Testdisk found extra NTFS partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
boarder2k7
Posts: 2
Joined: 28 Oct 2018, 17:07

Testdisk found extra NTFS partition

#1 Post by boarder2k7 »

I had a bootable Windows partition disappear, and I'm using testdisk within Gparted to try and recover it.

testdisk seems to have found the partition, but there is also an extra one here:
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
D HPFS - NTFS 0 1 1 2693 254 63 43279047
1 HPFS - NTFS 0 32 33 12 223 19 204800
2 HPFS - NTFS 12 223 20 60801 112 47 976568320

The two I want are the ones I labeled "1" and "2" where partition 1 is the 100 MiB reserved partition Windows creates, and 2 is the active bootable Windows partition. I have no idea what the 20 GiB partition marked "D" is as I've only ever had this drive formatted with that one Windows instance.

What should I set the two wanted partitions to in order to restore the drive? Does 1 become bootable and 2 become primary?

Gparted sees both partitions 1 and 2 and has 1 flagged as boot, is this correct? Partition 2 is labeled as "Windows" in Gparted but has no assigned size.

Gparted also shows an exclamation point next to the partition, and says:
"Index root attribute missing in directory inode 5: No such file or directory
Failed to open $Secure: No such file or directory
Failed to mount '/dev/sdb2': No such file or directory"


The message I got from testdisk at the beginning showed partition 2 as "Warning: Bad starting sector (CHS and LBA don't match."

(Sorry for the bad formatting and lack of actual pictures, not sure how to do screenshots within Gparted and none of the forum formatting buttons show up in NetSurf)

Thanks for the help

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk found extra NTFS partition

#2 Post by cgrenier »

Set the partition labeled as 1 as P(rimary) and 2 as *(bootable).
You will probably have to repair the filesystem, read the corresponding chapter in https://www.cgsecurity.org/testdisk.pdf
If it doesn't work, use PhotoRec to recover your data.

boarder2k7
Posts: 2
Joined: 28 Oct 2018, 17:07

Re: Testdisk found extra NTFS partition

#3 Post by boarder2k7 »

Follow-up: Never got this to work. In fact I suspect that trying to write the partitions back may have made the drive unrecoverable when I passed it off for a friend to try with a RapidSpar recovery tool (didn't know he had access to one or I would have tried that first).

Note for next time (which I know to do but somehow forgot): ALWAYS make a forensic copy of the drive and work off the copy to avoid breaking things worse.


End Result - no clue what happened in the first place, or what would have solved it, I didn't get it to work, nor did my friends who work in the field.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk found extra NTFS partition

#4 Post by cgrenier »

Even if recovering the partition failed, you should be able to recover some data using PhotoRec.

Locked