Second partition missing after Windows 7 -> 10 upgrade

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
geojay
Posts: 4
Joined: 09 Jan 2020, 20:58

Second partition missing after Windows 7 -> 10 upgrade

#1 Post by geojay »

I've recently upgraded my Shuttle PC (SZ68R5) from Windows 7 to Windows 10 and in the process, the second partition on a Seagate ST4000DM000 4TB drive has disappeared. I unfortunately can't remember the precise detail of how the drive came to be divided into two but I believe it was because the PC has a BIOS and therefore can only access partitions of a maximum size of 2TB.

I've now run Teskdisk and it seemed to find the missing second partition. I did what I thought was required to repair the partition but now, after a reboot, neither partitions are working in Windows. Instead, I have two drives, one of which reports a corrupted disk structure and the other claims to be un-formatted. I'm now out of my depth and would like to seek help before I make matters worse.

Thanks in anticipation...

The Teskdisk log now follows:



Wed Jan 8 19:22:57 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479515041792
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199022206976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
Hard disk list
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:W301738E, FW:CC54
Disk /dev/sdb - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SUV500MS480G, S/N:50026B7782667038, FW:003056RI

Partition table type (auto): Intel
Disk /dev/sda - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: Intel

Analyse Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Info: size boot_sector 4294965241, partition 4294965248
Current partition structure:
1 * HPFS - NTFS 0 32 33 267349 89 4 4294965248 [Data]

search_part()
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 0/1/1
filesystem size 3907023554
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91571500
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 243200 247 56 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
BAD_RS LBA=4294973440 2048
NTFS at 267349/186/38
filesystem size 3519055872
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
NTFS, blocksize=4096, 1801 GB / 1678 GiB
file_pread(4,2,buffer,7814037503(486401/86/21)) lseek err Invalid argument
file_pread(4,1,buffer,7814037503(486401/86/21)) lseek err Invalid argument
file_pread(4,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(4,1,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,7814037376(486401/84/20)) lseek err Invalid argument
file_pread(4,7,buffer,7814037505(486401/86/23)) lseek err Invalid argument
file_pread(4,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,7814037512(486401/86/30)) lseek err Invalid argument
file_pread(4,3,buffer,7814037520(486401/86/38)) lseek err Invalid argument
file_pread(4,3,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(4,8,buffer,7814037583(486401/87/38)) lseek err Invalid argument
file_pread(4,11,buffer,7814037630(486401/88/22)) lseek err Invalid argument
file_pread(4,2,buffer,7814039552(486401/118/54)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 8.

Results
* HPFS - NTFS 0 1 1 243200 254 63 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB
P HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
NTFS, blocksize=4096, 1801 GB / 1678 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 243200 254 63 3907024002
2 P HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]

interface_write()
1 * HPFS - NTFS 0 1 1 243200 254 63 3907024002
2 P HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
SIGHUP detected! TestDisk has been killed.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Second partition missing after Windows 7 -> 10 upgrade

#2 Post by cgrenier »

Every PC have a BIOS. Your disk isn't using 4096 bytes sector and your disk is over 2 TB, you should select EFI GPT, Analyse, Quick Search, for each partition, use 'p' to list the files.
If it's ok, on next screen, choose Write, confirm, Quit and restart your computer.

geojay
Posts: 4
Joined: 09 Jan 2020, 20:58

Re: Second partition missing after Windows 7 -> 10 upgrade

#3 Post by geojay »

OK, my main concern is that I selected Write in the session logged above and I think I may have made my situation worse.

I've just followed your advice to select EFI GPT and when I use 'p' to list the files, I get "Can't open filesystem. Filesystem seems damaged." for each. My log for that session follows...

