Recover Accidentally Erased?Wiped Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
sap17
Posts: 7
Joined: 29 May 2012, 12:50

Recover Accidentally Erased?Wiped Partition

#1 Post by sap17 »

Dear Sir, I have accidentally run the wipe drive option through a software known as Ccleaner on the secondary partition of my hard drive. After that the partition is being reflected as raw. The complete data is there and can be viewed using minitool partition recovery software. It has helped me in recovering the data too in an unorganized manner with the filenames changed. Now one of the options is to format the partition and start reusing it which I do not want to do. I think the wipe action has deleted some boot table. Is there some way to restore it? I cancelled the action within a few seconds after realizing my mistake. Operating System is windows 7 64 bit ultimate edition
HDD is Seagate 1 TB , Intel I5 2500k Processor and asus p8z68v motherboard with 4 gb 1666Mhz Corsair ram. I tried Running testdisk 6.14 but a small window opens up saying that test disk has stopped and windows is checking for the problem. Moreover I disabled the anti virus and tried again but the same result. However the C Drive and a 100 MB windows system partition are fine and the computer is running fine. Solicit your assistance.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover Accidentally Erased?Wiped Partition

#2 Post by Fiona »

Did you use the TestDisk6.14-32bit-version.
To get your files back it's depend on, how far did you write into your file system.
If you were overridding directories and file names, then it might be not possible to get your folders and filenames back.
To have a try to get your partition back and bootable you should run Deeper Search.
Because if you have had an NTFS-partition the backup of the boot sector is at the end of your partition.
If TestDisk would find it, it would display your partition for recovery using the backup of the boot sector and you could register it into your partition table.
But it's only recommended if your file system is not seriously damaged and TestDisk lists your data.
I tried Running testdisk 6.14 but a small window opens up saying that test disk has stopped and windows is checking for the problem.
Did you unzip TestDisk?
TestDisk is unix based.
To work correctly it needs the cygwin.dll and path.
So it's advisable to run it directly from it's folder.
Would it be possible, if you're able to recreate your situation to upload a screen from your message?

Fiona

sap17
Posts: 7
Joined: 29 May 2012, 12:50

Re: Recover Accidentally Erased?Wiped Partition

#3 Post by sap17 »

No I used the one under the link x64 as I have a windows 7 64 bit edition running. I extracted all the files through winrar in a folder named Testdisk on the C:\ Drive of the Machine. Then I right clicked and clicked on the Command "Run as Administrator". A window like the one you get when you open command prompt Flashes for a second and then vanishes on its own. I would not know where I am going wrong. I ran a program HxD and the sectors which have got erased are Sector 839075013 definitely as it has all 00. In fact the Values end at the end of Sector 839074950. The next sector ie 839074951 has all its values as 00. Then the Data i.e. figures in sector start at 840853829. Thus the total number of erased sectors are 17,78,879. So it roughly amounts to approx. 10 seconds of wiping. I have been able to recover bulk of the Data through a recovery software called partition mini tool which did a raw recovery and has recovered almost all files. However the names of the files have been serially listed and the all the jpeg files are in one folder. Same for the Mpeg, Mov, word filesetc and the names have been altered to read 1,2,3 etc. The results obtained by running Sectinspector are as listed below. Hope this helps.





--------------
Date and time:
28-May-12
20:20



--------------
Date and time:
29-May-12
14:50

0001.033

Sector Inspector Copyright Microsoft Corporation 2003
===========================================================================
Target - \\.\PHYSICALDRIVE0
121601 Cylinders
255 Heads
63 Sectors Per Track
512 BytesPerSector
12 MediaType

===========================================================================
Master Boot Record
===========================================================================
| B | FS TYPE | START | END | | |
| F | (hex) | C H S| C H S| RELATIVE | TOTAL |
===========================================================================
| * | 07 | 0 32 33| 12 223 19| 2048| 204800|
| | 07 | 12 223 20|1023 254 63| 206848| 838866054|
| | 0f |1023 254 63|1023 254 63| 839074950| 1114445115|
| | 00 | 0 0 0| 0 0 0| 0| 0|
===========================================================================
Disk Signature 0x3cd88b72

Partition #1 NTFS backup boot sector at LBN 206847.
Partition #2 NTFS backup boot sector at LBN 839072901.


