NTFS lost; disk showing incorrect information

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
rubyjade
Posts: 2
Joined: 25 Apr 2020, 19:53

NTFS lost; disk showing incorrect information

#1 Post by rubyjade »

I tried searching for this problem but couldn't find anything. I truly truly do not know how I messed up my drive this bad, except that it was late and I was tired.

I ran chkdsk /f on a Windows drive that wasn't booting. (I think checkdisk killed the partition table, but I'm not sure.) I wasn't aware there was a problem initially, but then I realized that the disk was saying it was RAW instead of NTFS.

When I ran testdisk to try to recover the partition, the most bizarre thing happened.

The name of the partition showing up is the name of a different partition on a different disk of a completely different size. For clarity, we'll call my troubled disk C and this other disk D. I did not clone or attempt to clone anything from drive D to drive C or any other drive. It was just hooked up to the system. I may have tried to write a log file to it at some point, but otherwise it was not involved in recovery efforts. The geometry of the disk seems to be correct. When I try listing the files on drive C, it lists the files (deleted and current) that are on D. D is no longer hooked up. I would really like to restore the partitions that actually WERE on disk C, but nothing seems to work. Drive C had two partitions, and it is the second one with the Windows installation I'd like to restore, but there's no sign that either partition ever existed. I'm trying to see what a different file recovery program will tell me, and it's giving me lists of 'recoverable' files from drive D instead of whatever is actually there.
Here's the most recent log:
Partition table type (auto): Intel
Disk /dev/sdc - 250 GB / 232 GiB - Hitachi HDP725025GLA380
Partition table type: Intel

Analyse Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
Current partition structure:
1 * HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
Invalid NTFS or exFAT boot
2 P HPFS - NTFS 60810 190 53 121600 247 55 976594944
2 P HPFS - NTFS 60810 190 53 121600 247 55 976594944

search_part()
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/32/33
filesystem size 976922616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094975
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=2048, size=976922616, end=976924663, disk end=488397168)
file_pread(6,2,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(6,1,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(6,2,buffer,488398848(30401/107/43)) lseek err Invalid argument
file_pread(6,14,buffer,488398850(30401/107/45)) lseek err Invalid argument
file_pread(6,3,buffer,488398864(30401/107/59)) lseek err Invalid argument
file_pread(6,3,buffer,488398911(30401/108/43)) lseek err Invalid argument
file_pread(6,8,buffer,488398927(30401/108/59)) lseek err Invalid argument
file_pread(6,11,buffer,488398974(30401/109/43)) lseek err Invalid argument
file_pread(6,2,buffer,488400896(30401/140/12)) lseek err Invalid argument
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (250 GB / 232 GiB) seems too small! (< 500 GB / 465 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB

Results
Change partition type:
No partition 0 0 1 30400 254 63 488392065

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/32/33
filesystem size 976922616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094975
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=2048, size=976922616, end=976924663, disk end=488397168)
file_pread(6,2,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(6,1,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(6,2,buffer,488398848(30401/107/43)) lseek err Invalid argument
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (250 GB / 232 GiB) seems too small! (< 500 GB / 465 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB

Results

interface_write()

No partition found or selected for recovery

interface_write()

No partition found or selected for recovery
Failed to read $MFTMirr: Input/output error.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
file_pread(6,1,buffer,976924672(60810/190/53)) lseek err Invalid argument
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB
2 P HPFS - NTFS 60810 190 53 121600 247 55 976594944
file_pread(6,8,buffer,976761848(60800/156/21)) lseek err Invalid argument
file_pread(6,1,buffer,976761848(60800/156/21)) lseek err Invalid argument
NTFS filesystem needs to be repaired.


