Missing partition; how to restore w/o overlapping partitions ?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
kbarb
Posts: 12
Joined: 13 Mar 2012, 01:28

Missing partition; how to restore w/o overlapping partitions ?

#1 Post by kbarb »

I'm trying to recover my [DATA] 3rd partition.

My System : Win10-Pro, 500GB ADATA SU-800 SSD drive, w/ MBR boot sector

= = = = = = = = = = = = = = = = = = = = = = = = = = =
History so far :
I was resizing partitions offline so as to make room for some Windows updates, when I eventually made a mistake.

(I was using some partitioning apps contained in a multiboot USB drive (called Easy2Boot). The Easy2Boot drive is the 2nd drive in the Win Disk Mngmnt drive screenshot.)

First I enlarged the C: [OS] partition successfully, using Acronis Disk Director.

Then I went to enlarge the hidden Win-Re-Recovery partition at the end of drive, so as to run a Windows update, by taking from the logical [DATA] partition before it.

For that I switched to try out Paragon Hard Disk Manager, first mistake.
But Paragon was going 10x slower than I'm used to for a partitioning app, so I stopped it. (the real mistake ! )

That screwed up the Extended & logical (F: DATA) partitions, and deleted the hidden Win-Re-Recovery partition at the end.
= = = = = = = = = = = = = = = = = = = = = = = = = = =

I haven't tried booting the machine yet because I anticipate problems.
The main goal is to get back the [DATA} partition.

I ran TestDisk and think I found the missing partitions, but I'm not sure what to do as it looks like it might overlap some partitions.
The problem is shown in the last (#6 & #7) screenshots.
Please follow the screen shots below.

If someone could help me recover it I'd be most grateful and would like to donate to support TestDisk.

Partitions originally were :
  1. - System Reserved (~500MB)
  2. - C: [OS]_________(~92GB)
    [--Extended LBA --]
  3. - F: [DATA]_______(+/-380GB) (my files)
  4. - Win-Re-Recovery (~500-600MB, hidden)

How it looks now (Drive letters get all switched up working offline) :
1 - 40E-Win10DiscMngt.png
1 - 40E-Win10DiscMngt.png (32.88 KiB) Viewed 913 times
|
Running TestDisk :
2 - 60A-TestDisk - ChooseDisk.png
2 - 60A-TestDisk - ChooseDisk.png (23.17 KiB) Viewed 913 times
|
3 - 2A-TestDisk - Analyse.png
3 - 2A-TestDisk - Analyse.png (34.9 KiB) Viewed 913 times
|
|
* * Hold on, have to figure out how to attach 4 more screenshots and the logfile . . .
Last edited by kbarb on 21 May 2024, 20:32, edited 6 times in total.
Top
kbarb
Posts: 12
Joined: 13 Mar 2012, 01:28

Re: Missing partition; how to restore w/o overlapping partitions ?

#2 Post by kbarb »

Continuing w/ screenshots . . .
|
4 - 2B-TestDisk - QuickSearch.png
4 - 2B-TestDisk - QuickSearch.png (29.79 KiB) Viewed 912 times
|
5 - 60B2-TestDisk - QuickSearch-Continue .png
5 - 60B2-TestDisk - QuickSearch-Continue .png (22.93 KiB) Viewed 912 times
|
6 - 2C-TestDisk - DeepScan.png
6 - 2C-TestDisk - DeepScan.png (61.25 KiB) Viewed 912 times
|
* * Hold on . . . one more Screenshot and the logfile . . .
Top
kbarb
Posts: 12
Joined: 13 Mar 2012, 01:28

Re: Missing partition; how to restore w/o overlapping partitions ?

#3 Post by kbarb »

Continuing w/ screenshot and logfile . . .
|
7 - 50A-TestDisk - pre-Write.png
7 - 50A-TestDisk - pre-Write.png (45.12 KiB) Viewed 908 times
|
So as I wrote above in the #7 screenshot :
  • No write was completed (meaning I didn't do it), and
  • How do I keep the Extended Partition 11742-96-3 -- 62183-251-20 from overlapping (starting before) the end of 2nd [OS] partition 63-221-31 -- 12025-228-43 ?

The logfile :

Code: Select all


Sun May 19 16:17:01 2024
Command line: TestDisk

TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=31914983424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=98391031808			[Drv-0, OS]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=408807276544			[Drv-0, approx area of my DATA files]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4146000384			[Drv-1, PTN1, Easy2Boot]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=524288000			[Drv-0, SysRes area]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1073741824			[Drv-1, E2B_PTN2, (Easy2Boot)]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=2896166912			[Drv-1, E2B_PTN3 (Easy2Boot) ]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112				[Drv-1, Boot (Easy2Boot)]
Hard disk list
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - ADATA SU800, S/N:2J3620055765, FW:R0427ANR
Disk \\.\PhysicalDrive1 - 31 GB / 29 GiB - CHS 3880 255 63, sector size=512 - Mass Storage Device, S/N:121220160204, FW:1.00
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512 - Microsoft Corporation RamDisk