LBN 0 [C 0, H 0, S 1]

0x0000 33 c0 8e d0 bc 00 7c 8e-c0 8e d8 be 00 7c bf 00 3ÀŽÐ¼.|ŽÀŽØ¾.|¿.
0x0010 06 b9 00 02 fc f3 a4 50-68 1c 06 cb fb b9 04 00 .¹..üó¤Ph .Ëû¹..
0x0020 bd be 07 80 7e 00 00 7c-0b 0f 85 0e 01 83 c5 10 ½¾.€~..|..…..ƒÅ
0x0030 e2 f1 cd 18 88 56 00 55-c6 46 11 05 c6 46 10 00 âñÍ ˆV.UÆF .ÆF .
0x0040 b4 41 bb aa 55 cd 13 5d-72 0f 81 fb 55 aa 75 09 ´A»ªUÍ ]r. ûUªu.
0x0050 f7 c1 01 00 74 03 fe 46-10 66 60 80 7e 10 00 74 ÷Á..t.þF f`€~ .t
0x0060 26 66 68 00 00 00 00 66-ff 76 08 68 00 00 68 00 &fh....fÿv.h..h.
0x0070 7c 68 01 00 68 10 00 b4-42 8a 56 00 8b f4 cd 13 |h..h .´BŠV.‹ôÍ
0x0080 9f 83 c4 10 9e eb 14 b8-01 02 bb 00 7c 8a 56 00 ŸƒÄ žë ¸..».|ŠV.
0x0090 8a 76 01 8a 4e 02 8a 6e-03 cd 13 66 61 73 1c fe Šv.ŠN.Šn.Í fas þ
0x00a0 4e 11 75 0c 80 7e 00 80-0f 84 8a 00 b2 80 eb 84 N u.€~.€.„Š.²€ë„
0x00b0 55 32 e4 8a 56 00 cd 13-5d eb 9e 81 3e fe 7d 55 U2äŠV.Í ]ëž >þ}U
0x00c0 aa 75 6e ff 76 00 e8 8d-00 75 17 fa b0 d1 e6 64 ªunÿv.è .u ú°Ñæd
0x00d0 e8 83 00 b0 df e6 60 e8-7c 00 b0 ff e6 64 e8 75 èƒ.°ßæ`è|.°ÿædèu
0x00e0 00 fb b8 00 bb cd 1a 66-23 c0 75 3b 66 81 fb 54 .û¸.»Í f#Àu;f ûT
0x00f0 43 50 41 75 32 81 f9 02-01 72 2c 66 68 07 bb 00 CPAu2 ù..r,fh.».
0x0100 00 66 68 00 02 00 00 66-68 08 00 00 00 66 53 66 .fh....fh....fSf
0x0110 53 66 55 66 68 00 00 00-00 66 68 00 7c 00 00 66 SfUfh....fh.|..f
0x0120 61 68 00 00 07 cd 1a 5a-32 f6 ea 00 7c 00 00 cd ah...Í Z2öê.|..Í
0x0130 18 a0 b7 07 eb 08 a0 b6-07 eb 03 a0 b5 07 32 e4 ·.ë. ¶.ë. µ.2ä
0x0140 05 00 07 8b f0 ac 3c 00-74 09 bb 07 00 b4 0e cd ...‹ð¬<.t.»..´.Í
0x0150 10 eb f2 f4 eb fd 2b c9-e4 64 eb 00 24 02 e0 f8 ëòôëý+Éädë.$.àø
0x0160 24 02 c3 49 6e 76 61 6c-69 64 20 70 61 72 74 69 $.ÃInvalid parti
0x0170 74 69 6f 6e 20 74 61 62-6c 65 00 45 72 72 6f 72 tion table.Error
0x0180 20 6c 6f 61 64 69 6e 67-20 6f 70 65 72 61 74 69 loading operati
0x0190 6e 67 20 73 79 73 74 65-6d 00 4d 69 73 73 69 6e ng system.Missin
0x01a0 67 20 6f 70 65 72 61 74-69 6e 67 20 73 79 73 74 g operating syst
0x01b0 65 6d 00 00 00 63 7b 9a-72 8b d8 3c 00 00 80 20 em...c{šr‹Ø<..€
0x01c0 21 00 07 df 13 0c 00 08-00 00 00 20 03 00 00 df !..ß ...... ...ß
0x01d0 14 0c 07 fe ff ff 00 28-03 00 86 14 00 32 00 fe ..þÿÿ.(..† .2.þ
0x01e0 ff ff 0f fe ff ff 86 44-03 32 3b 15 6d 42 00 00 ÿÿ.þÿÿ†D.2; mB..
0x01f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 aa ..............Uª

---------------------------------------------------------------------------
Primary Partition 1
NTFS BIOS Parameter Block Information

BytesPerSector : 512
Sectors Per Cluster : 8
ReservedSectors : 0
Fats : 0
RootEntries : 0
Small Sectors : 0 ( 0 MB )
Media Type : 248 ( 0xf8 )
SectorsPerFat : 0
SectorsPerTrack : 63
Heads : 255
Hidden Sectors : 2048
Large Sectors : 0 ( 0 MB )

