My computer has a 256GB SSD (C:) with Windows installed and a 1.0TB (D:) hard disk. (both GPT)
The 256GB SSD has 4 partitions.
1. Recovery Partition
2. EFI System Partition
3. maybe OEM Partition
4. BitLocker Partition
The important thing is that since I installed Ubuntu on the D drive, Windows fell into an automatic repair loop.
So I checked the C drive with Ubuntu, the 4th BitLocker partition was showen as Free Space.
I ran EFI GPT>Analyse>Quick Search in Testdisk.
After the MS Data, EFI System, and Unknows partitions appear, only the MS Data and EFI System partitions remain when the process is finished.
After using Deeper Search more partitions appear, at the end of the process there are 5 MS Data and EFI System partitions left.
After going through the None>Analyse>Quick Search process, a partition named "Sys=0C" appears with "the following partitions can't be recovered" message.
I will be dumping the c drive soon using ddrescue. I want to recover the 4th BitLocker partition and boot windows again. What should I do?
Thanks.
Code: Select all
Sun Dec 4 20:23:32 2022
Command line: TestDisk
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.0-56-generic (#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022) x86_64
Compiler: GCC 11.2
ext2fs lib: 1.46.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
User is not root!
Hard disk list
TestDisk exited normally.
Using locale 'LC_CTYPE=en_US.UTF-8;LC_NUMERIC=ko_KR.UTF-8;LC_TIME=ko_KR.UTF-8;LC_COLLATE=en_US.UTF-8;LC_MONETARY=ko_KR.UTF-8;LC_MESSAGES=en_US.UTF-8;LC_PAPER=ko_KR.UTF-8;LC_NAME=ko_KR.UTF-8;LC_ADDRESS=ko_KR.UTF-8;LC_TELEPHONE=ko_KR.UTF-8;LC_MEASUREMENT=ko_KR.UTF-8;LC_IDENTIFICATION=ko_KR.UTF-8'.
Sun Dec 4 20:23:32 2022
Command line: TestDisk /debug
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.0-56-generic (#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022) x86_64
Compiler: GCC 11.2
ext2fs lib: 1.46.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 500118192 sectors
/dev/sda: user_max 500118192 sectors
/dev/sda: native_max 500118192 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 1953525168 sectors
/dev/sdb: user_max 1953525168 sectors
/dev/sdb: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop13 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SanDisk SD8SBAT256G1122, S/N:161015400171, FW:Z2333000
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - HGST HTS541010A9E680, S/N:JD1002DM27ARZK, FW:JA0OA560
Disk /dev/loop0 - 122 MB / 116 MiB - 238984 sectors (RO), sector size=512
Disk /dev/loop1 - 64 MB / 61 MiB - 126896 sectors (RO), sector size=512
Disk /dev/loop10 - 52 MB / 49 MiB - 101624 sectors (RO), sector size=512
Disk /dev/loop11 - 290 KB / 284 KiB - 568 sectors (RO), sector size=512
Disk /dev/loop12 - 311 KB / 304 KiB - 608 sectors (RO), sector size=512
Disk /dev/loop2 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop3 - 420 MB / 400 MiB - 820832 sectors (RO), sector size=512
Disk /dev/loop4 - 248 MB / 236 MiB - 484392 sectors (RO), sector size=512
Disk /dev/loop5 - 66 MB / 63 MiB - 129520 sectors (RO), sector size=512
Disk /dev/loop6 - 363 MB / 346 MiB - 709280 sectors (RO), sector size=512
Disk /dev/loop7 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop8 - 48 MB / 45 MiB - 93928 sectors (RO), sector size=512
Disk /dev/loop9 - 48 MB / 45 MiB - 94064 sectors (RO), sector size=512
Partition table type (auto): EFI GPT
Disk /dev/sda - 256 GB / 238 GiB - SanDisk SD8SBAT256G1122
Partition table type: EFI GPT
Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=500118191 (expected 500118191)
hdr_lba_start=34
hdr_lba_end=500118158
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
3 P MS Reserved 1288192 1320959 32768 [Microsoft reserved partition]
Current partition structure:
1 P Windows Recovery Env 2048 1085439 1083392 [Basic data partition]
2 P EFI System 1085440 1288191 202752 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Reserved 1288192 1320959 32768 [Microsoft reserved partition]
3 P MS Reserved 1288192 1320959 32768 [Microsoft reserved partition]
search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1085439 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
set_FAT_info: name from BS used
FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
EFI System 1085440 1288191 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 175387403 2359246504 2183859102
FATX, 1118 GB / 1041 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
Results
P MS Data 2048 1085439 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
P EFI System 1085440 1288191 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 1085440" | dmsetup create test1
