exFat rewritten to NTFS boot disk from ISO

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Slawkos
Posts: 2
Joined: 05 Aug 2016, 18:46

exFat rewritten to NTFS boot disk from ISO

#1 Post by Slawkos »

Hi,
I would like to say hello to everybody as a new be on this "book of wisdom".
I have got in trouble when preparing bootable USB from ISO and unfortunately got confused with too many disks connected to de computer.
The good news is that I have got log and I can see the reformatted exFAT partitions and I can list the files after Deep Search (took 3 days).
Despite Ive created bkup of the disk but I am affraid to recover it on my own as the partitions are starting and ending like they're overlapped. It was a regular disk with no bootable partition, can't remember if it was two logical or extended if it matters. Those partitions was equal 500GB each or close to it, one of them was before Mac partition.

Code: Select all


Fri Aug  5 22:07:03 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 14.5.0 (Darwin Kernel Version 14.5.0: Thu Apr 21 20:40:54 PDT 2016; root:xnu-2782.5
Compiler: GCC 4.0
Compilation date: 2015-04-18T13:01:34
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk0 - 250 GB / 232 GiB - 488397168 sectors (RO), sector size=512
Disk /dev/disk2 - 1000 GB / 931 GiB - 1953504688 sectors, sector size=512
Disk /dev/rdisk0 - 250 GB / 232 GiB - 488397168 sectors (RO), sector size=512
Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953504688 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/rdisk2 - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953504688 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=63 1
NTFS at 63/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
check_part_i386 2 type EA: no test
get_geometry_from_list_part_aux head=1 nbr=4
Current partition structure:
Warning: number of heads/cylinder mismatches 255 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
 1 * HPFS - NTFS                   63 1953504566 1953504504

Warning: Bad ending sector (CHS and LBA don't match)
 2 P Sys=EA                1953504567 1953504629         63

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
.............................................deleted many entries.............................................
     FAT16 >32M            4819916519 4983048766  163132248
This partition ends after the disk limits. (start=4819916519, size=163132248, end=4983048766, disk end=1953504688)

HFS+ magic value at 977014584/0/1
part_size 976490040
     HFS                    977014584 1953504623  976490040
     HFS+ blocksize=4096, 499 GB / 465 GiB
     HPFS - NTFS            977014584 1953504629  976490046
     exFAT, blocksize=131072, 499 GB / 465 GiB

HFS+ magic value at 977014586/0/1
part_size 976490040
     HFS                       524548  977014587  976490040
     HFS+ found using backup sector!, 499 GB / 465 GiB

HFS+ magic value at 977014596/0/1
part_size 976490040
     HFS                    977014596 1953504635  976490040
     HFS+ blocksize=4096, 499 GB / 465 GiB
     HPFS - NTFS            977014596 1953504641  976490046
     exFAT, blocksize=131072, 499 GB / 465 GiB

HFS+ magic value at 977014598/0/1
part_size 976490040
     HFS                       524560  977014599  976490040
     HFS+ found using backup sector!, 499 GB / 465 GiB
BAD_RS LBA=2822020870 460
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             2822020870 3448490556  626469687
This partition ends after the disk limits. (start=2822020870, size=626469687, end=3448490556, disk end=1953504688)
BAD_RS LBA=3027511925 435
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
    
.............................................deleted many entries.............................................

     FAT12                 3317383056 7103432760 3786049705
This partition ends after the disk limits. (start=3317383056, size=3786049705, end=7103432760, disk end=1953504688)
NTFS at 1953504566/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size           1953504504
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS                   63 1953504566 1953504504
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 1953504566/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size           1953504504
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS           1953504566 3907009069 1953504504
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953504566, size=1953504504, end=3907009069, disk end=1953504688)
Disk /dev/rdisk2 - 1000 GB / 931 GiB - 1953504688 sectors
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 5057 GB / 4710 GiB)
The following partitions can't be recovered:
     FAT16 <32M              23889844 2369073339 2345183496
     FAT16 LBA              135321497 3483154496 3347833000
     FAT16 >32M             175803015 2516389150 2340586136
     FAT32                  235299285 3757607616 3522308332
     FAT16 LBA              259771959 2109462310 1849690352
     FAT16 >32M             282342851 2858870811 2576527961
.............................................deleted many entries.............................................
Now Im trying to copy some files but TestDisk is copying but it says failed.
Screen Shot 2016-08-08 at 22.21.36.png
Screen Shot 2016-08-08 at 22.21.36.png (26.23 KiB) Viewed 1573 times
I can't stop the copying process (can I :?: )
Screen Shot 2016-08-08 at 19.07.33.png
Screen Shot 2016-08-08 at 19.07.33.png (192.54 KiB) Viewed 1573 times
I don't won't to wait another 3 days to finish Deep Scan again when I close the program, is there any way to fix the disk knowing the data from the log?
Please for help, thanks.
Top
User avatar
cgrenier
Site Admin
Posts: 5442
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: exFat rewritten to NTFS boot disk from ISO

#2 Post by cgrenier »

Renamed your testdisk.log to avoid to overwrite it with new values.
After Quick Search, choose Stop, use 'a' to manually add the partitions to recover using the values found in the log file.
Set the partitions to P(imary). On next screen, choose Write, confirm.
Go in Advanced, for each partition, choose Boot. If the boot sector is damaged (Bad), choose BackupBS, confirm.
Quit and restart your computer.
Top
Slawkos
Posts: 2
Joined: 05 Aug 2016, 18:46

Re: exFat rewritten to NTFS boot disk from ISO

#3 Post by Slawkos »

Hi,
cgrenier thank you for the replay and help :)
I try to do as you suggested but there was no option to type manually the partitions after the quick search I had to do another "deeper search" then I could do it. I can only set one of the partitions as primary otherwise the program says "Structure: Bad"
Screen Shot 2016-08-09 at 10.52.57.png
Screen Shot 2016-08-09 at 10.52.57.png (37.44 KiB) Viewed 1565 times
Screen Shot 2016-08-09 at 10.55.42.png
Screen Shot 2016-08-09 at 10.55.42.png (41.11 KiB) Viewed 1565 times
they seems to overlap or something as both of them are starting very close to each other.

I'm also confused with the "HFS+ found using backup sector!, 499 GB / 465 GiB" - can we not use of the backup sector
and then it says it's exFAT

don't know what to do next
Top
Locked

Return to “Partition Recovery”