ClustersPerFRS : 246
Clust/IndxAllocBuf : 1
NumberSectors : 204799 ( 99.9995 MB )
MftStartLcn : 8533
Mft2StartLcn : 2
SerialNumber : 15761000687620749003
Checksum : 0 (0x0)

---------------------------------------------------------------------------

LBN 2048 [C 0, H 32, S 33]

0x0000 eb 52 90 4e 54 46 53 20-20 20 20 00 02 08 00 00 ëR NTFS .....
0x0010 00 00 00 00 00 f8 00 00-3f 00 ff 00 00 08 00 00 .....ø..?.ÿ.....
0x0020 00 00 00 00 80 00 80 00-ff 1f 03 00 00 00 00 00 ....€.€.ÿ ......
0x0030 55 21 00 00 00 00 00 00-02 00 00 00 00 00 00 00 U!..............
0x0040 f6 00 00 00 01 00 00 00-cb 76 52 ba 9e 52 ba da ö.......ËvRºžRºÚ
0x0050 00 00 00 00 fa 33 c0 8e-d0 bc 00 7c fb 68 c0 07 ....ú3ÀŽÐ¼.|ûhÀ.
0x0060 1f 1e 68 66 00 cb 88 16-0e 00 66 81 3e 03 00 4e hf.ˈ ..f >..N
0x0070 54 46 53 75 15 b4 41 bb-aa 55 cd 13 72 0c 81 fb TFSu ´A»ªUÍ r. û
0x0080 55 aa 75 06 f7 c1 01 00-75 03 e9 dd 00 1e 83 ec Uªu.÷Á..u.éÝ. ƒì
0x0090 18 68 1a 00 b4 48 8a 16-0e 00 8b f4 16 1f cd 13 h .´HŠ ..‹ô Í
0x00a0 9f 83 c4 18 9e 58 1f 72-e1 3b 06 0b 00 75 db a3 ŸƒÄ žX rá;...uÛ£
0x00b0 0f 00 c1 2e 0f 00 04 1e-5a 33 db b9 00 20 2b c8 ..Á.... Z3Û¹. +È
0x00c0 66 ff 06 11 00 03 16 0f-00 8e c2 ff 06 16 00 e8 fÿ. .. ..ŽÂÿ. .è
0x00d0 4b 00 2b c8 77 ef b8 00-bb cd 1a 66 23 c0 75 2d K.+Èwï¸.»Í f#Àu-
0x00e0 66 81 fb 54 43 50 41 75-24 81 f9 02 01 72 1e 16 f ûTCPAu$ ù..r
0x00f0 68 07 bb 16 68 70 0e 16-68 09 00 66 53 66 53 66 h.» hp. h..fSfSf
0x0100 55 16 16 16 68 b8 01 66-61 0e 07 cd 1a 33 c0 bf U h¸.fa..Í 3À¿
0x0110 28 10 b9 d8 0f fc f3 aa-e9 5f 01 90 90 66 60 1e ( ¹Ø.üóªé_. f`
0x0120 06 66 a1 11 00 66 03 06-1c 00 1e 66 68 00 00 00 .f¡ .f.. . fh...
0x0130 00 66 50 06 53 68 01 00-68 10 00 b4 42 8a 16 0e .fP.Sh..h .´BŠ .
0x0140 00 16 1f 8b f4 cd 13 66-59 5b 5a 66 59 66 59 1f . ‹ôÍ fY[ZfYfY
0x0150 0f 82 16 00 66 ff 06 11-00 03 16 0f 00 8e c2 ff .‚ .fÿ. .. ..ŽÂÿ
0x0160 0e 16 00 75 bc 07 1f 66-61 c3 a0 f8 01 e8 09 00 . .u¼. faà ø.è..
0x0170 a0 fb 01 e8 03 00 f4 eb-fd b4 01 8b f0 ac 3c 00 û.è..ôëý´.‹ð¬<.
0x0180 74 09 b4 0e bb 07 00 cd-10 eb f2 c3 0d 0a 41 20 t.´.»..Í ëòÃ..A
0x0190 64 69 73 6b 20 72 65 61-64 20 65 72 72 6f 72 20 disk read error
0x01a0 6f 63 63 75 72 72 65 64-00 0d 0a 42 4f 4f 54 4d occurred...BOOTM
0x01b0 47 52 20 69 73 20 6d 69-73 73 69 6e 67 00 0d 0a GR is missing...
0x01c0 42 4f 4f 54 4d 47 52 20-69 73 20 63 6f 6d 70 72 BOOTMGR is compr
0x01d0 65 73 73 65 64 00 0d 0a-50 72 65 73 73 20 43 74 essed...Press Ct
0x01e0 72 6c 2b 41 6c 74 2b 44-65 6c 20 74 6f 20 72 65 rl+Alt+Del to re
0x01f0 73 74 61 72 74 0d 0a 00-8c a9 be d6 00 00 55 aa start...Œ©¾Ö..Uª


