The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zearch
Posts: 29
Joined: 06 Apr 2014, 16:58

The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)

#1 Post by zearch »

Hi guys
Dealing with partitions I broke the Windows 10 single disk installation of a student of mine. The sad thing is he had a big job here in. I don't care the Windows setup and software.
I am not sure I post in the right section of the forum, but as I was dealing with partitions I post here. Please feel free to move my post.
I wanted to consolidate the storage in a single big partition.
I wanted to delete the recovery partition and also a small 2GB partition in the end of the disk (dedicated to swap, from an exercise). About this last, I first disabled swap in this volume, and as usual Windows asked for reboot, I postponed. I forgot this then with diskpart I deleted the recovery partition...(although I'm nearly sure I didn't use the override parameter, which as far as I remember is required for this) and maybe the swap partition. Then disk manager became irresponsive, as well as the services manager and everything. I rebooted, which failed, and Windows repair USB drive couldn't repair the system.
The drive in the PC is a 1 TB SSD that was cloned from a 1 TB HDD last year with Acronis for Crucial free cloning tool.

I remembered testdisk helped me some times with dying disks and the rule not to write to a failing disk so I cloned with ddrescue the SSD to a same size/model/brand one.

Here is screen I'm stuck at, not knowing which "partition that can't be recovered" to choose to [Continue] with.
Below I post the 3 screens so you can see the matching size for each partition, then the testdisk log
Please, would you kindly help me ?

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  MS Data               1887887359 3774222334 1886334976
   MS Data               1949325311 3897098238 1947772928
   MS Data               1949327359 3897102334 1947774976

[ Continue ]
NTFS, blocksize=4096, 965 GB / 899 GiB

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   MS Data               1887887359 3774222334 1886334976
>  MS Data               1949325311 3897098238 1947772928
   MS Data               1949327359 3897102334 1947774976

[ Continue ]
NTFS, blocksize=4096, 997 GB / 928 GiB

Code: Select all

estDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
   MS Data               1887887359 3774222334 1886334976
   MS Data               1949325311 3897098238 1947772928
>  MS Data               1949327359 3897102334 1947774976

[ Continue ]
NTFS, blocksize=4096, 997 GB / 928 GiB
Testdisk log

Code: Select all

Thu Jan 19 22:34:04 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.0-58-generic (#64-Ubuntu SMP Thu Jan 5 11:43:13 UTC 2023) x86_64
Compiler: GCC 11.2
ext2fs lib: 1.46.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
/dev/sdb: LBA, LBA48 support
/dev/sdb: size       1953525168 sectors
/dev/sdb: user_max   1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop13 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPLX-08ZNTT0, S/N:WD-WX51AA8KDXZ3, FW:05.01A05
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - CT1000MX500SSD1, S/N:2112E58E7843, FW:M3CR033
Disk /dev/loop0 - 64 MB / 61 MiB - 126760 sectors (RO), sector size=512
Disk /dev/loop1 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop10 - 52 MB / 49 MiB - 102048 sectors (RO), sector size=512
Disk /dev/loop11 - 290 KB / 284 KiB - 568 sectors (RO), sector size=512
Disk /dev/loop12 - 311 KB / 304 KiB - 608 sectors (RO), sector size=512
Disk /dev/loop2 - 250 MB / 238 MiB - 488400 sectors (RO), sector size=512
Disk /dev/loop3 - 66 MB / 63 MiB - 129584 sectors (RO), sector size=512
Disk /dev/loop4 - 250 MB / 238 MiB - 488864 sectors (RO), sector size=512
Disk /dev/loop5 - 363 MB / 346 MiB - 709280 sectors (RO), sector size=512
Disk /dev/loop6 - 260 MB / 248 MiB - 509456 sectors (RO), sector size=512
Disk /dev/loop7 - 85 MB / 81 MiB - 166424 sectors (RO), sector size=512
Disk /dev/loop8 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop9 - 48 MB / 45 MiB - 93920 sectors (RO), sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - CT1000MX500SSD1
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144
check_part_gpt failed for partition
 2 P MS Data                   264192    1345535    1081344 [Basic data partition]
check_part_gpt failed for partition
 4 P MS Data                  1552384 1949325311 1947772928
 1 P MS Reserved                   34     262177     262144
 2 P MS Data                   264192    1345535    1081344 [Basic data partition]
 3 P EFI System               1347584    1552383     204800
 4 P MS Data                  1552384 1949325311 1947772928
 5 P MS Data               1949327360 1953521663    4194304 [Basic data partition] [ITE]
     NTFS, blocksize=4096, 2147 MB / 2048 MiB

