Recovering OS Drive that shows RAW for a file system after power outage

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
harobikes
Posts: 4
Joined: 11 Sep 2022, 01:16

Recovering OS Drive that shows RAW for a file system after power outage

#1 Post by harobikes »

Firstly, I'd like to thank Christophe for making such an amazing program.
My computer went into a blue screen "Startup Repair cannot repair this computer automatically" loop & I've been researching how to fix it.
I followed the directions in the PDF guide and was able to make a FEDORA Live Bootable USB Drive & install TestDisk via Root by using sudo.
I analyzed the SSD that had stopped booting Windows 10 & got a notice stating the HDD seems too small??
Image Image
I pressed enter / continue, and it analyzed the SSD to reveal numerous Partitions. marked deleted? Only the top selection defaulted as showing "P" Primary.
Image --> Image
Pressing "P"
Three of them appear to be almost identical and contain all my USER files, when I press P to list files.
How do I determine which one I should Un-delete?
All three appear to start at the same sector but end at different sectors..?
The first selected shows:
NTFS, Blocksize =4096, 498 GB / 464 GB
2nd shows: NTFS found using backup sector, blocksize=4096, 498 GB / 464GiB
3rd shows: NTFS found using backup sector, blocksize=4096, 499GB / 465GiB
See screen shots:
1st
Image
2nd
Image
3rd
Image
I should change one of them to "P" Primary, correct?
Then do I press L to "load backup" ? or Enter to continue...? I'm unsure what to do from here onward.
The smaller ~500 MB partions had 2 of 3 corrupt:
Image
Image
Image --> Image
Image --> Image
I apologize for all the screenshots, I just wanted to be as clear as possible.
Anyone's help is greatly appreciated.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering OS Drive that shows RAW for a file system after power outage

#2 Post by recuperation »

Well, it's worth writing how your drive was partitioned before.

harobikes
Posts: 4
Joined: 11 Sep 2022, 01:16

Re: Recovering OS Drive that shows RAW for a file system after power outage

#3 Post by harobikes »

I simply had one main partition with my OS and all my data.
The other partitions I believe were created when I tried to migrated my data over from a Windows Vista computer years ago?
I didn't really know what the other hidden partitions were for so I left them alone & they only took up ~500 MB sections.
Here's the information about the Internal SSD I'm attempting to make bootable by using the testdrive /list command:
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Sector size:512
Model: Samsung SSD 850 EVO 500GB, S/N:S3PTNF0JB13717B, FW:EMT03B6Q
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
1 P MS Data 2048 1026047 1024000 [System Reserved]
NTFS, blocksize=4096
2 P MS Data 1026048 974536142 973510095
NTFS, blocksize=4096
3 P Windows Recovery Env 974536704 975601663 1064960
4 P EFI System 975603712 975808511 204800
5 P Windows Recovery Env 975808512 976769023 960512

I appreciate the replies.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering OS Drive that shows RAW for a file system after power outage

#4 Post by recuperation »

Please provide your testdisk logfile of a session that included a deep search.

harobikes
Posts: 4
Joined: 11 Sep 2022, 01:16

Re: Recovering OS Drive that shows RAW for a file system after power outage

#5 Post by harobikes »

In order to get to the deep search menu, I believe I must press Enter to continue from this screen. Does this save my changes to the partitions..?
Do I need to change any of the partitions yet from D to P? None of them give me the option to change them to *bootable.
In the example screen shot below, I've changed the partition that I believe to contain all my system files, etc. to P and also the EFI System Partition to P... though the EFI partition hasn't been modified since 16-Sep-2020 so I'm unsure if I need it?? Googling suggests that I'm required to have an EFI partition to have a bootable Windows 10 disk..?
Image
Your advice is greatly appreciated.
I took the dive and pressed enter & am currently doing the deep search*

Here's the result of the deep search:
Image
Lots of MAC HFS partitions...? I've never had any sort of MAC related dealings on this computer.
At the bottom of the results there are x5 that are tagged MS Data
Image
Image
Image


The Test log is extremely log & won't let me paste it here so I've saved the text here: https://justpaste.it/3yek7

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering OS Drive that shows RAW for a file system after power outage

