partition table from Windows XP gets smashed in Windows 7 - temporarily only!

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
larsdaniel
Posts: 7
Joined: 24 Jun 2016, 20:21

partition table from Windows XP gets smashed in Windows 7 - temporarily only!

#1 Post by larsdaniel »

Hi there,

I've got a crazy problem, which I've already described in reddit: https://redd.it/4pj8t3

On an older computer without internet, I was still running Windows XP. I wanted to migrate to Windows 7 and try the free upgrade to Windows 10 before it expires.

I've installed Windows 7 to a new partition on the first drive (I didn't update the old XP, but took an image copy of course). Dual-boot works fine.
But I was shocked what happened to the Western Digital RED 3 TB (typo in the picture, hehe) after booting Windows 7: the partition table got smashed:

Image

After quickly booting back into Windows XP the disk and its partitions returned without a problem! Hey, what's wrong here? :D

Let's see what TestDisk says:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 2907010 16 63

Warning: the current number of heads per cylinder is 16
but the correct value may be 255.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
Of course, I've tried to set the cylinders to 255, but after reboot it's back to 16. In Windows XP everything works as expected.
What do you think: can I completly destroy the partition and rebuild it without losing any data? To be true: I don't have the capacity to backup 3 TB, but only the most important files.

Best regards,
Lars-Daniel

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: partition table from Windows XP gets smashed in Windows 7 - temporarily only!

#2 Post by cgrenier »

Can you post the testdisk.log file content ?

larsdaniel
Posts: 7
Joined: 24 Jun 2016, 20:21

Re: partition table from Windows XP gets smashed in Windows 7 - temporarily only!

#3 Post by larsdaniel »

cgrenier wrote:Can you post the testdisk.log file content ?
Sure!

Code: Select all

Sat Jun 25 14:39:00 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1572864000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=256056286720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=31268536320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1572864000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=256056286720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=31268536320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107372772864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1572831744
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=256055238656
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=31267487744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=3000590401536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=142684996608
Hard disk list
Disk /dev/sda - 1572 MB / 1500 MiB - CHS 191 255 63, sector size=512
Disk /dev/sdb - 250 GB / 232 GiB - CHS 484521 16 63, sector size=512
Disk /dev/sdc - 256 GB / 238 GiB - CHS 496140 16 63, sector size=512
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 2907010 16 63, sector size=1024
Disk /dev/sde - 31 GB / 29 GiB - CHS 3801 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 2907010 16 63, sector size=1024
Drive C: - 107 GB / 99 GiB - CHS 208048 16 63, sector size=512
Drive D: - 1572 MB / 1499 MiB - CHS 191 255 63, sector size=512
Drive F: - 256 GB / 238 GiB - CHS 496138 16 63, sector size=512
Drive H: - 31 GB / 29 GiB - CHS 3801 255 63, sector size=512
Drive R: - 3000 GB / 2794 GiB - CHS 2907008 16 63, sector size=1024
Drive Z: - 142 GB / 132 GiB - CHS 276469 16 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 2907010 16 63
Geometry from i386 MBR: head=16 sector=63
NTFS at 2/0/33
heads/cylinder 255 (NTFS) != 16 (HD)
Current partition structure:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 16 (HD)
 1 * HPFS - NTFS              2   0 33 2907010   0 32 2930264064

search_part()
Disk \\.\PhysicalDrive3 - 3000 GB / 2794 GiB - CHS 2907010 16 63
NTFS at 2/0/33
heads/cylinder 255 (NTFS) != 16 (HD)
filesystem size           2930264064
sectors_per_cluster       4
mft_lcn                   128
mftmirr_lcn               366283008
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              2   0 33 2907010   0 32 2930264064
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
Warning: the current number of heads per cylinder is 16 but the correct value may be 255.

Results
   * HPFS - NTFS              2   0 33 2907010   0 32 2930264064
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

interface_write()
 1 * HPFS - NTFS              2   0 33 2907010   0 32 2930264064

larsdaniel
Posts: 7
Joined: 24 Jun 2016, 20:21

Re: partition table from Windows XP gets smashed in Windows 7 - temporarily only!

#4 Post by larsdaniel »

Anyone with an idea?

larsdaniel
Posts: 7
Joined: 24 Jun 2016, 20:21

Re: partition table from Windows XP gets smashed in Windows 7 - temporarily only!

#5 Post by larsdaniel »

I think the problem is, this NTFS uses 1024 bytes per sector ... Windows XP can handle this, Windows 7 can't.

Locked