---------------------------------------------------------------------------
Primary Partition 2
NTFS BIOS Parameter Block Information

BytesPerSector : 512
Sectors Per Cluster : 8
ReservedSectors : 0
Fats : 0
RootEntries : 0
Small Sectors : 0 ( 0 MB )
Media Type : 248 ( 0xf8 )
SectorsPerFat : 0
SectorsPerTrack : 63
Heads : 255
Hidden Sectors : 206848
Large Sectors : 0 ( 0 MB )

ClustersPerFRS : 246
Clust/IndxAllocBuf : 1
NumberSectors : 838866053 ( 409603 MB )
MftStartLcn : 786432
Mft2StartLcn : 2
SerialNumber : 15591678983522308804
Checksum : 0 (0x0)

---------------------------------------------------------------------------

LBN 206848 [C 12, H 223, S 20]

0x0000 eb 52 90 4e 54 46 53 20-20 20 20 00 02 08 00 00 ëR NTFS .....
0x0010 00 00 00 00 00 f8 00 00-3f 00 ff 00 00 28 03 00 .....ø..?.ÿ..(..
0x0020 00 00 00 00 80 00 80 00-85 14 00 32 00 00 00 00 ....€.€.… .2....
0x0030 00 00 0c 00 00 00 00 00-02 00 00 00 00 00 00 00 ................
0x0040 f6 00 00 00 01 00 00 00-c4 52 c5 60 6d c5 60 d8 ö.......ÄRÅ`mÅ`Ø
0x0050 00 00 00 00 fa 33 c0 8e-d0 bc 00 7c fb 68 c0 07 ....ú3ÀŽÐ¼.|ûhÀ.
0x0060 1f 1e 68 66 00 cb 88 16-0e 00 66 81 3e 03 00 4e hf.ˈ ..f >..N
0x0070 54 46 53 75 15 b4 41 bb-aa 55 cd 13 72 0c 81 fb TFSu ´A»ªUÍ r. û
0x0080 55 aa 75 06 f7 c1 01 00-75 03 e9 dd 00 1e 83 ec Uªu.÷Á..u.éÝ. ƒì
0x0090 18 68 1a 00 b4 48 8a 16-0e 00 8b f4 16 1f cd 13 h .´HŠ ..‹ô Í
0x00a0 9f 83 c4 18 9e 58 1f 72-e1 3b 06 0b 00 75 db a3 ŸƒÄ žX rá;...uÛ£
0x00b0 0f 00 c1 2e 0f 00 04 1e-5a 33 db b9 00 20 2b c8 ..Á.... Z3Û¹. +È
0x00c0 66 ff 06 11 00 03 16 0f-00 8e c2 ff 06 16 00 e8 fÿ. .. ..ŽÂÿ. .è
0x00d0 4b 00 2b c8 77 ef b8 00-bb cd 1a 66 23 c0 75 2d K.+Èwï¸.»Í f#Àu-
0x00e0 66 81 fb 54 43 50 41 75-24 81 f9 02 01 72 1e 16 f ûTCPAu$ ù..r
0x00f0 68 07 bb 16 68 70 0e 16-68 09 00 66 53 66 53 66 h.» hp. h..fSfSf
0x0100 55 16 16 16 68 b8 01 66-61 0e 07 cd 1a 33 c0 bf U h¸.fa..Í 3À¿
0x0110 28 10 b9 d8 0f fc f3 aa-e9 5f 01 90 90 66 60 1e ( ¹Ø.üóªé_. f`
0x0120 06 66 a1 11 00 66 03 06-1c 00 1e 66 68 00 00 00 .f¡ .f.. . fh...
0x0130 00 66 50 06 53 68 01 00-68 10 00 b4 42 8a 16 0e .fP.Sh..h .´BŠ .
0x0140 00 16 1f 8b f4 cd 13 66-59 5b 5a 66 59 66 59 1f . ‹ôÍ fY[ZfYfY
0x0150 0f 82 16 00 66 ff 06 11-00 03 16 0f 00 8e c2 ff .‚ .fÿ. .. ..ŽÂÿ
0x0160 0e 16 00 75 bc 07 1f 66-61 c3 a0 f8 01 e8 09 00 . .u¼. faà ø.è..
0x0170 a0 fb 01 e8 03 00 f4 eb-fd b4 01 8b f0 ac 3c 00 û.è..ôëý´.‹ð¬<.
0x0180 74 09 b4 0e bb 07 00 cd-10 eb f2 c3 0d 0a 41 20 t.´.»..Í ëòÃ..A
0x0190 64 69 73 6b 20 72 65 61-64 20 65 72 72 6f 72 20 disk read error
0x01a0 6f 63 63 75 72 72 65 64-00 0d 0a 42 4f 4f 54 4d occurred...BOOTM
0x01b0 47 52 20 69 73 20 6d 69-73 73 69 6e 67 00 0d 0a GR is missing...
0x01c0 42 4f 4f 54 4d 47 52 20-69 73 20 63 6f 6d 70 72 BOOTMGR is compr
0x01d0 65 73 73 65 64 00 0d 0a-50 72 65 73 73 20 43 74 essed...Press Ct
0x01e0 72 6c 2b 41 6c 74 2b 44-65 6c 20 74 6f 20 72 65 rl+Alt+Del to re
0x01f0 73 74 61 72 74 0d 0a 00-8c a9 be d6 00 00 55 aa start...Œ©¾Ö..Uª