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - ADATA SU800
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Info: size boot_sector 1023993, partition 1024000
NTFS at 63/221/31
check_part_i386 failed for partition type 07
Current partition structure:
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
 3 E extended LBA         12025 228 44 61727  87 56  798453760
Invalid NTFS or exFAT boot
 5 L HPFS - NTFS          12026   6 13 61727  87 56  798451712
 5 L HPFS - NTFS          12026   6 13 61727  87 56  798451712
Backup partition structure
partition_save

search_part()
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
NTFS at 0/32/33
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 23    1023993 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 499 MiB
NTFS at 63/221/31
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
check_part_i386 failed for partition type 07
     HPFS - NTFS          12026   6 13 61727  87 56  798451712
NTFS at 62183/251/21
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 21 62260 120 61    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
This partition ends after the disk limits. (start=1000214527, size=1228793, end=1001443319, disk end=1000215216)
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 512 GB / 477 GiB)
The following partition can't be recovered:
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB

Results
   * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
   P HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
   P HPFS - NTFS          12026   6 13 61727  87 56  798451712
     HPFS - NTFS          62183 251 21 62260 121  5    1228800
     NTFS, blocksize=4096, 629 MB / 600 MiB
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.

   P HPFS - NTFS          12026   6 13 61727  87 56  798451712
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
 3 P HPFS - NTFS          12026   6 13 61727  87 56  798451712

search_part()
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
NTFS at 0/32/33
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 23    1023993 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 499 MiB
NTFS at 63/221/30
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 40    63 221 30    1023993
     NTFS found using backup sector, blocksize=4096, 524 MB / 499 MiB
NTFS at 63/221/31
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
NTFS at 140/91/15
filesystem size           2252800
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33   140  91 15    2252800 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 1153 MB / 1100 MiB
NTFS at 140/91/16
filesystem size           186386425
sectors_per_cluster       8
mft_lcn                   379231
mftmirr_lcn               22269792
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            140  91 16 11742  95 58  186386425 [OS]
     NTFS, blocksize=4096, 95 GB / 88 GiB

LVM magic value at 5468/217/62
NTFS at 10118/97/27
filesystem size           161525760
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 10118  97 27  161525760 [OS]
     NTFS found using backup sector, blocksize=4096, 82 GB / 77 GiB
NTFS at 11742/96/2
filesystem size           187615225
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 38 11742  96  2  187615225
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
NTFS at 11742/128/35
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS, blocksize=4096, 414 GB / 386 GiB
NTFS at 12025/228/43
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS found using backup sector, blocksize=4096, 98 GB / 91 GiB
check_part_i386 failed for partition type 07
     HPFS - NTFS          12026   6 13 61727  87 56  798451712
NTFS at 62183/186/19
filesystem size           810338297
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          11742 128 42 62183 186 19  810338297
     NTFS found using backup sector, blocksize=4096, 414 GB / 386 GiB
NTFS at 62183/251/20
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS found using backup sector, blocksize=4096, 414 GB / 386 GiB
NTFS at 62183/251/21
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 21 62260 120 61    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
This partition ends after the disk limits. (start=1000214527, size=1228793, end=1001443319, disk end=1000215216)
NTFS at 0/32/33
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/23
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/30
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/23
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/30
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/31
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 11742/128/35
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 62183/251/13
filesystem size           836431865
sectors_per_cluster       8
mft_lcn                   91861431
mftmirr_lcn               91105456
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
NTFS at 62183/251/20
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
NTFS at 62183/251/21
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 512 GB / 477 GiB)
The following partition can't be recovered:
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB

Results
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
     HPFS - NTFS              0  32 33   140  91 15    2252800 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 1153 MB / 1100 MiB
     HPFS - NTFS              0  32 40    63 221 30    1023993
     NTFS found using backup sector, blocksize=4096, 524 MB / 499 MiB
     HPFS - NTFS             63 221 23   127 155 13    1023993
     NTFS, blocksize=4096, 524 MB / 499 MiB
     HPFS - NTFS             63 221 30   127 155 20    1023993
     NTFS, blocksize=4096, 524 MB / 499 MiB
     HPFS - NTFS             63 221 31 10118  97 27  161525760 [OS]
     NTFS found using backup sector, blocksize=4096, 82 GB / 77 GiB
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
     HPFS - NTFS             63 221 38 11742  96  2  187615225
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
     HPFS - NTFS            140  91 16 11742  96  2  186386432 [OS]
     NTFS, blocksize=4096, 95 GB / 88 GiB
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS, blocksize=4096, 414 GB / 386 GiB
     HPFS - NTFS          11742 128 42 62183 186 19  810338297
     NTFS found using backup sector, blocksize=4096, 414 GB / 386 GiB
     HPFS - NTFS          12026   6 13 61727  87 56  798451712
     HPFS - NTFS          62183 251 21 62260 121  5    1228800
     NTFS, blocksize=4096, 629 MB / 600 MiB
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB


