They were there, then they weren't

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
MacDuff
Posts: 3
Joined: 13 Nov 2016, 23:52

They were there, then they weren't

#1 Post by MacDuff »

Ran the analyze feature and 3 partitions showed up. The info looked accurate (I'm working on someone else's drive) Had the Dell part, Recovery, and System partitions all in RAW fs. I changed the Dell to DE per instructions then ran the deep scan. The scan came back with nothing at all. I ran analyze again and I have a tiny partition and nothing else.

Did I miss something? Am I hosed and the drive is now toast? Any help would be greatly appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: They were there, then they weren't

#2 Post by cgrenier »

If you do not write the new partition table, changing the partition type is useless.
Can you post the testdisk.log file content ?

MacDuff
Posts: 3
Joined: 13 Nov 2016, 23:52

Re: They were there, then they weren't continued

#3 Post by MacDuff »

Thanks for the reply Christophe, If I knew where it was I could. I'm running off the TRK USB stick. The last thing I saw was "log file corrupt". It's not looking good is it?
When it showed the partitions I did write down the CHS values for all three listed. I guess I should have stopped while I was ahead. Don't want to make any moves to avoid any further loss or damage.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: They were there, then they weren't

#4 Post by cgrenier »

If you can't provide the log file, try to post screenshots...

MacDuff
Posts: 3
Joined: 13 Nov 2016, 23:52

Re: They were there, then they weren't

#5 Post by MacDuff »

Christophe, I was able to finally get a log file. Also have the backup file. Does getting the I/O error indicate a head or control board issue or am I just missing something still? Thanks for your input and the work you have put into this project.

Backup:
#1479660884 Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63
1 : start= 63, size= 80262, Id=DE, P
2 : start= 81920, size= 30720000, Id=07, P
3 : start= 30801920, size=945969200, Id=07, *

I also have the start and end points written down from one of the screens I got early on. If that is needed I can put it together on here.

TestDisk:Mon Nov 21 19:56:07 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP2
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80000000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=74932300800
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=15728640000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=484336230400
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9726 255 63, sector size=512 - Maxtor 6Y080M0, S/N:325934313258434d202020202020202020202020, FW:YAR51HW0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500620AS, FW:DE13

Partition table type defaults to Intel
Disk /dev/sdb - 500 GB / 465 GiB - ST3500620AS
Partition table type: Intel

Interface Advanced

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:

Partition: Read error

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
file_pread(5,16,buffer,32(0/0/33)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,3,buffer,48(0/0/49)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,3,buffer,95(0/1/33)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,8,buffer,111(0/1/49)) ReadFile The request could not be performed because of an I/O device error.

* Truncated to keep post small

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: They were there, then they weren't

#6 Post by cgrenier »

The disk is correctly identified but all read operations failed, it's probably a damaged head. You will have to contact a data recovery company.

Locked