Thanks



Mon Jan 13 10:07:49 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=1993064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=1993064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479515041792
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396289024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1801756606464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1993064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1258029056
Hard disk list
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:W301738E, FW:CC54
Disk /dev/sdb - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SUV500MS480G, S/N:50026B7782667038, FW:003056RI
Disk /dev/sdg - 1993 MB / 1900 MiB - CHS 242 255 63, sector size=512 - USB DISK, S/N:9BBC0A00F31D1A34, FW:PMAP
Drive O: - 1258 MB / 1199 MiB - CHS 2457088 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: EFI GPT

Analyse Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 0/1/1
filesystem size 3907023554
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91571500
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=32256, part_size=2000396059648, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/1/1
filesystem size 3907023554
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91571500
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 63 3907023616 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907023554
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91571500
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 511 3907024064 3907023554
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907023554
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91571500
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 3907024064 7814047617 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,1,buffer,7814047618(486401/246/56)) lseek err Invalid argument
file_pread(4,1,buffer,7814047619(486401/246/57)) lseek err Invalid argument
file_pread(4,14,buffer,7814047620(486401/246/58)) lseek err Invalid argument
file_pread(4,3,buffer,7814047634(486401/247/9)) lseek err Invalid argument
file_pread(4,3,buffer,7814047681(486401/247/56)) lseek err Invalid argument
file_pread(4,8,buffer,7814047697(486401/248/9)) lseek err Invalid argument
file_pread(4,11,buffer,7814047744(486401/248/56)) lseek err Invalid argument
file_pread(4,2,buffer,7814049666(486402/24/25)) lseek err Invalid argument

Results
MS Data 63 3907023616 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
MS Data 511 3907024064 3907023554
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
MS Data 3907024064 7814047617 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

MS Data 63 3907023616 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

MS Data 511 3907024064 3907023554
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

MS Data 3907024064 7814047617 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery
simulate write!

TestDisk exited normally.

geojay
Posts: 4
Joined: 09 Jan 2020, 20:58

Re: Second partition missing after Windows 7 -> 10 upgrade

#4 Post by geojay »

I've run it once more, with the Intel setting and it seemed to identify the second partition, certainly it listed the files I expected to see. I'm still not confident how to restore this partition and whether that can cause any more harm:



Mon Jan 13 11:23:03 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=1993064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=1993064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479515041792
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396289024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1801756606464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1993064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1258029056
Hard disk list
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:W301738E, FW:CC54
Disk /dev/sdb - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SUV500MS480G, S/N:50026B7782667038, FW:003056RI
Disk /dev/sdg - 1993 MB / 1900 MiB - CHS 242 255 63, sector size=512 - USB DISK, S/N:9BBC0A00F31D1A34, FW:PMAP
Drive O: - 1258 MB / 1199 MiB - CHS 2457088 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: Intel

Analyse Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
Info: size boot_sector 3907023554, partition 3907024002
NTFS at 267349/89/4
Error: size boot_sector 4294965241 > partition 3519055872
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 243200 254 63 3907024002
Error: size boot_sector 4294965241 > partition 3519055872
Invalid NTFS or exFAT boot
2 P HPFS - NTFS 267349 89 4 486400 113 48 3519055872
2 P HPFS - NTFS 267349 89 4 486400 113 48 3519055872

search_part()
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 0/1/1
filesystem size 3907023554
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 91571500
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 243200 247 56 3907023554
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 267349/89/4
filesystem size 4294965241
sectors_per_cluster 8
mft_lcn 770042
mftmirr_lcn 91534057
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 40 267349 89 4 4294965241
NTFS found using backup sector, blocksize=4096, 2199 GB / 2047 GiB
NTFS at 267349/89/4
filesystem size 4294965241
sectors_per_cluster 8
mft_lcn 770042
mftmirr_lcn 91534057
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 267349 89 4 534698 145 31 4294965241
NTFS, blocksize=4096, 2199 GB / 2047 GiB
This partition ends after the disk limits. (start=4294967295, size=4294965241, end=8589932535, disk end=7814037168)
BAD_RS LBA=4294973440 2048
NTFS at 267349/186/38
filesystem size 3519055872
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
NTFS, blocksize=4096, 1801 GB / 1678 GiB
file_pread(4,2,buffer,7814037503(486401/86/21)) lseek err Invalid argument
file_pread(4,1,buffer,7814037503(486401/86/21)) lseek err Invalid argument
file_pread(4,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(4,1,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,7814037376(486401/84/20)) lseek err Invalid argument
file_pread(4,7,buffer,7814037505(486401/86/23)) lseek err Invalid argument
file_pread(4,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,7814037512(486401/86/30)) lseek err Invalid argument
file_pread(4,3,buffer,7814037520(486401/86/38)) lseek err Invalid argument
file_pread(4,3,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(4,8,buffer,7814037583(486401/87/38)) lseek err Invalid argument
file_pread(4,11,buffer,7814037630(486401/88/22)) lseek err Invalid argument
file_pread(4,2,buffer,7814039552(486401/118/54)) lseek err Invalid argument
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (4000 GB / 3726 GiB) seems too small! (< 4398 GB / 4095 GiB)
The following partition can't be recovered:
HPFS - NTFS 267349 89 4 534698 145 31 4294965241
NTFS, blocksize=4096, 2199 GB / 2047 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 8.