===========================================================================
Extended Boot Record
===========================================================================
| B | FS TYPE | START | END | | |
| F | (hex) | C H S| C H S| RELATIVE | TOTAL |
===========================================================================
| | 07 |1023 254 63|1023 254 63| 63| 1114445052|
| | 00 | 0 0 0| 0 0 0| 0| 0|
| | 00 | 0 0 0| 0 0 0| 0| 0|
| | 00 | 0 0 0| 0 0 0| 0| 0|
===========================================================================
Partition #1 NTFS backup boot sector at LBN 1953520064.


LBN 839074950 [C 52230, H 0, S 1]

0x0000 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0040 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0080 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0090 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 fe ...............þ
0x01c0 ff ff 07 fe ff ff 3f 00-00 00 fc 14 6d 42 00 00 ÿÿ.þÿÿ?...ü mB..
0x01d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 aa ..............Uª

---------------------------------------------------------------------------
Logical Volume
NTFS BIOS Parameter Block Information

BytesPerSector : 0
Sectors Per Cluster : 0
ReservedSectors : 0
Fats : 0
RootEntries : 0
Small Sectors : 0 ( 0 MB )
Media Type : 0 ( 0x0 )
SectorsPerFat : 0
SectorsPerTrack : 0
Heads : 0
Hidden Sectors : 0
Large Sectors : 0 ( 0 MB )

ClustersPerFRS : 0
Clust/IndxAllocBuf : 0
NumberSectors : 0 ( 0 MB )
MftStartLcn : 0
Mft2StartLcn : 0
SerialNumber : 0
Checksum : 0 (0x0)

---------------------------------------------------------------------------

LBN 839075013 [C 52230, H 1, S 1]

0x0000 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0040 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0080 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0090 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x01f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................



===========================================================================
Target - \\.\PHYSICALDRIVE1
60797 Cylinders
255 Heads
63 Sectors Per Track
512 BytesPerSector
12 MediaType



Error 1117 was encountered reading from \\.\PHYSICALDRIVE1.

The request could not be performed because of an I/O device error.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover Accidentally Erased?Wiped Partition

#4 Post by Fiona »

Please use the version 6.14-32bit.
To use the 64bit-version is only recommended if you have an OS lacking wow64 as some features are missing.
If you use Deeper Search in TestDisk, TestDisk will have a look for your backup of you boot sector.
It might be possible that TestDisk displays your partition for recovery.
In case if you press p to list your files, and your files are listed, you could for example copy them to another intact disk or partition.
But that's not all.
You could repair your overridden boot sector and get access to your partition again.
But it's depend on how far did you write into your file system.


Fiona

sap17
Posts: 7
Joined: 29 May 2012, 12:50

Re: Recover Accidentally Erased?Wiped Partition

#5 Post by sap17 »

Dear Fiona, Thanks for the guidance and shall try TestDisk Version 6.14-32 bit. Have been able to get the Backup Sector for this damaged partition through HxD. shall post results/logfile soonest before attempting any repair or restore.Regards

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover Accidentally Erased?Wiped Partition

#6 Post by Fiona »

Results and logfile are appreciated!
Especially are you able to list your files.
It would indicate that you didn't write as far into your file system and you'd be able to recover your partition directly.

Fiona

sap17
Posts: 7
Joined: 29 May 2012, 12:50

Re: Recover Accidentally Erased?Wiped Partition

#7 Post by sap17 »

Dear Fiona, Daniel Sedory is guiding me to recover the disk and has asked me to convey His Hello to you. I have uploaded the log file of testdisk for your perusal. Waiting for further assistance. Regards Atul

sap17
Posts: 7
Joined: 29 May 2012, 12:50

Re: Recover Accidentally Erased?Wiped Partition

#8 Post by sap17 »

Since I could not see the attached file I am pasting it .



