Going through the the TestDisk process

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
geordielad007
Posts: 7
Joined: 20 Feb 2021, 14:47

Going through the the TestDisk process

#1 Post by geordielad007 »

Hi Guys and ladies.

Bit of a background as to why and how I am where I am.

So I have a HP G6 pavilion laptop and one night my can of Guiness decide to pick a fight with the keyboard. I thought I was pretty quick to resolve the dispute by removing the guiness from the keyboard. Alas that was never to be the case. Everytime I clicked onto a dialoge window there would be a string of 3's appearing. So, I shutdown the laptop by the dreaded power button, as this was the only option. I then powered up the laptop and once again a string of 3's appeared in my password. So I closed the laptop down and decided I needed to sort out the keyboard. Looked on you tube and followed the instructions of the video. Disconnected the power, but did not remove the battery. Saw some possible Guiness contamination around power button components and cleaned.

The short of it is the laptop would not switch on.

So I went down the rabbit hole in search of my lost data. Fitted my laptop Hitachi 1TB HDD to my other laptop. However, whilst the beep gave an audible indication that it had been fitted, the drives were not shown in windows explorer; though the Disk Management showed it as a 931GB unallocated drive.

So purchased the EaseRUS and ran that, took pretty much a day for the analyses to complete. I thought great can see a load of important named folders and sub folders and named files. After saving a load of the folders, sub folders and files to an external hard drive, I could open docs, but they were all egyption and tried various ecncoders without success. However most noteably all photos and pictures were okay. I'm probably boring you now, but I then purchased disk raid internals and again I am further down the rabbit hole and looks like I have manged to now have readable PDFs, excels and docs.

But I wanted to go the extra mile and download the TestDisk software and it has been running for probably about 36 hours with 41% complete, not so much worried about that, as I have read some of Recuperation's posts.

I don't wish anyone one to spend a huge amount of time on this, but I do have a few questions, for re-assurance I guess.

1. Given the information below as a copy of the disk recovery at 41 % is this pretty normal, is it likely to be successful. My HDD partition was as I remember it
2. There is an extreme possibility that after I partitioned the drive in windows 7 and before the upgrade (which was/is windows 10 upgraded), that I deleted any created files in those drives,
without the experience or knowledge of the purpose fo those files/

C:\ approx 250GB
D:\ recovery
G:\ approx 300GB
H:\ approx 300GB

Analyse cylinder 6305/15199: 41% MS Data 8666092 48439531 39773440 em Partition] [SYSTEM]
MS Data bytes per sector mismatches 512 (NTFS) != 4096 (HD)
MS D6ta 621 920732 48981081 39773440
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
MS Data 6414800 11685840 5271040
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
MS Data 474142 474913 771 [Boot]
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD))
ccheck_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 2 (NTFS) != 63 (HD)
WaMS Datanumber of bytes p84868096 234751743 149883648 [DATA]96 (HD)
MS Data


Any small advice or explanation would be appreciated

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Going through the the TestDisk process

#2 Post by recuperation »

I can't find a question.
Please post your log file.

geordielad007
Posts: 7
Joined: 20 Feb 2021, 14:47

Re: Going through the the TestDisk process

#3 Post by geordielad007 »

I have searched through the tesdisk folder and there is no log file. The test disk recovery analysis is ongoing and is at 41%. It has been on 41% for over 12 hours now, but there is activity continuing.

The command DOS window I have shown in my previous post, and are in Italics.

I am hoping to recover the harddrive and get back as reasonably possible to its original state,
with the aid of this program

1. Am I wasting my time.
2. What happens on completion of the analysis.
3. Is the log file created on completion of the analysis or before.

The laptop harddrive at the moment is in a case connected via USB to my computer USB3 port. I do have a docking station, however this also USB.

1. Would I be better of with a docking station that has a USB3 output.
2. Would the speed of serial communication still be limited by the laptop hard drive.

Statement I do not hold anybody responsible for the advice that is given. I take full responsibility of my actions based on others advice.

geordielad007
Posts: 7
Joined: 20 Feb 2021, 14:47

Re: Going through the the TestDisk process

#4 Post by geordielad007 »

Okay, having watched some You tube videos, I realised I was running the TestDisk program from the very hard drive I was analysing. So I have stopped the program and deleted it from that drive.
I am now running testdisk from a separate drive and have selected create a log file. So, I am now at the stage of going through the analysis again.

In short I probably don't need for anybody to waste time on my earlier questions. Just thought I would this in case anybody else has done the same mistake as myself.

