The USB drive is 64GB in size (that's what it says on it).
I was attempting to fix a Windows installation not being detected by the system, so I ran [c]bootrec /fixboot[/c] and [c]bootrec /fixmbr[/c]. I also ran [c]bootrec /rebuildbcd[/c], but my USB drive wasn't impacted by it. I attempted to update Ventoy, which was on the drive. The drive already had Ventoy on it, so Ventoy2Disk would just update the VTOYEFI partition, which is intact.
There were 2 partitions: One 32MB (ESP | name VTOYEFI) in size and an exFAT partition taking all the available space.
When I realized I toasted my drive, I went to my PC and ran TestDisk. Bringing back the old partition did not work, it says the file system is damaged. I checked the boot sector and it said that the main one was [c]exFAT OK[/c] and the backup one wasn't. TestDisk offered to copy the main one to the back up. I allowed it to. (this was before I enabled the log file!)
I also attempted to rebuild the boot sector, to no avail.
Is my data just gone?
Testdisk.log is here.
Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 2862
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr
Insufficient description. Who is repairing whom?
Confusing, again! I expect the USB disk to be the one containing Ventoy. Now operating on your USB "drive"?
I also ran [c]bootrec /rebuildbcd[/c], but my USB drive wasn't impacted by it.
Is this a new operation independant of the initial repair?
I attempted to update Ventoy, which was on the drive. How this is Ventoy update related to the incident?
Where?!The drive already had Ventoy on it, so Ventoy2Disk would just update the VTOYEFI partition, which is intact.
There
Running TestDisk against which target?!were 2 partitions: One 32MB (ESP | name VTOYEFI) in size and an exFAT partition taking all the available space.
When I realized I toasted my drive, I went to my PC and ran TestDisk.
I have no idea!
Bringing back the old partition did not work, it says the file system is damaged. I checked the boot sector and it said that the main one was [c]exFAT OK[/c] and the backup one wasn't. TestDisk offered to copy the main one to the back up. I allowed it to. (this was before I enabled the log file!)
I also attempted to rebuild the boot sector, to no avail.
Is my data just gone?
You are supposed to upload your logfile to this site. I did this for you.
According to the log file you were trying to repair the Kingston stick that is running Ventoy.
I don't understand which data you are referring to as a Ventoy disk is usually filled with ISO files that came from somewhere else.
Are the ISO's the data?
If I have a problem with a Ventoy storage device I would zero out the device, reinstall Ventoy and copy the ISO files.
Code: Select all
Tue Oct 1 10:27:47 2024
Command line: TestDisk
TestDisk 7.3-WIP, Data Recovery Utility, September 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3003.3
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=61991813632
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=66294120448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=224933179904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=208271310848
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=61957210112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=33554432
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-1DG142, S/N:WBYDLJ5Z, FW:1003YAM1
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63, sector size=512 - Kingston DataTraveler 3.0, S/N:0000000005, FW:0000
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - Kingston DataTraveler 3.0
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
Current partition structure:
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [VTOYEFI]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 7532/168/61
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
FAT16 at 7532/168/61
FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
file_win32_pread(884,8,buffer,121077760(7536/189/14)) read err: read after end of file
Results
* HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
P FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
interface_write()
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
exFAT_boot_sector
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
Boot sector
exFAT OK
Backup boot record
exFAT OK
Sectors are identical.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Directory /
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
dir_partition inode=0
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
Directory /
Analyse Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
Current partition structure:
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [VTOYEFI]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 7532/168/61
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
FAT16 at 7532/168/61
FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
file_win32_pread(884,8,buffer,121077760(7536/189/14)) read err: read after end of file
Results
* HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
P FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
interface_write()
1 * HPFS - NTFS 0 32 33 7532 168 60 121010176
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
Current partition structure:
1 P HPFS - NTFS 0 32 33 7532 168 60 121010176
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [VTOYEFI]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 7532/168/61
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
FAT16 at 7532/168/61
FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
file_win32_pread(884,8,buffer,121077760(7536/189/14)) read err: read after end of file
Results
* HPFS - NTFS 0 32 33 7532 168 60 121010176
exFAT, blocksize=2, 61 GB / 57 GiB
P FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
FAT16, blocksize=512, 33 MB / 32 MiB
interface_write()
1 * HPFS - NTFS 0 32 33 7532 168 60 121010176
2 P FAT16 LBA 7532 168 61 7536 189 13 65536 [EFI System Partition] [VTOYEFI]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
TestDisk exited normally.
Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr
I was repairing a cousin's computer with my Ventoy USB drive. The USB drive is the kingston drive.Insufficient description. Who is repairing whom?
Sorry. The USB drive is the Kingston drive. It contains Ventoy.Confusing, again! I expect the USB disk to be the one containing Ventoy. Now operating on your USB "drive"?
Yes.Is this a new operation independant of the initial repair?
The second, large partition. The first one is as I described, intact.Running TestDisk against which target?!
Yes.Are the ISO's the data?
-
recuperation
- Posts: 2862
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr
But what is the disk?yum13241 wrote: ↑Yesterday, 14:45I was repairing a cousin's computer with my Ventoy USB drive. The USB drive is the kingston drive.Insufficient description. Who is repairing whom?
Sorry. The USB drive is the Kingston drive. It contains Ventoy.Confusing, again! I expect the USB disk to be the one containing Ventoy. Now operating on your USB "drive"?
Yes.Is this a new operation independant of the initial repair?
The second, large partition. The first one is as I described, intact.Running TestDisk against which target?!
What you say is as specific and precise as when you said "I delivered the mail to house number 5".
The logfile states that you operated on your Kingston USB device.
It is still unclear what is dammaged. Obviously it is your cousin's computer. Now it seems the Kingston USB device is dammaged as well. You did not comment on my proposal of just reinstalling Ventoy to the pen drive of your choice and copying the ISOs in there.
If there were ISO files, the chances are 99,9% that you did not create those ISO files and that you just copied them to the Ventoy disk.
I don't get it sorry, and asking you does not enlight me as I hoped to.
Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr
Now it seems the Kingston USB device is dammaged as well. You did not comment on my proposal of just reinstalling Ventoy to the pen drive of your choice and copying the ISOs in there.
If there were ISO files, the chances are 99,9% that you did not create those ISO files and that you just copied them to the Ventoy disk.
The second partition (the biggest one on my Kingston drive) is damaged.It is unclear what is damaged
I actually did create some of the ISO files on there (mainly custom Windows deployments, mainly getting around esoteric firmware), and there were non-ISO files there as well.
I could format the drive and just try to download everything again, but typically that's a last resort. All I know is that [c]bootrec[/c] must've operated on the Kingston USB drive, since its bootsector is corrupted, which even after copying the regular to the backup as TestDisk suggests, does not allow me to list files on the deleted partition, since TestDisk believes that the filesystem is damaged. Rewriting the partition table has no effect, and Windows Explorer prompts to format the drive, to which I have selected NO each time.
The Kingston USB drive, which is 64GB in size and had 2 partitions before the accident: VTOYEFI (32MB in size) and Ventoy Neo, taking the rest of the space, formatted as exFAT.But what is the disk?
What you say is as specific and precise as when you said "I delivered the mail to house number 5".
My cousin's computer is no longer "damaged", as you put it. Some aftermarket disk shenanigans, that was all. They went to a guy who installed a drive, replacing the DVD drive, though that's out of scope.
If it is at all possible, I'd rather just "undelete" as TestDisk puts it, rather than just give up. If that is not possible, I'll just go on a long scavenger hunt for everything I had.
-
recuperation
- Posts: 2862
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr
The second partition (the biggest one on my Kingston drive) is damaged.
I actually did create some of the ISO files on there (mainly custom Windows deployments, mainly getting around esoteric firmware), and there were non-ISO files there as well.
I could format the drive and just try to download everything again, but typically that's a last resort. All I know is that [c]bootrec[/c] must've operated on the Kingston USB drive, since its bootsector is corrupted, which even after copying the regular to the backup as TestDisk suggests, does not allow me to list files on the deleted partition, since TestDisk believes that the filesystem is damaged. Rewriting the partition table has no effect, and Windows Explorer prompts to format the drive, to which I have selected NO each time.
[/quote]
[/quote]
According to the log file - which I trust - your first partition is the big one containing your iso-files.
I found that strange and looked at my own Ventoy pen drive - the EFI partition is the second one which is the last one of two partitions. The first one is the big one in case of my Ventoy pen drive.
You just have to follow the standard procedure and try to look into that first partition using Testdisk and search your iso's and files there:
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
There is an undelete function in the "advanced" menu.
If that fails use some commercial software or try using Photorec. It might be necessary to disable all formats in Photorec with the exception of the ISO file format.
The problem with ISO is that they contain lots of different file formats. Photorec typically stops recovering a file when it detecs a new file.
That means that finding a zip file header might finalize the recovery of an ISO file.
You might play around to see which settings yield the expected outcome.