Wed May 30 19:19:31 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-05-21T08:46:51
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=429499419648
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=570595866624
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST31000524AS, S/N:202020202020202020202020563943504a5a5050, FW:JC4B

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - ST31000524AS
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 222 31 838866054
3 E extended LBA 52230 0 1 121600 254 63 1114445115
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
search_vista_part: 1

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 838866054
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 52229 222 31 838866054
NTFS, blocksize=4096, 429 GB / 400 GiB
check_part_i386 failed for partition type 07
HPFS - NTFS 52230 1 1 121600 254 63 1114445052
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525317(121601/83/24)) lseek err Invalid argument
file_pread(4,8,buffer,1953525445(121601/85/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525573(121601/87/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525701(121601/89/30)) lseek err Invalid argument
file_pread(4,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(4,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(4,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(4,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB
P HPFS - NTFS 52230 1 1 121600 254 63 1114445052

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 236 39 838866944
3 P HPFS - NTFS 52230 1 1 121600 254 63 1114445052
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 222 31 838866054
3 E extended LBA 52230 0 1 121600 254 63 1114445115
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
search_vista_part: 1

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 838866054
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 52229 222 31 838866054
NTFS, blocksize=4096, 429 GB / 400 GiB
check_part_i386 failed for partition type 07
HPFS - NTFS 52230 1 1 121600 254 63 1114445052
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525317(121601/83/24)) lseek err Invalid argument
file_pread(4,8,buffer,1953525445(121601/85/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525573(121601/87/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525701(121601/89/30)) lseek err Invalid argument
file_pread(4,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(4,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(4,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(4,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB
P HPFS - NTFS 52230 1 1 121600 254 63 1114445052

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 236 39 838866944
3 P HPFS - NTFS 52230 1 1 121600 254 63 1114445052
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 222 31 838866054
3 E extended LBA 52230 0 1 121600 254 63 1114445115
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
search_vista_part: 1

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 838866054
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 52229 222 31 838866054
NTFS, blocksize=4096, 429 GB / 400 GiB
check_part_i386 failed for partition type 07
HPFS - NTFS 52230 1 1 121600 254 63 1114445052
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525317(121601/83/24)) lseek err Invalid argument
file_pread(4,8,buffer,1953525445(121601/85/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525573(121601/87/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525701(121601/89/30)) lseek err Invalid argument
file_pread(4,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(4,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(4,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(4,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB
P HPFS - NTFS 52230 1 1 121600 254 63 1114445052

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 236 39 838866944
3 P HPFS - NTFS 52230 1 1 121600 254 63 1114445052

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 838866054
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 52229 222 31 838866054
NTFS, blocksize=4096, 429 GB / 400 GiB
Search for partition aborted

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 236 39 838866944
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - ST31000524AS
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 222 31 838866054
3 E extended LBA 52230 0 1 121600 254 63 1114445115
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
5 L HPFS - NTFS 52230 1 1 121600 254 63 1114445052
search_vista_part: 1

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 838866054
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 52229 222 31 838866054
NTFS, blocksize=4096, 429 GB / 400 GiB
check_part_i386 failed for partition type 07
HPFS - NTFS 52230 1 1 121600 254 63 1114445052
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525317(121601/83/24)) lseek err Invalid argument
file_pread(4,8,buffer,1953525445(121601/85/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525573(121601/87/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525701(121601/89/30)) lseek err Invalid argument
file_pread(4,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(4,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(4,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(4,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(4,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB
P HPFS - NTFS 52230 1 1 121600 254 63 1114445052

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 52229 236 39 838866944
3 P HPFS - NTFS 52230 1 1 121600 254 63 1114445052
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 838866054
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 52229 222 31 838866054
NTFS, blocksize=4096, 429 GB / 400 GiB
NTFS at 52102/146/13
filesystem size 2045952
sectors_per_cluster 8
mft_lcn 85248
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 52102 146 13 52229 236 39 2045952 [New Volume]
NTFS, blocksize=4096, 1047 MB / 999 MiB
NTFS at 52229/236/39
filesystem size 2045952
sectors_per_cluster 8
mft_lcn 85248
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 52102 146 13 52229 236 39 2045952 [New Volume]
NTFS found using backup sector, blocksize=4096, 1047 MB / 999 MiB
check_part_i386 failed for partition type 07
HPFS - NTFS 52230 1 1 121600 254 63 1114445052
BAD_RS LBA=2806629033 9285965
file_pread(4,3,buffer,2806629033(174704/147/13)) lseek err Invalid argument
file_pread(4,1,buffer,2806629033(174704/147/13)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 174704 147 13 230105 137 6 890016429
This partition ends after the disk limits. (start=2806629033, size=890016429, end=3696645461, disk end=1953525168)
NTFS at 121600/254/63
filesystem size 1114445052
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 52230 1 1 121600 254 63 1114445052 [DATA]
NTFS found using backup sector, blocksize=4096, 570 GB / 531 GiB
NTFS at 121601/25/24
filesystem size 1953314816
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525189(121601/81/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525317(121601/83/24)) lseek err Invalid argument
file_pread(4,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,1953525445(121601/85/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,1953525573(121601/87/28)) lseek err Invalid argument
file_pread(4,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,1953525701(121601/89/30)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1892 GB / 1762 GiB)
The following partition can't be recovered:
FAT16 <32M 174704 147 13 230105 137 6 890016429
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=255 nbr=4