Results
HPFS - NTFS 0 1 1 243200 254 63 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB
HPFS - NTFS 0 32 40 267349 89 4 4294965241
NTFS found using backup sector, blocksize=4096, 2199 GB / 2047 GiB
* HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
NTFS, blocksize=4096, 1801 GB / 1678 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.


dir_partition inode=5
* HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
NTFS, blocksize=4096, 1801 GB / 1678 GiB
Directory /
5 dr-xr-xr-x 0 0 0 16-Dec-2019 21:03 .
5 dr-xr-xr-x 0 0 0 16-Dec-2019 21:03 ..
***** REMOVED FOUND FILES *****
56264 -r--r--r-- 0 0 430592 12-Mar-2019 19:05 EUMONBMP.SYS
56271 -r--r--r-- 0 0 4096 24-Sep-2017 21:37 {01EE95A1-5DCB-463C-ABDB-DAF50B15835C}.CBM
Not an exFAT boot sector.

HPFS - NTFS 0 1 1 243200 254 63 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

HPFS - NTFS 0 32 40 267349 89 4 4294965241
NTFS found using backup sector, blocksize=4096, 2199 GB / 2047 GiB
Can't open filesystem. Filesystem seems damaged.
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 267349 154 6 486400 211 19 3519057920
5 L HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 267349/154/6,lba=4294971392

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Second partition missing after Windows 7 -> 10 upgrade

#5 Post by cgrenier »

After Deeper Search, use the arrow keys to switch the partitions from D(eleted) to P(rimary) to get

Code: Select all

D HPFS - NTFS 0 1 1 243200 254 63 3907024002
P HPFS - NTFS 0 32 40 267349 89 4 4294965241
P HPFS - NTFS 267349 186 38 486400 211 19 3519055872 [Backups]
On next screen, choose Write, confirm, Quit
After a reboot, run testdisk again, Advanced, select the first partition, Boot, List. If you can see your files, choose BackupBS, confirm, Quit

geojay
Posts: 4
Joined: 09 Jan 2020, 20:58

Re: Second partition missing after Windows 7 -> 10 upgrade

#6 Post by geojay »

Hi,
I've tried to do this, however the PC won't boot with the disk attached. I unplugged the disk while the PC rebooted and then reconnected it once Windows had started. I ran the second steps as advised but following the boot screen, 'list' wasn't available. My log follows:





Tue Jan 14 09:22:55 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=480103981056
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479515041792
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1801756606464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
Hard disk list
Disk /dev/sda - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SUV500MS480G, S/N:50026B7782667038, FW:003056RI
Disk /dev/sdf - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - ST4000DM000-1F2168, S/N:W301738E, FW:CC54

Partition table type (auto): Intel
Disk /dev/sdf - 4000 GB / 3726 GiB - ST4000DM000-1F2168
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 267349/89/4
Error: size boot_sector 4294965241 > partition 3519055872
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 267349 89 4 486400 113 48 3519055872

ntfs_boot_sector
1 P HPFS - NTFS 267349 89 4 486400 113 48 3519055872
NTFS at 267349/89/4
Error: size boot_sector 4294965241 > partition 3519055872
filesystem size 4294965241 1
sectors_per_cluster 8 0
mft_lcn 770042 0
mftmirr_lcn 91534057 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Error: size boot_sector 4294965241 > partition 3519055872
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

Locked