dir_partition inode=5
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 16-May-2024 06:23 .
       5 dr-xr-xr-x     0      0         0 16-May-2024 06:23 ..
  261645 dr-xr-xr-x     0      0         0 15-Jan-2020 19:33 $AV_ASW
   70838 dr-xr-xr-x     0      0         0 26-Jan-2021 03:39 $GetCurrent
      61 dr-xr-xr-x     0      0         0 16-May-2024 06:36 $Recycle.Bin
   71638 dr-xr-xr-x     0      0         0  5-Feb-2021 07:23 $SysReset
  589499 dr-xr-xr-x     0      0         0  5-May-2022 00:17 $WINDOWS.~BT
     489 dr-xr-xr-x     0      0         0 13-May-2024 22:06 $WinREAgent
    4975 dr-xr-xr-x     0      0         0  4-Sep-2023 19:04 $Windows.~WS
  167521 dr-xr-xr-x     0      0         0 14-Jul-2020 00:31 DRIVERS
   88041 dr-xr-xr-x     0      0         0 13-Oct-2018 07:29 Documents and Settings
     109 dr-xr-xr-x     0      0         0 30-Sep-2019 23:34 ESD
   93386 dr-xr-xr-x     0      0         0 25-Oct-2022 22:10 Intel
    4532 dr-xr-xr-x     0      0         0 22-Feb-2021 06:04 KRD2018_Data
  183011 dr-xr-xr-x     0      0         0 30-Dec-2023 01:30 OneDriveTemp
  392146 dr-xr-xr-x     0      0         0  7-Dec-2019 12:14 PerfLogs
  392147 dr-xr-xr-x     0      0         0 12-May-2024 04:17 Program Files
  393370 dr-xr-xr-x     0      0         0 31-Dec-2023 03:40 Program Files (x86)
  393473 dr-xr-xr-x     0      0         0 31-Dec-2023 03:40 ProgramData
  392922 dr-xr-xr-x     0      0         0 19-Jan-2024 19:45 Recovery
   60787 dr-xr-xr-x     0      0         0  3-Nov-2021 01:40 SARDU_342
  378042 dr-xr-xr-x     0      0         0  9-Aug-2020 02:55 Sandbox
   86422 dr-xr-xr-x     0      0         0 13-May-2024 12:53 System Volume Information
  259402 dr-xr-xr-x     0      0         0  8-Nov-2021 08:28 Temp
  393625 dr-xr-xr-x     0      0         0 21-Feb-2024 22:34 Users
  393683 dr-xr-xr-x     0      0         0 12-May-2024 05:53 Windows
   23009 dr-xr-xr-x     0      0         0 27-Oct-2022 18:52 easeus_tb_cloud
      19 dr-xr-xr-x     0      0         0  7-Mar-2021 07:19 found.000
    4147 -r--r--r--     0      0      1024 14-May-2024 06:46 AMTAG.BIN
   19137 -r--r--r--     0      0         1 16-Jul-2016 14:43 BOOTNXT
    2718 -r--r--r--     0      0      8192  3-May-2023 07:06 DumpStack.log
      36 -r--r--r--     0      0      8192 23-Jun-2023 21:23 DumpStack.log.tmp
  333564 -r--r--r--     0      0    316416 27-Oct-2022 18:27 EUMONBMP.SYS
      20 -r--r--r--     0      0       112 13-Aug-2020 02:13 bootTel.dat
   19141 -r--r--r--     0      0    384322 16-Jul-2016 14:43 bootmgr
   90987 -r--r--r--     0      0 3308445696 13-May-2024 22:28 hiberfil.sys
  102440 -r--r--r--     0      0        94 16-May-2024 06:23 rescuepe.log
  140894 -r--r--r--     0      0     66633 12-Dec-2023 20:28 sheepshearing1a.jpg
  140894 -r--r--r--     0      0      1805 12-Dec-2023 20:28 sheepshearing1a.jpg:Zone.Identifier
    9442 -r--r--r--     0      0        85 22-Oct-2022 20:07 startup.log
   86439 -r--r--r--     0      0 268435456 13-May-2024 22:28 swapfile.sys
  598637 -r--r--r--     0      0      4096 27-Oct-2022 18:39 {F964BF1F-DD8B-4215-A8F6-66D683A74F40}.CBM


dir_partition inode=5
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS, blocksize=4096, 414 GB / 386 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 12-May-2024 04:24 .
       5 dr-xr-xr-x     0      0         0 12-May-2024 04:24 ..
    1712 dr-xr-xr-x     0      0         0 26-Oct-2022 20:18 $AV_ASW
      41 dr-xr-xr-x     0      0         0  6-Aug-2023 22:55 $RECYCLE.BIN
      44 dr-xr-xr-x     0      0         0 30-Dec-2023 20:40 Files
   50362 dr-xr-xr-x     0      0         0  3-Nov-2021 06:50 MUSIC
   19883 dr-xr-xr-x     0      0         0 30-Dec-2023 20:41 OneDrive
   58806 dr-xr-xr-x     0      0         0 30-Dec-2023 20:09 OneDriveTemp
      68 dr-xr-xr-x     0      0         0 12-Mar-2024 23:39 PHOTOS
    4465 dr-xr-xr-x     0      0         0  2-Nov-2021 20:16 Program Files
      36 dr-xr-xr-x     0      0         0 23-Jun-2023 10:23 System Volume Information
      64 dr-xr-xr-x     0      0         0  5-Mar-2024 00:17 VIDEOS
    4365 dr-xr-xr-x     0      0         0  4-Nov-2021 23:04 WindowsApps
   21563 -r--r--r--     0      0      1196  2-Nov-2021 20:59 DOWNLOADS - Shortcut.lnk
    1397 -r--r--r--     0      0      8192 15-Mar-2024 03:08 DumpStack.log
    1409 -r--r--r--     0      0      8192 13-May-2024 22:28 DumpStack.log.tmp
   19883 -r--r--r--     0      0       272 30-Dec-2023 20:41 OneDrive:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.SyncRootIdentity
      63 -r--r--r--     0      0       520 27-Feb-2021 18:49 desktop.ini
   57402 -r--r--r--     0      0 22548578304 13-May-2024 22:28 pagefile.sys
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         11742  96  3 62183 251 20  810344448
 5 L HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 11742/96/3,lba=188641280

