after partition recovery, only displays 10 clusters of files

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kailord
Posts: 5
Joined: 15 May 2012, 03:48

after partition recovery, only displays 10 clusters of files

#1 Post by kailord »

hi, I read in the documentation that after partition scanning is done, only 10 clusters of file information is displayed. can I please verify this fact, because

after I recover a partition, it shows me my "p" list of files, which shows one directory only.
in this partition, I have a few directories but one is shown. I think this is because this directory is big, has quite a few files, more than 10 clusters, so only one directory is shown.

in this directory, there are some subdirectories, and all the files inside appear fine.

so my worry now is, other directories branching from the ROOT directory have not yet been shown. this is likely i think, because only 10 clusters are displayed.

if this is true (is this true? ), then what should be my next step? "c" copy the files out, and only 10 clusters will be rescued, or there is some other command to "c" copy or rescue the entire harddisk, including directories which are not displayed ?

thanks! i'm unclear about what the next step should be.

kailord
Posts: 5
Joined: 15 May 2012, 03:48

Re: after partition recovery, only displays 10 clusters of f

#2 Post by kailord »

Hi Fiona, you said in another post:
"If TestDisk finds your correct partition, you can write it into your partition table again."

I encountered this as well, and I tried to write it in, but after writing, and restarting the computer,
I am back to square one - that partition is still not recognised, and I can try to testdisk again and detect it again (on Deeper Search), but every time I try to "write it in", it does not get remembered.

What is going on in this situation? Is the only way now, to copy each file into a new harddisk one by one, and sort out the files again? There is no way to restore this partition ?

Thanks !

kailord
Posts: 5
Joined: 15 May 2012, 03:48

Re: after partition recovery, only displays 10 clusters of f

#3 Post by kailord »

to elaborate on this previous post, I followed testdisk step by step instructions, until:

It works, you have found the correct partition!
Use the left/right arrow to navigate into your folders and watch your files for more verification
Note: FAT directory listing is limited to 10 clusters - some files may not appear but it doesn't affect recovery.
Press q for Quit to go back to the previous display.
The available status are Primary, * bootable, Logical and Deleted.
Using the left/right arrow keys, change the status of the selected partition to L(ogical)
Hint: read How to recognize primary and logical partitions?
Note: If a partition is listed *(bootable) but if you don't boot from this partition, you can change it to Primary partition.

At this point, following the instructions, I changed it to "P" because mine was originally listed by testdisk as *
next,

Press Enter to proceed.
Partition table recovery
It's now possible to write the new partition structure.
Note: The extended partition is automatically set. TestDisk recognizes this using the different partition structure.
If all partitions are listed and only in this case, confirm at Write with Enter, y and OK.
Now, the partitions are registered in the partition table.
NTFS Boot sector recovery

There was no Boot sector recovery because it wasn't a bootable partition in the first place.
TestDisk displays You have to restart your Computer to access your data so press Enter a last time and reboot your computer.

I restarted, but I'm back to square one, it's like I have not done any Analyze before - the partition is still listed in My Computer as Drive J: (but no further information about size, type, and when I Properties it, it takes a long time to try to access and summarise its properties. Disk Management still shows the drive, the correct size, but raw, no NTFS)

When I repeat testdisk, I get the same results - same files seen, same detection. Almost as if nothing has changed. I write again, save again, reboot again, same thing, no detection.

What might be wrong? Would the next logical step be just to copy as many files out as possible? Using testdisk or other software?

Thanks!

kailord
Posts: 5
Joined: 15 May 2012, 03:48

Re: after partition recovery, only displays 10 clusters of f

#4 Post by kailord »

is it also because this drive, with two partitions:
both cannot be "P"rimary partition, the first one should have been "P" and the second one is "L"ogical ?

testdisk detected first one as * and second one as P

and now the second one (P) is accessed fine, but the * first one isn't detected properly

should I change the first one to P, and the second one to L, and WRITE this new information in?

thanks!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: after partition recovery, only displays 10 clusters of f

#5 Post by Fiona »

There was no Boot sector recovery because it wasn't a bootable partition in the first place.
Boot sector is different.
Each partition has a boot sector and it's the first logical executable sector of a partition.
To boot is determined in your MBR and partition table.
The hexadecimal value is 80h which says, this is your start partition.
If the value is 00 these partitions will be ignored.

Your boot sector contain essential data about your file system and boot strap to start your OS.
If a boot sector is damaged, your partition appears as RAW unformatted.
It means your partition is available but has no file system.

If you wrote your partition to your partition table will be only working if your boot sector is ok.
You can check your boot sector in TestDisk under the menu Advanced..
If your partition is not listed under Advanced then it will be not in your partition table.
If your partition is avilable, please check it and confirm at Boot.
There you'll have the opportunities to repair your boot sector, if the backup is Ok you can use Backup BS to copy your backup of the boot sector over your defect boot sector (only if it listed as Bad).
You even have the possibility to rebuild a boot sector.
Only use these features if your boot sector is damaged and you were able to list your files.
At the moment I don't recommend to use the features Org BS and repair MFT if someone has no idea exactly what it and he does.
In case prefer to the documentation or ask here, with a clearly explanation.

is it also because this drive, with two partitions:
both cannot be "P"rimary partition, the first one should have been "P" and the second one is "L"ogical ?

Would it be possible to copy the content from your testdisk display or your testdisk.log?
Also you can upload screenshots or zip the logfile for uploading.
I'd need infos from Analyse about your current partition structur and Quick or Deeper Search, just like your partitions are found.

Fiona

Locked