Dynamic Disk - Lost Volume

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
thirdcherry
Posts: 8
Joined: 27 Jun 2012, 08:01

Dynamic Disk - Lost Volume

#1 Post by thirdcherry »

I have a Seagate ST325082 4AS - 250GB (232.88 GB) Hard Drive
C - 16383, H - 16, S - 63; Size - 512

I had three volumes on it: G:\ and H:\ and remaining space was extended from G:\
To make more room I moved all the data from H:\ and deleted the volume.
Then I extended volume G:\ to the remaining size of the drive.

When the system rebooted, the drive was not found and my data is not accessible.

Test Disk finds the partitions, but won't recover them -- error: Disk is too small.
When I try to correct the disk geometry - it says I should be using 255 for the Heads number.

But this still does not help, the main portion of my data still shows as not recoverable.

I urgently need this data! Your help is much appreciated!

*** Updated - Used current version TestDisk and Added Log File
Attachments
testdisk.zip
(2 KiB) Downloaded 443 times
Last edited by thirdcherry on 29 Jun 2012, 04:26, edited 1 time in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Dynamic Disk - Lost Volume

#2 Post by Fiona »

I'd need infos from Analyse, is your current partition table.
If you still have your testdisk.log file, would it be possible to zip and upload it.
Alternatively, you can copy and paste the content in your post.

Fiona

thirdcherry
Posts: 8
Joined: 27 Jun 2012, 08:01

Re: Dynamic Disk - Lost Volume

#3 Post by thirdcherry »

I was using AOMEI Dynamic Disk Manager to do the volume resize, which resulted in the failure and now lack of access to the disk.

I've contacted AOMEI and they recommend:
  • 1. Delete the Volumes and partitions
    2. Convert it to a basic disk
    3. Recover data with Test Disk
Does this make sense to do this way?

Thank you so much for all the help!

thirdcherry
Posts: 8
Joined: 27 Jun 2012, 08:01

Re: Dynamic Disk - Lost Volume

#4 Post by thirdcherry »

Please help:

Thu Jun 28 19:47:15 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-06-28T08:45:48
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120033041920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120033041920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=250056221184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=120031478784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=250057064448
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\I:
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST3120026A, S/N:4a3333543537414b202020202020202020202020, FW:3.06
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500JB-00GVC0, S/N:2020202057202d4443574c413837343631373732, FW:08.02D08
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ST325082 4AS, FW:3.AA
Disk /dev/sdd - 250 GB / 232 GiB - CHS 32301 240 63, sector size=512 - ST325082 4AS, FW:3.AA

Partition table type (auto): Intel
Disk /dev/sdc - 250 GB / 232 GiB - ST325082 4AS
Partition table type: Intel