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144
check_part_gpt failed for partition
 2 P MS Data                   264192    1345535    1081344 [Basic data partition]
check_part_gpt failed for partition
 4 P MS Data                  1552384 1949325311 1947772928
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                   264192    1345535    1081344 [Basic data partition]
 2 P MS Data                   264192    1345535    1081344 [Basic data partition]
 3 P EFI System               1347584    1552383     204800
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 4 P MS Data                  1552384 1949325311 1947772928
 4 P MS Data                  1552384 1949325311 1947772928
 5 P MS Data               1949327360 1953521663    4194304 [Basic data partition] [ITE]
Backup partition structure
partition_save

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 2/42/41
filesystem size           1266011080
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=17825792, part_size=648197672960, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 2/42/41
filesystem size           1266011080
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                    34816 1266045895 1266011080
     NTFS, blocksize=4096, 648 GB / 603 GiB
NTFS at 117515/141/2
filesystem size           1886334976
sectors_per_cluster       8
mft_lcn                   695904
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384 1887887359 1886334976
     NTFS found using backup sector, blocksize=4096, 965 GB / 899 GiB
NTFS at 117515/141/2
filesystem size           1886334976
sectors_per_cluster       8
mft_lcn                   695904
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1887887359 3774222334 1886334976
     NTFS, blocksize=4096, 965 GB / 899 GiB
This partition ends after the disk limits. (start=1887887359, size=1886334976, end=3774222334, disk end=1953525168)
NTFS at 121339/226/39
filesystem size           1947772928
sectors_per_cluster       8
mft_lcn                   695904
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384 1949325311 1947772928
     NTFS found using backup sector, blocksize=4096, 997 GB / 928 GiB
NTFS at 121339/226/39
filesystem size           1947772928
sectors_per_cluster       8
mft_lcn                   695904
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               1949325311 3897098238 1947772928
     NTFS, blocksize=4096, 997 GB / 928 GiB
This partition ends after the disk limits. (start=1949325311, size=1947772928, end=3897098238, disk end=1953525168)
NTFS at 121340/4/8
filesystem size           1947774976
sectors_per_cluster       8
mft_lcn                   695904
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384 1949327359 1947774976
     NTFS found using backup sector, blocksize=4096, 997 GB / 928 GiB
NTFS at 121340/4/8
filesystem size           1947774976
sectors_per_cluster       8
mft_lcn                   695904
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data               1949327359 3897102334 1947774976
     NTFS, blocksize=4096, 997 GB / 928 GiB
This partition ends after the disk limits. (start=1949327359, size=1947774976, end=3897102334, disk end=1953525168)
NTFS at 121340/4/9
filesystem size           4194304
sectors_per_cluster       8
mft_lcn                   262144
mftmirr_lcn               2053
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1945133057 1949327360    4194304
     NTFS found using backup sector, blocksize=4096, 2147 MB / 2048 MiB
NTFS at 121340/4/9
filesystem size           4194304
sectors_per_cluster       8
mft_lcn                   262144
mftmirr_lcn               2053
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1949327360 1953521663    4194304 [ITE]
     NTFS, blocksize=4096, 2147 MB / 2048 MiB
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)
The following partitions can't be recovered:
     MS Data               1887887359 3774222334 1886334976
     NTFS, blocksize=4096, 965 GB / 899 GiB
     MS Data               1949325311 3897098238

Many thanks

zearch
Posts: 29
Joined: 06 Apr 2014, 16:58

Re: The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)

#2 Post by zearch »

Hi all people
Seeking back here I see I forgot to post the partitions listed by fdisk : the partition I'd like to recover access to is /dev/sdb4, the biggest. The strange is it has not the same Basic data partition name that sdb2 & sdb5 have, although it is/was the NTFS C: Windows volume.
Am I right thinking I must use beginning and end sector numbers listed here to select the partition I want in testdisk?