TestDisk exited normally.
What I'm thinking :
Use a partitioning program to shrink the size of the 2nd [OS] partition, below the 11742 cylinder.
Then let TestDisk restore the found Extended partition and its logical [DATA] partition, and the Win-RE-Recovery partition if possible.

Does that sound right ? or is there a better way.
Thanks very much !
Top
recuperation
Posts: 2797
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Missing partition; how to restore w/o overlapping partitions ?

#4 Post by recuperation »

kbarb wrote: ↑21 May 2024, 19:37 I'm trying to recover my [DATA] 3rd partition.

My System : Win10-Pro, 500GB ADATA SU-800 SSD drive, w/ MBR boot sector

= = = = = = = = = = = = = = = = = = = = = = = = = = =
History so far :
I was resizing partitions offline so as to make room for some Windows updates, when I eventually made a mistake.

(I was using some partitioning apps contained in a multiboot USB drive (called Easy2Boot). The Easy2Boot drive is the 2nd drive in the Win Disk Mngmnt drive screenshot.)

First I enlarged the C: [OS] partition successfully, using Acronis Disk Director.

Then I went to enlarge the hidden Win-Re-Recovery partition at the end of drive, so as to run a Windows update, by taking from the logical [DATA] partition before it.

For that I switched to try out Paragon Hard Disk Manager, first mistake.
But Paragon was going 10x slower than I'm used to for a partitioning app, so I stopped it. (the real mistake ! )

That screwed up the Extended & logical (F: DATA) partitions, and deleted the hidden Win-Re-Recovery partition at the end.
= = = = = = = = = = = = = = = = = = = = = = = = = = =

I haven't tried booting the machine yet because I anticipate problems.
The main goal is to get back the [DATA} partition.

I ran TestDisk and think I found the missing partitions, but I'm not sure what to do as it looks like it might overlap some partitions.
The problem is shown in the last (#6 & #7) screenshots.
Please follow the screen shots below.

If someone could help me recover it I'd be most grateful and would like to donate to support TestDisk.
You are so generous, thank you, Sir! Because of your kindness I have drawn a little picture for you:
donkey and carrot_q60.jpg
donkey and carrot_q60.jpg (27.97 KiB) Viewed 860 times
Just some feedback concerning the sentence above:
In other words you say: "In case of recovery success I might donate."
My response to your issue does not depend on hanging carrots in front of my nose - I am not the recipient anyway.
This should not discourage you from donating!
For all other readers, I don't want to read such a sentence announcing a possible donation. I really don't like that.
However, what encourages me is a good case description where I can read through without having to ask questions.
I have not seen such a good case description as your one for a long time!
Partitions originally were :
  1. - System Reserved (~500MB)
  2. - C: [OS]_________(~92GB)
    [--Extended LBA --]
  3. - F: [DATA]_______(+/-380GB) (my files)
  4. - Win-Re-Recovery (~500-600MB, hidden)

How it looks now (Drive letters get all switched up working offline) :
1 - 40E-Win10DiscMngt.png
|
Running TestDisk :
2 - 60A-TestDisk - ChooseDisk.png
|
3 - 2A-TestDisk - Analyse.png
|
|
* * Hold on, have to figure out how to attach 4 more screenshots and the logfile . . .
Top
recuperation
Posts: 2797
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Missing partition; how to restore w/o overlapping partitions ?

#5 Post by recuperation »

kbarb wrote: ↑21 May 2024, 19:37 I'm trying to recover my [DATA] 3rd partition.

My System : Win10-Pro, 500GB ADATA SU-800 SSD drive, w/ MBR boot sector

= = = = = = = = = = = = = = = = = = = = = = = = = = =
History so far :
I was resizing partitions offline so as to make room for some Windows updates, when I eventually made a mistake.

(I was using some partitioning apps contained in a multiboot USB drive (called Easy2Boot). The Easy2Boot drive is the 2nd drive in the Win Disk Mngmnt drive screenshot.)

First I enlarged the C: [OS] partition successfully, using Acronis Disk Director.

Then I went to enlarge the hidden Win-Re-Recovery partition at the end of drive, so as to run a Windows update, by taking from the logical [DATA] partition before it.