Analyse Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 30401 14 60 488392944
No partition is bootable
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/1/1
filesystem size 3020157
sectors_per_cluster 4
mft_lcn 251679
mftmirr_lcn 377519
clusters_per_mft_record -10
clusters_per_index_record 2
HPFS - NTFS 0 1 1 187 254 63 3020157
NTFS, blocksize=2048, 1546 MB / 1474 MiB
NTFS at 188/0/1
filesystem size 488388911
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 17535951
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 188 0 1 30588 204 59 488388911 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
This partition ends after the disk limits. (start=3020220, size=488388911, end=491409130, disk end=488395055)
NTFS at 17653/0/1
filesystem size 204796620
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 12799788
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 17653 0 1 30400 254 63 204796620 [Portfolio]
NTFS, blocksize=4096, 104 GB / 97 GiB
file_pread(6,2,buffer,488396800(30401/75/11)) lseek err Invalid argument
file_pread(6,1,buffer,488396800(30401/75/11)) lseek err Invalid argument
file_pread(6,8,buffer,488395061(30401/47/36)) lseek err Invalid argument
file_pread(6,1,buffer,488395061(30401/47/36)) lseek err Invalid argument
file_pread(6,8,buffer,488395189(30401/49/38)) lseek err Invalid argument
file_pread(6,8,buffer,488395317(30401/51/40)) lseek err Invalid argument
file_pread(6,8,buffer,488395445(30401/53/42)) lseek err Invalid argument
file_pread(6,8,buffer,488395573(30401/55/44)) lseek err Invalid argument
file_pread(6,8,buffer,488395701(30401/57/46)) lseek err Invalid argument
file_pread(6,8,buffer,488395829(30401/59/48)) lseek err Invalid argument
file_pread(6,8,buffer,488395957(30401/61/50)) lseek err Invalid argument
file_pread(6,8,buffer,488396085(30401/63/52)) lseek err Invalid argument
file_pread(6,8,buffer,488396213(30401/65/54)) lseek err Invalid argument
file_pread(6,8,buffer,488396341(30401/67/56)) lseek err Invalid argument
file_pread(6,8,buffer,488396469(30401/69/58)) lseek err Invalid argument
file_pread(6,8,buffer,488396597(30401/71/60)) lseek err Invalid argument
file_pread(6,8,buffer,488396725(30401/73/62)) lseek err Invalid argument
file_pread(6,8,buffer,488396800(30401/75/11)) lseek err Invalid argument
file_pread(6,8,buffer,488396808(30401/75/19)) lseek err Invalid argument
file_pread(6,3,buffer,488396816(30401/75/27)) lseek err Invalid argument
file_pread(6,3,buffer,488396863(30401/76/11)) lseek err Invalid argument
file_pread(6,8,buffer,488396879(30401/76/27)) lseek err Invalid argument
file_pread(6,11,buffer,488396926(30401/77/11)) lseek err Invalid argument
file_pread(6,2,buffer,488398848(30401/107/43)) lseek err Invalid argument
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (250 GB / 232 GiB) seems too small! (< 251 GB / 234 GiB)
The following partition can't be recovered:
HPFS - NTFS 188 0 1 30588 204 59 488388911 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 187 254 63 3020157
NTFS, blocksize=2048, 1546 MB / 1474 MiB
P HPFS - NTFS 17653 0 1 30400 254 63 204796620 [Portfolio]
NTFS, blocksize=4096, 104 GB / 97 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 187 254 63 3020157

search_part()
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/1/1
filesystem size 3020157
sectors_per_cluster 4
mft_lcn 251679
mftmirr_lcn 377519
clusters_per_mft_record -10
clusters_per_index_record 2
HPFS - NTFS 0 1 1 187 254 63 3020157
NTFS, blocksize=2048, 1546 MB / 1474 MiB
NTFS at 187/231/44
filesystem size 283591929
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 17535951
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1545600512, part_size=145199067648, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 187/254/63
filesystem size 3020157
sectors_per_cluster 4
mft_lcn 251679
mftmirr_lcn 377519
clusters_per_mft_record -10
clusters_per_index_record 2
HPFS - NTFS 0 1 1 187 254 63 3020157
NTFS found using backup sector, blocksize=2048, 1546 MB / 1474 MiB
NTFS at 188/0/1
filesystem size 488388911
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 17535951
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 188 0 1 30588 204 59 488388911 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
This partition ends after the disk limits. (start=3020220, size=488388911, end=491409130, disk end=488395055)
Search for partition aborted
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (250 GB / 232 GiB) seems too small! (< 251 GB / 234 GiB)
The following partition can't be recovered:
HPFS - NTFS 188 0 1 30588 204 59 488388911 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 187 254 63 3020157
NTFS, blocksize=2048, 1546 MB / 1474 MiB

interface_write()
1 * HPFS - NTFS 0 1 1 187 254 63 3020157
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Dynamic Disk - Lost Volume

#5 Post by Fiona »

Has your disk been before a basic disk or a dynamical volume?
Do you want to convert it back to basic?
Your volume I: ends after disk limit.
There might be a trick to get data and probably to resize it.
Like in those examples;
http://forum.cgsecurity.org/phpBB3/plea ... lit=tricky
http://forum.cgsecurity.org/phpBB3/post ... icky#p2334
http://forum.cgsecurity.org/phpBB3/post ... icky#p1093
But before you'd write a partition table. it's advisable to copy/ backup your data using testdisk first.
The Value to extend your disk virtual is 30589!
Please copy/backup your data.
Your OS is Vista servicepack 2.
In your case, there is almost no reason to use any partition manager becaise since Vista you can use the disk management console to resize and create partitions.
But it'll come later.

