Unable to recover partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
d4riog
Posts: 3
Joined: 09 Apr 2017, 04:11

Unable to recover partition

#1 Post by d4riog »

Hi there,

I am dealing with a 1TB external HD which appears in disk management as follows:

01.png
01.png (4.42 KiB) Viewed 1869 times

Basically, I followed the TestDisk Step by Step guide, and I managed to get to this stage:

03.png
03.png (18.59 KiB) Viewed 1869 times


in fact, I can list all files pressing P, but when I try to write the new partition structure I click [ write ], quit the program, reboot my laptop with the usb HD connected but nothing change. After reboot, the HD appears as connected via USB, still not visible in the explorer, and still unallocated in disk management.

Am I doing something wrong or is there a way to figure out what's going on?

(I thought that since I am able to list all files I should be able to recover the partition)

cheers,
D

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Unable to recover partition

#2 Post by cgrenier »

Maybe another process is preventing the write operation to be completed. Boot your Windows in safe mode, try to disable your antivirus and try again to recover your partition.

d4riog
Posts: 3
Joined: 09 Apr 2017, 04:11

Re: Unable to recover partition

#3 Post by d4riog »

cgrenier wrote: 10 Apr 2017, 06:28 Maybe another process is preventing the write operation to be completed. Boot your Windows in safe mode, try to disable your antivirus and try again to recover your partition.
Thank you, I tried to recover the partition in safe mode but nothing changes. After clicking on [ write ], I quit and rebooted as suggested but no change as well.

If I reload testdisk I still get "Partition: read error", I click on [ quick search ] the partition is detected, I click enter to write the partition table and asked to reboot again.

In an ideal scenario, after rebooting the HD should be visible in the explorer, right?

I just wonder what else should I try to understand why the write operation is not performed. Any suggestion? would posting a log file help? I am lost.

d4riog
Posts: 3
Joined: 09 Apr 2017, 04:11

Re: Unable to recover partition

#4 Post by d4riog »

By the way, the following is the testdisk log file.

In the meantime I figured out that when I list files I am actually able to copy them (at least the copy of small files did not failed but I haven't tried with big ones).

What's the best strategy at this point? Would using ddrescue take ages due to the size of the HD (1tb) and the speed of my computer/laptop?

thanks

Code: Select all


Mon Apr 10 22:49:35 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=452797136896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=26843545600
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-1DG142, S/N:SBY1P6SN, FW:0002LVM1
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Backup+ BK, S/N:NA52SW33, FW:0409

Partition table type defaults to Intel
Disk /dev/sdb - 1000 GB / 931 GiB - Seagate Backup+ BK
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:

Partition: Read error

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616 [Seagate Backup Plus Drive]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,6,buffer,1953525762(121601/90/28)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 121601  25 24 1953519616 [Seagate Backup Plus Drive]
     NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616 [Seagate Backup Plus Drive]
write!

write_mbr_i386: starting...
file_pread(5,1,buffer,0(0/0/1)) ReadFile Data error (cyclic redundancy check).


Partition: Read error
Store new MBR code
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

Locked