For that I switched to try out Paragon Hard Disk Manager, first mistake.
But Paragon was going 10x slower than I'm used to for a partitioning app, so I stopped it. (the real mistake ! )

That screwed up the Extended & logical (F: DATA) partitions, and deleted the hidden Win-Re-Recovery partition at the end.
= = = = = = = = = = = = = = = = = = = = = = = = = = =

I haven't tried booting the machine yet because I anticipate problems.
The main goal is to get back the [DATA} partition.

I ran TestDisk and think I found the missing partitions, but I'm not sure what to do as it looks like it might overlap some partitions.
The problem is shown in the last (#6 & #7) screenshots.
Please follow the screen shots below.

If someone could help me recover it I'd be most grateful and would like to donate to support TestDisk.

Partitions originally were :
  1. - System Reserved (~500MB)
  2. - C: [OS]_________(~92GB)
    [--Extended LBA --]
  3. - F: [DATA]_______(+/-380GB) (my files)
  4. - Win-Re-Recovery (~500-600MB, hidden)

How it looks now (Drive letters get all switched up working offline) :
Some information regarding the "MBR"-label: The Microsoft Reserved Partition is not the MBR. The MBR is just one sector at the beginning of the disk. ;)
1 - 40E-Win10DiscMngt.png
|
Running TestDisk :
2 - 60A-TestDisk - ChooseDisk.png
|
3 - 2A-TestDisk - Analyse.png
|
|
* * Hold on, have to figure out how to attach 4 more screenshots and the logfile . . .
Top
recuperation
Posts: 2797
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Missing partition; how to restore w/o overlapping partitions ?

#6 Post by recuperation »

kbarb wrote: ↑21 May 2024, 19:54 Continuing w/ screenshot and logfile . . .
|
7 - 50A-TestDisk - pre-Write.png
|
So as I wrote above in the #7 screenshot :
  • No write was completed (meaning I didn't do it), and
  • How do I keep the Extended Partition 11742-96-3 -- 62183-251-20 from overlapping (starting before) the end of 2nd [OS] partition 63-221-31 -- 12025-228-43 ?
Under construction!

The logfile :

Code: Select all


Sun May 19 16:17:01 2024
Command line: TestDisk

TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=31914983424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=98391031808			[Drv-0, OS]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=408807276544			[Drv-0, approx area of my DATA files]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4146000384			[Drv-1, PTN1, Easy2Boot]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=524288000			[Drv-0, SysRes area]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1073741824			[Drv-1, E2B_PTN2, (Easy2Boot)]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=2896166912			[Drv-1, E2B_PTN3 (Easy2Boot) ]
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112				[Drv-1, Boot (Easy2Boot)]
Hard disk list
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - ADATA SU800, S/N:2J3620055765, FW:R0427ANR
Disk \\.\PhysicalDrive1 - 31 GB / 29 GiB - CHS 3880 255 63, sector size=512 - Mass Storage Device, S/N:121220160204, FW:1.00
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512 - Microsoft Corporation RamDisk

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - ADATA SU800
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Info: size boot_sector 1023993, partition 1024000
NTFS at 63/221/31
check_part_i386 failed for partition type 07
Current partition structure:
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
 3 E extended LBA         12025 228 44 61727  87 56  798453760
Invalid NTFS or exFAT boot
 5 L HPFS - NTFS          12026   6 13 61727  87 56  798451712
 5 L HPFS - NTFS          12026   6 13 61727  87 56  798451712
Backup partition structure
partition_save

search_part()
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
NTFS at 0/32/33
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 23    1023993 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 499 MiB
NTFS at 63/221/31
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
check_part_i386 failed for partition type 07
     HPFS - NTFS          12026   6 13 61727  87 56  798451712
NTFS at 62183/251/21
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 21 62260 120 61    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
This partition ends after the disk limits. (start=1000214527, size=1228793, end=1001443319, disk end=1000215216)
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 512 GB / 477 GiB)
The following partition can't be recovered:
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB

Results
   * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
   P HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
   P HPFS - NTFS          12026   6 13 61727  87 56  798451712
     HPFS - NTFS          62183 251 21 62260 121  5    1228800
     NTFS, blocksize=4096, 629 MB / 600 MiB
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.

   P HPFS - NTFS          12026   6 13 61727  87 56  798451712
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
 3 P HPFS - NTFS          12026   6 13 61727  87 56  798451712

search_part()
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
NTFS at 0/32/33
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 23    1023993 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 499 MiB
NTFS at 63/221/30
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 40    63 221 30    1023993
     NTFS found using backup sector, blocksize=4096, 524 MB / 499 MiB
NTFS at 63/221/31
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
NTFS at 140/91/15
filesystem size           2252800
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33   140  91 15    2252800 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 1153 MB / 1100 MiB
NTFS at 140/91/16
filesystem size           186386425
sectors_per_cluster       8
mft_lcn                   379231
mftmirr_lcn               22269792
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            140  91 16 11742  95 58  186386425 [OS]
     NTFS, blocksize=4096, 95 GB / 88 GiB