#6 Post by recuperation »

harobikes wrote: 11 Sep 2022, 06:44 Firstly, I'd like to thank Christophe for making such an amazing program.
My computer went into a blue screen "Startup Repair cannot repair this computer automatically" loop & I've been researching how to fix it.
I followed the directions in the PDF guide and was able to make a FEDORA Live Bootable USB Drive & install TestDisk via Root by using sudo.
I analyzed the SSD that had stopped booting Windows 10 & got a notice stating the HDD seems too small??
Image Image
I pressed enter / continue, and it analyzed the SSD to reveal numerous Partitions. marked deleted? Only the top selection defaulted as showing "P" Primary.
Image --> Image
Pressing "P"
Three of them appear to be almost identical and contain all my USER files, when I press P to list files.
How do I determine which one I should Un-delete?
All three appear to start at the same sector but end at different sectors..?
The first selected shows:
NTFS, Blocksize =4096, 498 GB / 464 GB
2nd shows: NTFS found using backup sector, blocksize=4096, 498 GB / 464GiB
3rd shows: NTFS found using backup sector, blocksize=4096, 499GB / 465GiB
See screen shots:
1st
Image
2nd
Image
3rd
Image
I should change one of them to "P" Primary, correct?
Then do I press L to "load backup" ? or Enter to continue...? I'm unsure what to do from here onward.
The smaller ~500 MB partions had 2 of 3 corrupt:
Image
Image
Image --> Image
Image --> Image
I apologize for all the screenshots, I just wanted to be as clear as possible.
Anyone's help is greatly appreciated.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering OS Drive that shows RAW for a file system after power outage

#7 Post by recuperation »

harobikes wrote: 11 Sep 2022, 06:44 Firstly, I'd like to thank Christophe for making such an amazing program.
My computer went into a blue screen "Startup Repair cannot repair this computer automatically" loop & I've been researching how to fix it.
I followed the directions in the PDF guide and was able to make a FEDORA Live Bootable USB Drive & install TestDisk via Root by using sudo.
I analyzed the SSD that had stopped booting Windows 10 & got a notice stating the HDD seems too small??
Image Image
I pressed enter / continue, and it analyzed the SSD to reveal numerous Partitions. marked deleted? Only the top selection defaulted as showing "P" Primary.
Image --> Image
Pressing "P"
Three of them appear to be almost identical and contain all my USER files, when I press P to list files.
How do I determine which one I should Un-delete?
All three appear to start at the same sector but end at different sectors..?
The first selected shows:
NTFS, Blocksize =4096, 498 GB / 464 GB
2nd shows: NTFS found using backup sector, blocksize=4096, 498 GB / 464GiB
3rd shows: NTFS found using backup sector, blocksize=4096, 499GB / 465GiB
See screen shots:
1st
Image
2nd
Image
3rd
Image
I should change one of them to "P" Primary, correct?
Then do I press L to "load backup" ? or Enter to continue...? I'm unsure what to do from here onward.
The smaller ~500 MB partions had 2 of 3 corrupt:
Image
The three big entries provide you with three choices. Normally I would have select the third option in order to maximize the space. But the logfile reports problems for choice 2 and 3 if I read that correctly. The second choice already would overlap with the four last partitions which leaves the first entry to set to "primary".


I don't understand why the EFI partition is positioned in the back area of the disk.
Normally it is one of the first partitions.
If you are booting in UEFI mode I assume the EFI partition is required so set it to "primary".
The last and the third last entry are Windows recovery partitions. Switching the third last partition to "primary" would overlap it with the following EFI partition by one sector.
Therefore I would set the the last entry to primary and leave the third last as "deleted".

The log mentions a dirty NTFS volume. You would probably need to run chkdsk on your big main partition.
After all I would duplicate the Samsung EVO 850 500GB using ddrescue as described in the manual before doing all modifications.
If you access the drive in Linux you can mount them read only and there is no risk of Windows writing on one of your partitions even without your intervention.

There are so many partitions. Is your disk filled up with virtual drive images?

harobikes
Posts: 4
Joined: 11 Sep 2022, 01:16

Re: Recovering OS Drive that shows RAW for a file system after power outage

#8 Post by harobikes »

I haven't ever had a virtual disk image on this SSD :/ Unsure why there's multiple partitions found? I migrated the computer from windows Vista years ago... maybe that had something to do with it...?
I backed up an image of the SSD using ddrescue as you recommended and ran chkdsk on the disc.
I am attempting to do what you suggested:
When I did this:
Image and selected WRITE the partition structure...
I got a black screen that said: Reboot & select proper boot device.
Would it because I have both the top partition and the EFI partition selected at the same time?
When I go into the boot sector utility, all three partitions show OK boot sectors..?
Any advice is greatly appreciated.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering OS Drive that shows RAW for a file system after power outage

#9 Post by recuperation »

I can't help you with repairing a failed Windows 10 installation other than repairing the partition table.
I have no experience with the Windows 10 boot process. I don't use Windows 10.
I can only recommend you using the repair installation mode of your Windows.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering OS Drive that shows RAW for a file system after power outage

#10 Post by recuperation »

harobikes wrote: 11 Oct 2022, 05:38 Would it because I have both the top partition and the EFI partition selected at the same time?
No. The partitioned are not selected. As they are simply not deleted anymore they are kind of active - not to be confused with "active partition".
The three active partitions do not overlap, that is important.

Locked