Lost partition not written after reboot Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Legionella
Posts: 3
Joined: 01 Aug 2020, 02:49

Lost partition not written after reboot

#1 Post by Legionella »

Greetings,

As I'm sure many people do here, I come asking for help repairing an HDD whose only partition became "unallocated space" without a clear reason. I have been able to list the files with testdisk and the ones i have extracted appear to have sufficient integrity. Unfortunately this was a 1 TB drive and I do not currently own any other drives of that size to which I can offload the data, so before I went and spent money on one I wanted to try and repair the partition if it's possible. TestDisk successfully finds it in quick search, and when I ask to write partition it simply says the drive must be rebooted for the change to take effect. The space remains unallocated however. The log is below

Code: Select all

 

Fri Jul 31 20:42:01 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204881920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=92613025792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204881920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=92613025792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=494586036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - PNY CS900 500GB SSD, S/N:PNY09202280040408798, FW:CS900613
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Seagate Expansion Desk, S/N:16CC4256B1NA, FW:0604
Disk /dev/sdc - 92 GB / 86 GiB - CHS 1407 255 63, sector size=4096 - MSFT XVDD, FW:1.0
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Seagate Expansion Desk, S/N:16CC4256B1NA, FW:0604
Disk \\.\PhysicalDrive2 - 92 GB / 86 GiB - CHS 1407 255 63, sector size=4096 - MSFT XVDD, FW:1.0
Drive D: - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Seagate Expansion Desk, S/N:16CC4256B1NA, FW:0604

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - Seagate Expansion Desk
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 1953519616, partition 244189952
Current partition structure:
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
 1 * HPFS - NTFS              0   4  5 15200  35  3  244189952 [Noah's Ark]

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   4  5 15200  35  3  244189952 [Noah's Ark]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,1,buffer,244190719(15200/43/11)) lseek err Invalid argument
file_pread(5,1,buffer,244190720(15200/43/12)) lseek err Invalid argument
file_pread(5,1,buffer,244190656(15200/42/11)) lseek err Invalid argument
file_pread(5,1,buffer,244190672(15200/42/27)) lseek err Invalid argument
file_pread(5,1,buffer,244190688(15200/42/43)) lseek err Invalid argument
file_pread(5,1,buffer,244190704(15200/42/59)) lseek err Invalid argument
file_pread(5,1,buffer,244190720(15200/43/12)) lseek err Invalid argument
file_pread(5,1,buffer,244190721(15200/43/13)) lseek err Invalid argument
file_pread(5,1,buffer,244190722(15200/43/14)) lseek err Invalid argument
file_pread(5,2,buffer,244190727(15200/43/19)) lseek err Invalid argument
file_pread(5,2,buffer,244190729(15200/43/21)) lseek err Invalid argument
file_pread(5,3,buffer,244190735(15200/43/27)) lseek err Invalid argument
file_pread(5,1,buffer,244190976(15200/47/16)) lseek err Invalid argument

Results
   * HPFS - NTFS              0   4  5 15200  35  3  244189952 [Noah's Ark]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
   
As of right now, I'm in a new computer which I'm certain has no running antiviruses and I have so far failed to find a similar log error in posts about similar issues. Is there something I'm missing?

Thank you for your time and your excellent software!

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Lost partition not written after reboot

#2 Post by recuperation »

Relying on a repair of a faulty drive is too risky to be recommended!

In your case it looks like the sector size of 4096 is not reflected in the boot sector.
Usually drives with a sector size of 4096 come with an emulation of 512 byte.
Did you duplicate this drive from another one?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Lost partition not written after reboot

#3 Post by cgrenier »

As reparation asks, do you clone your disk, move this disk from another computer or replace your computer motherboard ?

Assuming the disk will not move to another computer, the partition is correctly listed in the partition table.

Run TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files,
- choose Write, confirm, Quit
- Restart your computer.
- Run "cmd" (right click "Run as Administrator" and type "chkdsk /f d:" (replace d: by the correct drive letter)

Legionella
Posts: 3
Joined: 01 Aug 2020, 02:49

Re: Lost partition not written after reboot

#4 Post by Legionella »

Relying on a repair of a faulty drive is too risky to be recommended!

In your case it looks like the sector size of 4096 is not reflected in the boot sector.
Usually drives with a sector size of 4096 come with an emulation of 512 byte.
Did you duplicate this drive from another one?
I understand, I was hoping the drive itself would be repairable. It is not duplicated and I'm not sure about the sector size or why it might not be reflected in the boot sector. Is this something I have any capacity to change?

As reparation asks, do you clone your disk, move this disk from another computer or replace your computer motherboard ?

Assuming the disk will not move to another computer, the partition is correctly listed in the partition table.

Run TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files,
- choose Write, confirm, Quit
- Restart your computer.
- Run "cmd" (right click "Run as Administrator" and type "chkdsk /f d:" (replace d: by the correct drive letter)
I am moving this disk, which was my former second hard drive (not for booting, just file storage) to a second computer with a smaller SSD.

I tried doing the chkdsk but it says this is not possible for RAW drives.

Thank you both again for all your kind help.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Lost partition not written after reboot

#5 Post by recuperation »

Legionella wrote: 01 Aug 2020, 23:41
Relying on a repair of a faulty drive is too risky to be recommended!