LVM magic value at 5468/217/62
NTFS at 10118/97/27
filesystem size           161525760
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 10118  97 27  161525760 [OS]
     NTFS found using backup sector, blocksize=4096, 82 GB / 77 GiB
NTFS at 11742/96/2
filesystem size           187615225
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 38 11742  96  2  187615225
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
NTFS at 11742/128/35
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS, blocksize=4096, 414 GB / 386 GiB
NTFS at 12025/228/43
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS found using backup sector, blocksize=4096, 98 GB / 91 GiB
check_part_i386 failed for partition type 07
     HPFS - NTFS          12026   6 13 61727  87 56  798451712
NTFS at 62183/186/19
filesystem size           810338297
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          11742 128 42 62183 186 19  810338297
     NTFS found using backup sector, blocksize=4096, 414 GB / 386 GiB
NTFS at 62183/251/20
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS found using backup sector, blocksize=4096, 414 GB / 386 GiB
NTFS at 62183/251/21
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 21 62260 120 61    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB
NTFS at 62260/121/5
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB
This partition ends after the disk limits. (start=1000214527, size=1228793, end=1001443319, disk end=1000215216)
NTFS at 0/32/33
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/23
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/30
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/23
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/30
filesystem size           1023993
sectors_per_cluster       8
mft_lcn                   6553
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 63/221/31
filesystem size           192169984
sectors_per_cluster       8
mft_lcn                   532831
mftmirr_lcn               22423392
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 11742/128/35
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 62183/251/13
filesystem size           836431865
sectors_per_cluster       8
mft_lcn                   91861431
mftmirr_lcn               91105456
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
NTFS at 62183/251/20
filesystem size           810342400
sectors_per_cluster       8
mft_lcn                   39134908
mftmirr_lcn               871694
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
NTFS at 62183/251/21
filesystem size           1228793
sectors_per_cluster       8
mft_lcn                   46695
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 512 GB / 477 GiB)
The following partition can't be recovered:
     HPFS - NTFS          62260 121  5 62336 245 45    1228793
     NTFS, blocksize=4096, 629 MB / 599 MiB

Results
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
     HPFS - NTFS              0  32 33   140  91 15    2252800 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 1153 MB / 1100 MiB
     HPFS - NTFS              0  32 40    63 221 30    1023993
     NTFS found using backup sector, blocksize=4096, 524 MB / 499 MiB
     HPFS - NTFS             63 221 23   127 155 13    1023993
     NTFS, blocksize=4096, 524 MB / 499 MiB
     HPFS - NTFS             63 221 30   127 155 20    1023993
     NTFS, blocksize=4096, 524 MB / 499 MiB
     HPFS - NTFS             63 221 31 10118  97 27  161525760 [OS]
     NTFS found using backup sector, blocksize=4096, 82 GB / 77 GiB
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
     HPFS - NTFS             63 221 38 11742  96  2  187615225
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
     HPFS - NTFS            140  91 16 11742  96  2  186386432 [OS]
     NTFS, blocksize=4096, 95 GB / 88 GiB
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS, blocksize=4096, 414 GB / 386 GiB
     HPFS - NTFS          11742 128 42 62183 186 19  810338297
     NTFS found using backup sector, blocksize=4096, 414 GB / 386 GiB
     HPFS - NTFS          12026   6 13 61727  87 56  798451712
     HPFS - NTFS          62183 251 21 62260 121  5    1228800
     NTFS, blocksize=4096, 629 MB / 600 MiB
     HPFS - NTFS          62183 251 28 62260 121  5    1228793
     NTFS found using backup sector, blocksize=4096, 629 MB / 599 MiB