Any help please?

Code: Select all

fdisk -x /dev/sdb
Disk /dev/sdb: 931,51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: CT1000MX500SSD1 
Units: sector of 1 × 512 = 512 bytes
Sector size (logical / physical): 512 bytes / 4096 bytes
I/O size (minimal / optimal): 4096 bytes / 4096 bytes
Disk label type: gpt
Disk identifier: E2E7CCEC-B58D-4A10-96BF-02CB0807BC48
First LBA: 34
Last LBA: 1953525134
Alternative LBA: 1953525167
LBA partition entries: 2
Allocated partitions entries: 128

Device            Begin        End   Sectors  Type-UUID                            UUID                                 Name                 Attr.
/dev/sdb1            34     262177     262144 E3C9E316-0B5C-4DB8-817D-F92DF00215AE 9BB22BF7-11F2-40BD-AE99-27BEE8EC54D4                      
/dev/sdb2        264192    1345535    1081344 EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 253F7AB5-CF4E-411F-9BB3-4A70824AE7BD Basic data partition GUID:63
/dev/sdb3       1347584    1552383     204800 C12A7328-F81F-11D2-BA4B-00A0C93EC93B B9461699-2D66-485A-9E3F-CCFCAEA09FF0                      
/dev/sdb4       1552384 1949325311 1947772928 EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 5FBFD743-CEFC-4CD1-863D-24224181979B                      
/dev/sdb5    1949327360 1953521663    4194304 EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 5090A872-5355-4F00-AF76-7FC62E525FD6 Basic data partition 

Partition 1 does not start on a physical cylinder boundary.

zearch
Posts: 29
Joined: 06 Apr 2014, 16:58

Re: The harddisk (1000 GB / 931 GiB) seems too small! (< 1995 GB / 1858 GiB)

#3 Post by zearch »

I realize I gave truncated informations, fdisk -l /dev/sdb instead of fdisk -l /dev/sdb*
This one shows strange things, ~900GB partitions inside a 100MB Disk?Partition?

Code: Select all

sudo fdisk -l /dev/sdb*
[sudo] password for me: 
Disk /dev/sdb: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: CT1000MX500SSD1 
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: E2E7CCEC-B58D-4A10-96BF-02CB0807BC48

Device          Start        End    Sectors   Size Type
/dev/sdb1          34     262177     262144   128M Microsoft reserved
/dev/sdb2      264192    1345535    1081344   528M Microsoft basic data
/dev/sdb3     1347584    1552383     204800   100M EFI System
/dev/sdb4     1552384 1949325311 1947772928 928.8G Microsoft basic data
/dev/sdb5  1949327360 1953521663    4194304     2G Microsoft basic data


Disk /dev/sdb1: 128 MiB, 134217728 bytes, 262144 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sdb2: 528 MiB, 553648128 bytes, 1081344 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sdb3: 100 MiB, 104857600 bytes, 204800 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x0a0dff65

Device      Boot      Start        End    Sectors   Size Id Type
/dev/sdb3p1      1869881445 3571221465 1701340021 811.3G 7a unknown
/dev/sdb3p2      1634566756 3553817813 1919251058 915.2G 72 unknown
/dev/sdb3p3               0          0          0     0B  0 Empty
/dev/sdb3p4        28049408   28049849        442   221K  0 Empty

Partition table entries are not in disk order.


Disk /dev/sdb4: 928.77 GiB, 997259739136 bytes, 1947772928 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sdb5: 2 GiB, 2147483648 bytes, 4194304 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x6c727443

Device      Boot      Start        End    Sectors   Size Id Type
/dev/sdb5p1      1970237472 3672215697 1701978226 811.6G 75 PC/IX
/dev/sdb5p2      1929382413 3883035520 1953653108 931.6G 72 unknown
/dev/sdb5p3               0          0          0     0B  0 Empty
/dev/sdb5p4        27394442   27394879        438   219K  0 Empty

Partition table entries are not in disk order.

Locked