I will post again when the analysis is complete.

geordielad007
Posts: 7
Joined: 20 Feb 2021, 14:47

Re: Going through the the TestDisk process

#5 Post by geordielad007 »

Okay I have completed the analysis and it has been stored in the test log file.

I wish to rebuild the hard drive but not too sure how to proceed, if I lose data then I am not too concerned.
However, I am hoping that I can fix this with test disk.

Could anyone give some advice on how best to proceed.
testdisk.log
(20.45 KiB) Downloaded 271 times
The above is the log

geordielad007
Posts: 7
Joined: 20 Feb 2021, 14:47

Re: Going through the the TestDisk process

#6 Post by geordielad007 »

So, another mistake I have made is I ran the test disk from my new Samsung 500GB SSD computer.

I then did a successful analysis of the Laptop hard disk and tried t o re-write to the hard disk, which produced an error.
So then I thought well might as well copy the drives, however you do not get the option to save it to an external hard drive.
So now I am running the analaysis from a 2TB hard drive and hopefully I should be able to copy the partitions from a
1TB laptop hard disk onto the 2TB external hard disk, however it appears to use the sub folder path name Testdisk etc

Is it going to be a problem saving drives in the sub folders

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Going through the the TestDisk process

#7 Post by recuperation »

Having finished the quick search you could walk through your partition list and use the "p"-key (list files) to see if the partition contains readable content. You could then copy your content to another drive.

As your log contains a list of CRC errors I would install smartmontools.
Please check the SMART parameters with smartmontools running smartctl -a /dev/sdX.
X stands for the label of your Intenso drive.

You can write the analysis directly into a file by using
smartctl -a /dev/sdX > c:\mylog.txt
on a windows machine. You might have to run it as an administrator.
For externally connected drives using a USB connection read here:
viewtopic.php?p=28640#p28640

Please post your smartmontools log file here.

If your drive is dammaged acording to the log file there is a decision to be made how to proceed with recovery.
Depending on how far your disk is filled with files you either copy files and folder using Testdisk or in a case of a full disk rather duplicate your disk to a healthy one.

The idea is to minimize stressing a possibly dammaged disk.
geordielad007 wrote: 21 Feb 2021, 18:38 Is it going to be a problem saving drives in the sub folders
That is pretty unspecific statement lacking details.

geordielad007
Posts: 7
Joined: 20 Feb 2021, 14:47

Re: Going through the the TestDisk process

#8 Post by geordielad007 »

Okay I installed the smartmontools, tried to run it with my external drive putting in SMARTCTL -a /dev/sdh and it didn't work. So I tried smartctl -a /dev/sda and this worked for my C drive on this laptop.

I tried various options, but couldn't get the tool to work.

Before I carried out fault finding; this laptop showed duplicate drives in windows explorer for the same drive, i.e. H drive would be seen as part of the PC
in windows explorer and be duplicated as an external drive. So I deleted this entry from the registry, which is not a problem, because I can put it back in.

I have administrator rights on the external drives.

1. Why is my laptop C drive SDA.

2. If I revert back to my original registry, how do I show all the drives connected to the laptop in SMARTMONTOOLS.

3. My external corrupted hard drive is connected, what are the commands to reveal the drive in SMARTMONTOOLS

recuperation
Posts: 2721
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Going through the the TestDisk process

#9 Post by recuperation »

geordielad007 wrote: 22 Feb 2021, 20:48 Okay I installed the smartmontools, tried to run it with my external drive putting in SMARTCTL -a /dev/sdh and it didn't work. So I tried smartctl -a /dev/sda and this worked for my C drive on this laptop.
No, this command applies to a drive but not to your "C"-volume regardless of the fact, that your "C"-volume assumably resides on drive sda.
You have to distinguish between drives and partitions or volumes.


I tried various options, but couldn't get the tool to work.
I don't know what "various" means. Did you check the link?
Before I carried out fault finding; this laptop showed duplicate drives in windows explorer for the same drive, i.e. H drive would be seen as part of the PC
in windows explorer and be duplicated as an external drive. So I deleted this entry from the registry, which is not a problem, because I can put it back in.
I don't understand. Posting a picture of your problem could simplify my life.
I have administrator rights on the external drives.

1. Why is my laptop C drive SDA.
It is not - see explanation above.

2. If I revert back to my original registry, how do I show all the drives connected to the laptop in SMARTMONTOOLS.
I would simply increment the drive letter in "smartctl -a /dev/sdX".

3. My external corrupted hard drive is connected, what are the commands to reveal the drive in SMARTMONTOOLS
See point 2.
in Windows you should see your drive in disk management, in linux run the lsblk command.

Locked