Using TestDisk on dynamical disk to convert them back to basic, there is no necessity to delete any partitions.
Dynamic disks need no partition table.
They put a signatur of the volume at the end of the disk.
That entry in your partition table;
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 30401 14 60 488392944
It's only a dummy, so that another OS doesn't try to use that disk.
The partition ID is 42.
What TestDisk does.
If your Partitions are listed correctly for recovery (your data should be listed also) you can use the menu "Write" to write an Intel partition table.
After restart of your PC, your disk is a basic disk again and partitions are available.
That's it!

But now at the moment try to increase your disk (amount of cylinder as described) and list your data.
If yor data are listed, please copy/backup them.
Next step will be to have atry to write your partition table of your virtual increased disk.
Please not, to access a virtual disk on virtual space causes read errors because ther is no physically space.
But it's a normal behavior and often at the and of a disk is free space.

Fiona

thirdcherry
Posts: 8
Joined: 27 Jun 2012, 08:01

Re: Dynamic Disk - Lost Volume

#6 Post by thirdcherry »

Hi Fiona,

1. My disc was originally a Basic Disk
2. then converted to a Dynamic Disk
3. Then increased the volume size
4. Then attempted to resize volume again after deleting excess volume.

thirdcherry
Posts: 8
Joined: 27 Jun 2012, 08:01

Re: Dynamic Disk - Lost Volume

#7 Post by thirdcherry »

Hi Fiona,

The scan completes, but shows

HPFS - NTFS 0 1 1 187 254 63 3020157
HPFS - NTFS 188 0 1 30588 254 63 488392065 [Work]
HPFS - NTFS 17653 0 1 30400 254 63 204796620 [Portfolio]

The first partition I believe I was using as a scratch disk, and was 1GB partition. Eventually I deleted this partition and extended the Work Partition onto this one, successfully.

Partition 2 - Work - this is the main partition of data that I'm concerned about preserving.

Partition 3 - Portfolio - I had already deleted this volume, and was attempting to expand Work into this area when the drive failed to do that extension. I'm not concerned with recovering this data, I already have a backup of it.

Please advise how to mark these Partitions properly to get my data back. Currently, I only have *, P, and D as options.

Thank you!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Dynamic Disk - Lost Volume

#8 Post by Fiona »

I'll have a try to guide you through!
Your disk info were lacking, but I've got it from your first post and the testdisk.log.
Now it looks like that you're only concerned about your partition labeled "Work".

To access your disk, that your partition Work fits, you must increase the maount of cylinders to make that partition accessible.
Please, try the following;
Confirm in TestDisk through until you see Analyse.
Don't confirm at Analyse but Geometry.
Please check Cylinder.
Change the value to 30589 .
Leave the menu at OK
Check Analyse and press enter.
Proceed at Quick Search with enter also.
If TestDisk starts a scan, wait until you see that partition "Work".
Press enter to stop the scan.
Your partition with label "Work" should be listed.
Please upload a screen.
Check that partition and press p to list your files.
But it'd only possible as long as a boot sector is recognized
Do you see your files or an error message.
This is only intended for diagnosing purposes.
It doesn't change anything to your HDD.
Don't use write or anything else!

Please let me know.

Fiona

thirdcherry
Posts: 8
Joined: 27 Jun 2012, 08:01

Re: Dynamic Disk - Lost Volume

#9 Post by thirdcherry »

here's the screen after quick search.

Yes, if I press P I see all my files.

I don't currently have another hard drive to copy to, if I go get an external, will I be able to copy the data to there?
If I write to the disk, will it simply recover the data without me having to copy it to another drive?
Thanks!
Attachments
analyse_Work.jpg
analyse_Work.jpg (154.56 KiB) Viewed 8153 times

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Dynamic Disk - Lost Volume

#10 Post by Fiona »

Just have another disk/drive etc.. whre you can copy your data to.
It should be working.
Afterwards we can have a try to resize your partition.
But it's always recommended before you go to change anything to your diks/partition to have a backup!

Fiona

Locked