In your case it looks like the sector size of 4096 is not reflected in the boot sector.
Usually drives with a sector size of 4096 come with an emulation of 512 byte.
Did you duplicate this drive from another one?
I understand, I was hoping the drive itself would be repairable. It is not duplicated and I'm not sure about the sector size or why it might not be reflected in the boot sector. Is this something I have any capacity to change?
Yes, by following the advice given by cgrenier.
Duplicated drives need certain adjustments to run properly when the sector size on the target is different from the source.
As reparation asks, do you clone your disk, move this disk from another computer or replace your computer motherboard ?

Assuming the disk will not move to another computer, the partition is correctly listed in the partition table.

Run TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files,
- choose Write, confirm, Quit
- Restart your computer.
- Run "cmd" (right click "Run as Administrator" and type "chkdsk /f d:" (replace d: by the correct drive letter)
I am moving this disk, which was my former second hard drive (not for booting, just file storage) to a second computer with a smaller SSD.
Do you mean physically moving or duplicating as you are talking about a "second computer with a smaller SSD"?
I tried doing the chkdsk but it says this is not possible for RAW drives.
Have you followed the proposal of cgrenier?

Legionella
Posts: 3
Joined: 01 Aug 2020, 02:49

Re: Lost partition not written after reboot

#6 Post by Legionella »

Legionella wrote: 01 Aug 2020, 03:00 Greetings,

As I'm sure many people do here, I come asking for help repairing an HDD whose only partition became "unallocated space" without a clear reason. I have been able to list the files with testdisk and the ones i have extracted appear to have sufficient integrity. Unfortunately this was a 1 TB drive and I do not currently own any other drives of that size to which I can offload the data, so before I went and spent money on one I wanted to try and repair the partition if it's possible. TestDisk successfully finds it in quick search, and when I ask to write partition it simply says the drive must be rebooted for the change to take effect. The space remains unallocated however. The log is below

Code: Select all

 

Fri Jul 31 20:42:01 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204881920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=92613025792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204881920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=92613025792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=494586036224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - PNY CS900 500GB SSD, S/N:PNY09202280040408798, FW:CS900613
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Seagate Expansion Desk, S/N:16CC4256B1NA, FW:0604
Disk /dev/sdc - 92 GB / 86 GiB - CHS 1407 255 63, sector size=4096 - MSFT XVDD, FW:1.0
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Seagate Expansion Desk, S/N:16CC4256B1NA, FW:0604
Disk \\.\PhysicalDrive2 - 92 GB / 86 GiB - CHS 1407 255 63, sector size=4096 - MSFT XVDD, FW:1.0
Drive D: - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Seagate Expansion Desk, S/N:16CC4256B1NA, FW:0604

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - Seagate Expansion Desk
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 1953519616, partition 244189952
Current partition structure:
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
 1 * HPFS - NTFS              0   4  5 15200  35  3  244189952 [Noah's Ark]

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 15200 255 63
NTFS at 0/4/5
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   4  5 15200  35  3  244189952 [Noah's Ark]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,1,buffer,244190719(15200/43/11)) lseek err Invalid argument
file_pread(5,1,buffer,244190720(15200/43/12)) lseek err Invalid argument
file_pread(5,1,buffer,244190656(15200/42/11)) lseek err Invalid argument
file_pread(5,1,buffer,244190672(15200/42/27)) lseek err Invalid argument
file_pread(5,1,buffer,244190688(15200/42/43)) lseek err Invalid argument
file_pread(5,1,buffer,244190704(15200/42/59)) lseek err Invalid argument
file_pread(5,1,buffer,244190720(15200/43/12)) lseek err Invalid argument
file_pread(5,1,buffer,244190721(15200/43/13)) lseek err Invalid argument
file_pread(5,1,buffer,244190722(15200/43/14)) lseek err Invalid argument
file_pread(5,2,buffer,244190727(15200/43/19)) lseek err Invalid argument
file_pread(5,2,buffer,244190729(15200/43/21)) lseek err Invalid argument
file_pread(5,3,buffer,244190735(15200/43/27)) lseek err Invalid argument
file_pread(5,1,buffer,244190976(15200/47/16)) lseek err Invalid argument

Results
   * HPFS - NTFS              0   4  5 15200  35  3  244189952 [Noah's Ark]
     NTFS, blocksize=4096, 1000 GB / 931 GiB
   
As of right now, I'm in a new computer which I'm certain has no running antiviruses and I have so far failed to find a similar log error in posts about similar issues. Is there something I'm missing?

Thank you for your time and your excellent software!
cgrenier wrote: 01 Aug 2020, 08:33 As reparation asks, do you clone your disk, move this disk from another computer or replace your computer motherboard ?

Assuming the disk will not move to another computer, the partition is correctly listed in the partition table.

Run TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files,
- choose Write, confirm, Quit
- Restart your computer.
- Run "cmd" (right click "Run as Administrator" and type "chkdsk /f d:" (replace d: by the correct drive letter)
I tried to unplug instead of restarting the system before the last post, sorry for taking your time. The steps outlined by cgrenier did the job! Thank you both so much! :D

Locked