Newbie question: is safe to sleep?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
caam
Posts: 4
Joined: 11 Jan 2017, 12:04

Newbie question: is safe to sleep?

#1 Post by caam »

Hello
I am trying to recover my external hard drive on a windows 10 computer. With the quick search I recovered 25 gb of 100, in a 1TB drive. Then, I started a deep search. So far, it has been working for one day and just finished 20%. since it is an external portable hard drive I am a bit concern about a so long period of time working continuously. Two questions: is it safe for the disk to continue working four more days? If I put the computer to sleep, can it damage the disk? (some posts suggest it is ok, but some others indicated an error happened because the computer went to sleep)
Thanks for your help

Carlos Alberto

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Newbie question: is safe to sleep?

#2 Post by cgrenier »

When recovering data from a disk with bad sectors, I had to run ddrescue for more than 2 weeks without interruption.
I didn't had problem.

There should be no problem putting the computer to sleep.

caam
Posts: 4
Joined: 11 Jan 2017, 12:04

Re: Newbie question: is safe to sleep?

#3 Post by caam »

Thanks!
The program run smoothly.
Now, I got this issue: I found the main partition with data (the FAT32 LBA, the NTFS does not have any valid file):
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
FAT32 LBA 0 32 33 121601 25 24 1953519616 [NO NAME]

But as you can see, there is nothing in the first part of the disk (CHS 0 1 1 to 0 32 32): how can I fix it? Should I add a new partition? if so, where can I find documentation or guidelines to do it? My guess is that the missing partition should be 0 1 1 to 0 32 34.
Also, is there a missing partition at the end? (the end sector is at x 25 24, but the beginning is at 32 33, which suggested me that there could be at least 32 heads per cylinder and 33 sectors per head)
Thanks again for your help

Carlos Alberto

Code: Select all

Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999390445568
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 999 GB / 930 GiB - CHS 121502 255 63, sector size=512
Drive E: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB
Partition table type: Mac

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
Bad MAC partition, invalid block0 signature
read_part_mac: bad DPME signature

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 P FAT32 LBA                0  32 33 121601  25 24 1953519616
sector_size  65295
cluster_size 255
reserved     4095
fats         255
dir_entries  65535
sectors      1551
media        00
fat_length   0
secs_track   7
heads        0
hidden       8
total_sect   9
check_part_i386 failed for partition type 0C
 1 P FAT32 LBA                0  32 33 121601  25 24 1953519616

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 P FAT32 LBA                0  32 33 121601  25 24 1953519616
sector_size  65295
cluster_size 255
reserved     4095
fats         255
dir_entries  65535
sectors      1551
media        00
fat_length   0
secs_track   7
heads        0
hidden       8
total_sect   9
check_part_i386 failed for partition type 0C
Current partition structure:
Invalid FAT boot sector
 1 P FAT32 LBA                0  32 33 121601  25 24 1953519616
 1 P FAT32 LBA                0  32 33 121601  25 24 1953519616
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/39
FAT1 : 32-238440
FAT2 : 238441-476849
start_rootdir : 476850 root cluster : 2
Data : 476850-1953519601
sectors : 1953519616
cluster_size : 64
no_of_cluster : 30516293 (2 - 30516294)
fat_length 238409 calculated 238409
set_FAT_info: name from BS used

FAT32 at 0/32/39
     FAT32 LBA                0  32 33 121601  25 24 1953519616 [NO NAME]
     FAT32, blocksize=32768, 1000 GB / 931 GiB
NTFS at 121601/25/24
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
     FAT32 LBA                0  32 33 121601  25 24 1953519616 [NO NAME]
     FAT32, blocksize=32768, 1000 GB / 931 GiB
Not an exFAT boot sector.

     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
     FAT32 LBA                0  32 33 121601  25 24 1953519616 [NO NAME]
     FAT32, blocksize=32768, 1000 GB / 931 GiB
FAT: cluster=2(0x2), pos=478898
FAT: cluster=2105376(0x202020), pos=135222834

interface_write()
 1 P FAT32 LBA                0  32 33 121601  25 24 1953519616 [NO NAME]

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Newbie question: is safe to sleep?

#4 Post by cgrenier »

Don't worry about partition alignement. If you can see your files, use the arrow keys to switch the partition to P(rimary).
On next screen, choose Write, confirm, Quit

caam
Posts: 4
Joined: 11 Jan 2017, 12:04

Re: Newbie question: is safe to sleep?

#5 Post by caam »

Thanks!
will give it a try

caam
Posts: 4
Joined: 11 Jan 2017, 12:04

Re: Newbie question: is safe to sleep?

#6 Post by caam »

Hello
I followed the steps and selected write. The two FAT sections are now equal... but I'm still unable to mount the drive in a mac or see it in windows.
why can be that?
also, if i run now photorec, will photorec recognize the files I can see using testDisk as existent or deleted files?

Carlos Alberto

Locked