Results
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
HPFS - NTFS 12 223 19 25 159 5 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB
HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 52102 146 13 52229 236 39 2045952 [New Volume]
NTFS, blocksize=4096, 1047 MB / 999 MiB
HPFS - NTFS 52230 1 1 121600 254 63 1114445052 [DATA]
NTFS found using backup sector, blocksize=4096, 570 GB / 531 GiB
HPFS - NTFS 52230 1 1 121600 254 63 1114445052


dir_partition inode=5
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
Directory /
5 dr-xr-xr-x 0 0 0 1-Apr-2012 04:07 .
5 dr-xr-xr-x 0 0 0 1-Apr-2012 04:07 ..
35 dr-xr-xr-x 0 0 0 4-Aug-2011 17:19 Boot
85 -r--r--r-- 0 0 383786 20-Nov-2010 18:10 bootmgr
96 -r--r--r-- 0 0 8192 4-Aug-2011 12:35 BOOTSECT.BAK
97 dr-xr-xr-x 0 0 0 10-Oct-2011 20:27 System Volume Information
102 -r--r--r-- 0 0 401620 1-Apr-2012 04:07 YORTD
Not an exFAT boot sector.

HPFS - NTFS 12 223 19 25 159 5 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
HPFS - NTFS 12 223 20 52229 236 39 838866944
NTFS, blocksize=4096, 429 GB / 400 GiB
Directory /
5 dr-xr-xr-x 0 0 0 29-May-2012 19:42 .
5 dr-xr-xr-x 0 0 0 29-May-2012 19:42 ..
57589 dr-xr-xr-x 0 0 0 21-Aug-2011 04:10 $Recycle.Bin
129904 dr-xr-xr-x 0 0 0 2-Feb-2012 11:39 AMD
17459 dr-xr-xr-x 0 0 0 6-Sep-2011 00:15 ATI
876 dr-xr-xr-x 0 0 0 29-May-2012 14:48 Config.Msi
71261 dr-xr-xr-x 0 0 0 14-Jul-2009 10:38 Documents and Settings
126164 dr-xr-xr-x 0 0 0 29-May-2012 14:05 downloads
2206 dr-xr-xr-x 0 0 0 14-Aug-2011 21:51 Drivers
91933 -r--r--r-- 0 0 3195383808 30-May-2012 18:27 hiberfil.sys
117910 dr-xr-xr-x 0 0 0 18-Sep-2011 17:39 Intel
162926 dr-xr-xr-x 0 0 0 29-May-2012 13:58 Log
40110 dr-xr-xr-x 0 0 0 1-Apr-2012 03:20 MGADiagToolOutput
159890 dr-xr-xr-x 0 0 0 23-May-2012 02:10 MML_2.0.1.3
34965 dr-xr-xr-x 0 0 0 4-Aug-2011 18:49 MSOCache
127258 dr-xr-xr-x 0 0 0 28-May-2012 07:35 New folder
5619 -r--r--r-- 0 0 4260511744 30-May-2012 18:27 pagefile.sys
57601 dr-xr-xr-x 0 0 0 14-Jul-2009 08:50 PerfLogs
57603 dr-xr-xr-x 0 0 0 29-May-2012 19:38 Program Files
39956 dr-xr-xr-x 0 0 0 31-Aug-2011 11:22 Program Files (x64)
57816 dr-xr-xr-x 0 0 0 29-May-2012 19:37 Program Files (x86)
57932 dr-xr-xr-x 0 0 0 27-May-2012 21:39 ProgramData
118781 dr-xr-xr-x 0 0 0 3-Aug-2011 22:33 RaidTool
115408 dr-xr-xr-x 0 0 0 3-Aug-2011 22:14 Recovery
21335 -r--r--r-- 0 0 11033 31-Aug-2011 07:50 Setup Log.txt
57599 dr-xr-xr-x 0 0 0 22-Jan-2012 12:31 System Volume Information
155036 dr-xr-xr-x 0 0 0 30-May-2012 18:47 Temp
58026 dr-xr-xr-x 0 0 0 21-Aug-2011 04:10 Users
58188 dr-xr-xr-x 0 0 0 29-May-2012 13:58 Windows