dir_partition inode=5
     HPFS - NTFS             63 221 31 12025 228 43  192169984 [OS]
     NTFS, blocksize=4096, 98 GB / 91 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 16-May-2024 06:23 .
       5 dr-xr-xr-x     0      0         0 16-May-2024 06:23 ..
  261645 dr-xr-xr-x     0      0         0 15-Jan-2020 19:33 $AV_ASW
   70838 dr-xr-xr-x     0      0         0 26-Jan-2021 03:39 $GetCurrent
      61 dr-xr-xr-x     0      0         0 16-May-2024 06:36 $Recycle.Bin
   71638 dr-xr-xr-x     0      0         0  5-Feb-2021 07:23 $SysReset
  589499 dr-xr-xr-x     0      0         0  5-May-2022 00:17 $WINDOWS.~BT
     489 dr-xr-xr-x     0      0         0 13-May-2024 22:06 $WinREAgent
    4975 dr-xr-xr-x     0      0         0  4-Sep-2023 19:04 $Windows.~WS
  167521 dr-xr-xr-x     0      0         0 14-Jul-2020 00:31 DRIVERS
   88041 dr-xr-xr-x     0      0         0 13-Oct-2018 07:29 Documents and Settings
     109 dr-xr-xr-x     0      0         0 30-Sep-2019 23:34 ESD
   93386 dr-xr-xr-x     0      0         0 25-Oct-2022 22:10 Intel
    4532 dr-xr-xr-x     0      0         0 22-Feb-2021 06:04 KRD2018_Data
  183011 dr-xr-xr-x     0      0         0 30-Dec-2023 01:30 OneDriveTemp
  392146 dr-xr-xr-x     0      0         0  7-Dec-2019 12:14 PerfLogs
  392147 dr-xr-xr-x     0      0         0 12-May-2024 04:17 Program Files
  393370 dr-xr-xr-x     0      0         0 31-Dec-2023 03:40 Program Files (x86)
  393473 dr-xr-xr-x     0      0         0 31-Dec-2023 03:40 ProgramData
  392922 dr-xr-xr-x     0      0         0 19-Jan-2024 19:45 Recovery
   60787 dr-xr-xr-x     0      0         0  3-Nov-2021 01:40 SARDU_342
  378042 dr-xr-xr-x     0      0         0  9-Aug-2020 02:55 Sandbox
   86422 dr-xr-xr-x     0      0         0 13-May-2024 12:53 System Volume Information
  259402 dr-xr-xr-x     0      0         0  8-Nov-2021 08:28 Temp
  393625 dr-xr-xr-x     0      0         0 21-Feb-2024 22:34 Users
  393683 dr-xr-xr-x     0      0         0 12-May-2024 05:53 Windows
   23009 dr-xr-xr-x     0      0         0 27-Oct-2022 18:52 easeus_tb_cloud
      19 dr-xr-xr-x     0      0         0  7-Mar-2021 07:19 found.000
    4147 -r--r--r--     0      0      1024 14-May-2024 06:46 AMTAG.BIN
   19137 -r--r--r--     0      0         1 16-Jul-2016 14:43 BOOTNXT
    2718 -r--r--r--     0      0      8192  3-May-2023 07:06 DumpStack.log
      36 -r--r--r--     0      0      8192 23-Jun-2023 21:23 DumpStack.log.tmp
  333564 -r--r--r--     0      0    316416 27-Oct-2022 18:27 EUMONBMP.SYS
      20 -r--r--r--     0      0       112 13-Aug-2020 02:13 bootTel.dat
   19141 -r--r--r--     0      0    384322 16-Jul-2016 14:43 bootmgr
   90987 -r--r--r--     0      0 3308445696 13-May-2024 22:28 hiberfil.sys
  102440 -r--r--r--     0      0        94 16-May-2024 06:23 rescuepe.log
  140894 -r--r--r--     0      0     66633 12-Dec-2023 20:28 sheepshearing1a.jpg
  140894 -r--r--r--     0      0      1805 12-Dec-2023 20:28 sheepshearing1a.jpg:Zone.Identifier
    9442 -r--r--r--     0      0        85 22-Oct-2022 20:07 startup.log
   86439 -r--r--r--     0      0 268435456 13-May-2024 22:28 swapfile.sys
  598637 -r--r--r--     0      0      4096 27-Oct-2022 18:39 {F964BF1F-DD8B-4215-A8F6-66D683A74F40}.CBM


dir_partition inode=5
     HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
     NTFS, blocksize=4096, 414 GB / 386 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 12-May-2024 04:24 .
       5 dr-xr-xr-x     0      0         0 12-May-2024 04:24 ..
    1712 dr-xr-xr-x     0      0         0 26-Oct-2022 20:18 $AV_ASW
      41 dr-xr-xr-x     0      0         0  6-Aug-2023 22:55 $RECYCLE.BIN
      44 dr-xr-xr-x     0      0         0 30-Dec-2023 20:40 Files
   50362 dr-xr-xr-x     0      0         0  3-Nov-2021 06:50 MUSIC
   19883 dr-xr-xr-x     0      0         0 30-Dec-2023 20:41 OneDrive
   58806 dr-xr-xr-x     0      0         0 30-Dec-2023 20:09 OneDriveTemp
      68 dr-xr-xr-x     0      0         0 12-Mar-2024 23:39 PHOTOS
    4465 dr-xr-xr-x     0      0         0  2-Nov-2021 20:16 Program Files
      36 dr-xr-xr-x     0      0         0 23-Jun-2023 10:23 System Volume Information
      64 dr-xr-xr-x     0      0         0  5-Mar-2024 00:17 VIDEOS
    4365 dr-xr-xr-x     0      0         0  4-Nov-2021 23:04 WindowsApps
   21563 -r--r--r--     0      0      1196  2-Nov-2021 20:59 DOWNLOADS - Shortcut.lnk
    1397 -r--r--r--     0      0      8192 15-Mar-2024 03:08 DumpStack.log
    1409 -r--r--r--     0      0      8192 13-May-2024 22:28 DumpStack.log.tmp
   19883 -r--r--r--     0      0       272 30-Dec-2023 20:41 OneDrive:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.SyncRootIdentity
      63 -r--r--r--     0      0       520 27-Feb-2021 18:49 desktop.ini
   57402 -r--r--r--     0      0 22548578304 13-May-2024 22:28 pagefile.sys
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         11742  96  3 62183 251 20  810344448
 5 L HPFS - NTFS          11742 128 35 62183 251 20  810342400 [DATA]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 11742/96/3,lba=188641280

TestDisk exited normally.
What I'm thinking :
Use a partitioning program to shrink the size of the 2nd [OS] partition, below the 11742 cylinder.
Then let TestDisk restore the found Extended partition and its logical [DATA] partition, and the Win-RE-Recovery partition if possible.