dir_partition inode=5
1 * HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB
Directory /
5 dr-xr-xr-x 0 0 0 17-Apr-2020 09:37 .
5 dr-xr-xr-x 0 0 0 17-Apr-2020 09:37 ..
35 dr-xr-xr-x 0 0 0 21-Nov-2015 22:15 $RECYCLE.BIN
40 dr-xr-xr-x 0 0 0 21-Nov-2015 22:16 Audio Projects
14667 dr-xr-xr-x 0 0 0 5-Mar-2013 22:24 ConvertX To DVD + Keygen
14687 dr-xr-xr-x 0 0 0 2-Apr-2013 19:08 Debugging Tools for Windows (x86)
74176 dr-xr-xr-x 0 0 0 18-Oct-2013 00:15 Legacy Fonts
65764 dr-xr-xr-x 0 0 0 2-Apr-2013 19:10 Microsoft Visual Studio 10.0
65687 dr-xr-xr-x 0 0 0 2-Apr-2013 19:10 Microsoft Windows Performance Toolkit
71 dr-xr-xr-x 0 0 0 25-Nov-2019 14:55 My Backups
79 dr-xr-xr-x 0 0 0 16-Dec-2017 09:43 Program Backup
38 dr-xr-xr-x 0 0 0 17-Apr-2020 05:49 System Volume Information
43 dr-xr-xr-x 0 0 0 1-Aug-2018 18:02 Video Projects
3439 dr-xr-xr-x 0 0 0 28-Oct-2019 19:12 msdownld.tmp
68435 dr-xr-xr-x 0 0 0 2-Apr-2013 19:11 oZone3D
3393 -r--r--r-- 0 0 10270843 10-Feb-2012 21:24 Win 98.rar
41 -r--r--r-- 0 0 10493100032 16-Apr-2020 22:06 pagefile.sys

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB
NTFS at 0/32/33
file_pread(6,1,buffer,976924663(60810/190/44)) lseek err Invalid argument
filesystem size 976922616 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 122094975 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Partition table has been cleared.
You have to reboot for the change to take effect.

Analyse Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/32/33
filesystem size 976922616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094975
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=2048, size=976922616, end=976924663, disk end=488397168)
file_pread(6,2,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(6,1,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(6,2,buffer,488398848(30401/107/43)) lseek err Invalid argument
file_pread(6,14,buffer,488398850(30401/107/45)) lseek err Invalid argument
file_pread(6,3,buffer,488398864(30401/107/59)) lseek err Invalid argument
file_pread(6,3,buffer,488398911(30401/108/43)) lseek err Invalid argument
file_pread(6,8,buffer,488398927(30401/108/59)) lseek err Invalid argument
file_pread(6,11,buffer,488398974(30401/109/43)) lseek err Invalid argument
file_pread(6,2,buffer,488400896(30401/140/12)) lseek err Invalid argument
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (250 GB / 232 GiB) seems too small! (< 500 GB / 465 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 32 33 60810 190 44 976922616 [Samsung Spinpoint]
NTFS, blocksize=4096, 500 GB / 465 GiB

Results

interface_write()

No partition found or selected for recovery
I decided to clear the partition table in case that would solve the identity crisis but it did not, and now I'm worried that was a dumb thing to do.

I should probably clarify that this is not a critical data recovery because I have another copy of the data; I just would really like to solve this mystery.
Top
User avatar
cgrenier
Site Admin
Posts: 5441
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: NTFS lost; disk showing incorrect information

#2 Post by cgrenier »

It has all the symptom of a cloned harddisk to a smaller one... Has a disk been deconnected while the computer was in hibernation ?

The method to recover the data is to run PhotoRec, enable the Expert mode, choose "Whole Disk", start the recovery, use a blocksize of 512 bytes, use the default options otherwise (no need to create an image_remaining.dd file).
Enough free space (250GB or more recommended) is needed on the destination.
But if you already have another copy of the data, no need to try all this...
Top
rubyjade
Posts: 2
Joined: 25 Apr 2020, 19:53

Re: NTFS lost; disk showing incorrect information

#3 Post by rubyjade »

It was cloned from a larger disk originally; just not the one with the info that's showing up now. I cloned a 360 GB drive with 160 GB free onto the 232 GB one. It was successful in most ways; it booted up into Windows. That's a different story. Regardless, I've run a whole bunch of other recovery programs and even when they just find raw files it's the wrong stuff.

I don't hibernate my desktop computers and I doubt I disconnected it while the computer was still running, but all things are possible.

Which is more likely, in your opinion? That I somehow accidentally cloned a drive or that rescue software is finding 'files' that aren't there because they're reading bad filesystem data (I do not know if that's even possible)?

I have a drive with enough space to run PhotoRec, and I guess that would be one way to try to answer the above question.
Top
Locked

Return to “Partition Recovery”