 1743667200
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Boot sector
Status: Bad

Backup boot sector
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 1743667200 1743667200
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 1743667200 1743667200
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Not an exFAT boot sector.

2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
Can't open filesystem. Filesystem seems damaged.
filesystem size 1743667200 1743667200
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1

ntfs_boot_sector
2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
NTFS at 13/163/20
filesystem size 1743667200 1743667200
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Boot sector
Status: Bad

Backup boot sector
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.



PS: This is simply a 3 partition Windows 7 HD.

1. System reserved
2. 800GB Win 7-64 (won't boot)
3. 100GB Win 7-32 (boots)

Maybe we can use the boot record of 3. to boot 2. ?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk 7.1 WIP Geometry error

#9 Post by cgrenier »

In Advanced, select the same partition, choose Boot and BackupBS, confirm, Quit, restart your computer
Run "cmd" (right click run as administrator) and "chkdsk /f M:"

gold333
Posts: 11
Joined: 04 Apr 2016, 00:58

Re: Testdisk 7.1 WIP Geometry error

#10 Post by gold333 »

Hi I did that.

This is the result:

Image


I rebooted into the same (backup partition C:) and ran

chkdsk /f m:

This was the result:

Image



What shall I do now, run deep scan again? or write? repairMFT? Resize partition a little?




This is the testdisk.log:


Sat Jun 4 21:09:43 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, February 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.9, Cygwin32 2004.1
Compilation date: 2016-03-16T08:10:04
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107339579392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=892757606400
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 129201 240 63, sector size=512 - WDC WD10 01FALS-00J7B, S/N:WD-WMATV1397531, FW:05.0

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10 01FALS-00J7B
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=240 sector=63
NTFS at 0/32/33
heads/cylinder 255 (NTFS) != 240 (HD)
check_part_i386 failed for partition type 07
NTFS at 115335/140/29
1 * HPFS - NTFS 0 32 33 13 163 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
3 P HPFS - NTFS 115335 140 29 129201 40 24 209647616
NTFS, blocksize=4096, 107 GB / 99 GiB

ntfs_boot_sector
2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
NTFS at 13/163/20
filesystem size 1743667200 1743667200
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Boot sector
Status: Bad

Backup boot sector
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector

ntfs_boot_sector
2 P HPFS - NTFS 13 163 20 115335 140 28 1743667200
NTFS at 13/163/20
NTFS at 13/163/20
filesystem size 1743667200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.


What shall I do now, run deep scan again? or write? repairMFT? Resize partition a little?

Locked