Does that sound right ? or is there a better way.
Thanks very much !
Top
recuperation
Posts: 2797
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Missing partition; how to restore w/o overlapping partitions ?

#7 Post by recuperation »

Copy all data files out of your DATA-Partition onto another healthy disk using Testdisk abilities. This way you avoid modifying your broken disk.
Check those copied files for integrity.

Avoid using software that resizes and moves partitions.
This way neither power outages nor read errors on a disk are able to put your data at risk.

recipe 1:
========
Buy another disk, maybe bigger than the 512 TB and partition it in a way that you are not forced to store programs on your data partition.
Reinstall your operating system.
Copy the data to the new disk.

recipe 2:
========
Copy the partitions from your broken source disk to the new disk target.
Your software should ask you for the size of each target volume/partition.
Maybe you can avoid reinstalling your operating system.

your proposal:
=============
Currently you do not know to whom the overlapping partition area really belongs to.
How will your partitioning tool(s) react to this when it discoveres that ill-defined structure?

Theoretically you can resize the "OS"-partition at its end if you have enough free space left within that "OS"-partition.
Then the overlap situation is resolved.
Keep in mind that the MBR structure needs at least one free sector between the following partitions. That means that you not only need one sector between the "OS" and the "DATA" partition but a free sector as well between the "DATA"-partition and the "Winre"-partition.

I am not familiar with the most recent versions of Microsoft Windows to tell you if that missing sector behind the data partition is due to your actions or if special rules apply here as it is a special partition.

22.5.2024 17:46 Rewritten the previous contribution
Top
kbarb
Posts: 12
Joined: 13 Mar 2012, 01:28

Re: Missing partition; how to restore w/o overlapping partitions ?

#8 Post by kbarb »

In other words you say: "In case of recovery success I might donate."
No, actually "in other words" would not be a correct assumption. I'm sorry to hear that you arrived at that inference, as it's not what I was thinking.
It's just that I've used all kinds of free software, and although sometimes I've donated, often I've not.
It's just easier to say to yourself, maybe, sometime.
But it occurred to me this time around, this TestDisk software is really useful and could be saving me, so I really should consider helping out by supporting the project, and not just freeloading.

If I'd really intended a straightforward transactional statement in the realm of bribery I would have written, "If you can solve my problem I'll make a donation".

I hope you can accept my genuine appreciative intentions.
Top
kbarb
Posts: 12
Joined: 13 Mar 2012, 01:28

Re: Missing partition; how to restore w/o overlapping partitions ?

#9 Post by kbarb »

Some information regarding the "MBR"-label: The Microsoft Reserved Partition is not the MBR.
Yes, I am aware of that - good catch - but it was just easier to put that in the diagram as such, when most people wouldn't notice the difference, rather than spelling out the details of the first CHS 0,0,1 512-byte sector.
If anyone really wants to get into it they could try :

All the Details of many versions of both MBR and OS Boot Sectors - TheStarman

Ok, now on to problem solving . . .
Top
kbarb
Posts: 12
Joined: 13 Mar 2012, 01:28

Re: Missing partition; how to restore w/o overlapping partitions ?

#10 Post by kbarb »

Thanks very much for your suggestions !
I'm mulling them over.
|
recipe 2:
========
Copy the partitions from your broken source disk to the new disk target.
Your software should ask you for the size of each target volume/partition.
Interesting idea. But wouldn't any partitioning or backup software just try to copy the "known" partitions, instead of the lost ones ?
In other words, it could try to copy a raw partition that doesn't have the correct parameters, and then restore w/ different but perhaps incorrect parameters ?
I know you don't like to comment on the possibilities of other software, but I'm just thinking about your idea.
|
For :
your proposal:
=============
Currently you do not know to whom the overlapping partition area really belongs to.
You mean, I don't know which partition table holds the error. Or something else ?
I'm assuming, perhaps incorrectly, that the [OS] partition is probably correct.
I'd stopped the resize process while resizing the [DATA] & [WinRE] partitions, although I realize that the Acronis Disc Director program was probably adjusting all partition tables when it was doing its thing.
Theoretically you can resize the "OS"-partition at its end if you have enough free space left within that "OS"-partition.
Then the overlap situation is resolved.
I do have plenty of room at the end of that [OS] partition.
But jeeze, you're scaring me a bit now with your first recipes - I didn't think I was in quite so much trouble.

I'm thinking to work on a sector-by-sector clone and trying my idea, rather than charging ahead on the disk in question.
If that doesn't work, try your recipe-2. Just what I'm thinking, or vice versa.

One other question if it's ok:
In a normal correctly set up TestDisk "Write" procedure, should you have in the write list, all the correct partitions lined up for Write, not just the ones you found from Deep Search, or other ?
If so my #7 screenshot would have done an incomplete Write, correct ? (Aside from the other problems)

Thanks very much for your time and advice !
Top
Post Reply

Return to “Partition Recovery”