interface_write()
1 P MS Data 2048 1085439 1083392
2 P EFI System 1085440 1288191 202752 [EFI System Partition] [NO NAME]
search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1085439 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
NTFS at 18/186/1
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 294715 300888 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 18/186/1
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 300888 307061 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 67/144/13
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1085439 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
NTFS at 67/144/13
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1085439 2168830 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
set_FAT_info: name from BS used
FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
EFI System 1085440 1288191 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
FAT32 at 67/144/20
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
FAT differs, FAT sectors=752-761/761
set_FAT_info: name from BS used
FAT32 at 67/144/20
FAT: cluster=2(0x2), pos=1093632
EFI System 1085440 1288191 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
FAT32 at 67/144/20
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
FAT differs, FAT sectors=752-761/761
set_FAT_info: name from BS used
FAT32 at 67/144/20
FAT: cluster=2(0x2), pos=1093638
FAT: cluster=771(0x303), pos=1095176
FAT: cluster=1540(0x604), pos=1096714
FAT: cluster=2309(0x905), pos=1098252
FAT: cluster=3078(0xc06), pos=1099790
FAT: cluster=3847(0xf07), pos=1101328
FAT: cluster=4616(0x1208), pos=1102866
FAT: cluster=5385(0x1509), pos=1104404
FAT: cluster=6154(0x180a), pos=1105942
FAT: cluster=6923(0x1b0b), pos=1107480
FAT: cluster=7692(0x1e0c), pos=1109018
FAT: cluster=8461(0x210d), pos=1110556
FAT: cluster=9230(0x240e), pos=1112094
MS Data 1085446 1288197 202752 [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 175387403 2359246504 2183859102
FATX, 1118 GB / 1041 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
Results
MS Data 2048 1085439 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
MS Data 294715 300888 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
MS Data 300888 307061 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
MS Data 1085439 2168830 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
EFI System 1085440 1288191 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
MS Data 1085446 1288197 202752 [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 6174 linear /dev/sda 294715" | dmsetup create test1
echo "0 6174 linear /dev/sda 300888" | dmsetup create test2
echo "0 1083392 linear /dev/sda 1085439" | dmsetup create test3
echo "0 202752 linear /dev/sda 1085440" | dmsetup create test4
echo "0 202752 linear /dev/sda 1085446" | dmsetup create test5
interface_write()
No partition found or selected for recovery
simulate write!
Partition table type (auto): EFI GPT
Disk /dev/sda - 256 GB / 238 GiB - SanDisk SD8SBAT256G1122
Partition table type: None
Interface Advanced
P Unknown 0 0 1 31130 233 63 500118192
Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Current partition structure:
P Unknown 0 0 1 31130 233 63 500118192
search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 32 33 67 144 13 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6670-7430
FAT2 : 7431-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-202751
sectors : 202752
cluster_size : 2
no_of_cluster : 97280 (2 - 97281)
fat_length 761 calculated 761
set_FAT_info: name from BS used
FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
FAT32 67 144 14 80 47 31 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
Sys=0C 10917 92 3 146856 77 14 2183859102
FATX, 1118 GB / 1041 GiB
This partition ends after the disk limits. (start=175387403, size=2183859102, end=2359246504, disk end=500118192)
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (256 GB / 238 GiB) seems too small! (< 1207 GB / 1124 GiB)
The following partition can't be recovered:
Sys=0C 10917 92 3 146856 77 14 2183859102
FATX, 1118 GB / 1041 GiB
Results
P NTFS 0 32 33 67 144 13 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
P FAT32 67 144 14 80 47 31 202752 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 103 MB / 99 MiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 1085440" | dmsetup create test1
interface_write()
P NTFS 0 32 33 67 144 13 1083392
P FAT32 67 144 14 80 47 31 202752 [EFI System Partition] [NO NAME]
Write isn't available because the partition table type "None" has been selected.
TestDisk exited normally.