dir_partition inode=5
HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 29-May-2012 19:42 .
5 dr-xr-xr-x 0 0 0 29-May-2012 19:42 ..
57589 dr-xr-xr-x 0 0 0 21-Aug-2011 04:10 $Recycle.Bin
129904 dr-xr-xr-x 0 0 0 2-Feb-2012 11:39 AMD
17459 dr-xr-xr-x 0 0 0 6-Sep-2011 00:15 ATI
876 dr-xr-xr-x 0 0 0 29-May-2012 14:48 Config.Msi
71261 dr-xr-xr-x 0 0 0 14-Jul-2009 10:38 Documents and Settings
126164 dr-xr-xr-x 0 0 0 29-May-2012 14:05 downloads
2206 dr-xr-xr-x 0 0 0 14-Aug-2011 21:51 Drivers
91933 -r--r--r-- 0 0 3195383808 30-May-2012 18:27 hiberfil.sys
117910 dr-xr-xr-x 0 0 0 18-Sep-2011 17:39 Intel
162926 dr-xr-xr-x 0 0 0 29-May-2012 13:58 Log
40110 dr-xr-xr-x 0 0 0 1-Apr-2012 03:20 MGADiagToolOutput
159890 dr-xr-xr-x 0 0 0 23-May-2012 02:10 MML_2.0.1.3
34965 dr-xr-xr-x 0 0 0 4-Aug-2011 18:49 MSOCache
127258 dr-xr-xr-x 0 0 0 28-May-2012 07:35 New folder
5619 -r--r--r-- 0 0 4260511744 30-May-2012 18:27 pagefile.sys
57601 dr-xr-xr-x 0 0 0 14-Jul-2009 08:50 PerfLogs
57603 dr-xr-xr-x 0 0 0 29-May-2012 19:38 Program Files
39956 dr-xr-xr-x 0 0 0 31-Aug-2011 11:22 Program Files (x64)
57816 dr-xr-xr-x 0 0 0 29-May-2012 19:37 Program Files (x86)
57932 dr-xr-xr-x 0 0 0 27-May-2012 21:39 ProgramData
118781 dr-xr-xr-x 0 0 0 3-Aug-2011 22:33 RaidTool
115408 dr-xr-xr-x 0 0 0 3-Aug-2011 22:14 Recovery
21335 -r--r--r-- 0 0 11033 31-Aug-2011 07:50 Setup Log.txt
57599 dr-xr-xr-x 0 0 0 22-Jan-2012 12:31 System Volume Information
155036 dr-xr-xr-x 0 0 0 30-May-2012 18:47 Temp
58026 dr-xr-xr-x 0 0 0 21-Aug-2011 04:10 Users
58188 dr-xr-xr-x 0 0 0 29-May-2012 13:58 Windows


dir_partition inode=5
HPFS - NTFS 52102 146 13 52229 236 39 2045952 [New Volume]
NTFS, blocksize=4096, 1047 MB / 999 MiB
Directory /
5 dr-xr-xr-x 0 0 0 27-May-2012 13:29 .
5 dr-xr-xr-x 0 0 0 27-May-2012 13:29 ..
NTFS filesystem need to be repaired.


dir_partition inode=5
HPFS - NTFS 52230 1 1 121600 254 63 1114445052 [DATA]
NTFS found using backup sector, blocksize=4096, 570 GB / 531 GiB
ntfs_readdir failed
Directory /
5 dr-xr-xr-x 0 0 0 27-May-2012 11:38 .
5 dr-xr-xr-x 0 0 0 27-May-2012 11:38 ..
711 dr-xr-xr-x 0 0 0 31-Aug-2011 11:19 HTC
Not an exFAT boot sector.
Not an exFAT boot sector.

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

sap17
Posts: 7
Joined: 29 May 2012, 12:50

Re: Recover Accidentally Erased?Wiped Partition

#9 Post by sap17 »

Dear Fiona, During the test the files of the damaged partition could not be seen as the option "p" would not come up when I selected the damaged/erased partition. What next? This not with standing I am impressed with the knowledge possessed by you and Daniel. Thanks for taking out time to assist me and please do let me know if I can reciprocate in any way. Regards SAP

sap17
Posts: 7
Joined: 29 May 2012, 12:50

Re: Recover Accidentally Erased?Wiped Partition

#10 Post by sap17 »

Dear Fiona, Waiting for further assistance.

Locked