NTFS disks went RAW

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Niels
Posts: 3
Joined: 06 Jan 2013, 21:20

NTFS disks went RAW

#1 Post by Niels »

Hi,

I could use some help recovering some NTFS disks that went RAW on my Windows 7 Ultimate system. I don't know what happened, system was running very slow, after reboot I got a "disk read error" before anything started. I removed the disk and plugged in a USB-device attached to a different computer. This showed the following:
Windows Disk Management
Windows Disk Management
disk2-image.png (5.45 KiB) Viewed 3689 times
Disk has four partitions/drives: H was my D-drive. This one still works fine. J was my C-drive, this one I would like very much to recover. According to the Medion Helpdesk G is a bitlocker partition.

I have run the testdisk analyse, but I am unsure how to continue. The log file up to now reports the following:

Code: Select all

Sun Jan  6 13:14:15 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999317045248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202241024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2647570432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=53687091200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=945336352768
filewin32_getfilesize(\\.\L:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\L:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\L:
file_pread(4,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST310005 28AS, S/N:V93P3XBV, FW:CC45
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST310003 33AS
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Generic External, S/N:MSE5235V1NXG2U, FW:2.10
Drive E: - 2647 MB / 2524 MiB - CHS 631 64 32, sector size=2048 - DTSOFT BDROM, FW:1.05

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - Generic External
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
NTFS at 114943/120/58
check_part_i386 4 type 12: no test
Current partition structure:
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS             12 223 20 114943 120 57 1846360064
 2 P HPFS - NTFS             12 223 20 114943 120 57 1846360064
 3 P HPFS - NTFS          114943 120 58 121470 142 16  104857600 [Recover]
 4 P Compaq Diagnostics   121470 142 17 121601  48 31    2098608
Computes LBA from CHS for Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, 104 MB / 100 MiB
file_pread(6,16,buffer,206848(12/223/20)) read err: Invalid argument
file_pread(6,1,buffer,206848(12/223/20)) read err: Invalid argument
file_pread(6,7,buffer,206849(12/223/21)) read err: Invalid argument
file_pread(6,16,buffer,259151(16/33/33)) read err: Invalid argument
file_pread(6,1,buffer,259151(16/33/33)) read err: Invalid argument
file_pread(6,16,buffer,2925941(182/33/33)) read err: Invalid argument
file_pread(6,16,buffer,4899951(305/2/1)) read err: Invalid argument
file_pread(6,1,buffer,4899961(305/2/11)) read err: Invalid argument
file_pread(6,16,buffer,4899967(305/2/17)) read err: Invalid argument
file_pread(6,1,buffer,4899967(305/2/17)) read err: Invalid argument
file_pread(6,16,buffer,4921470(306/88/37)) read err: Invalid argument
file_pread(6,1,buffer,4921470(306/88/37)) read err: Invalid argument
file_pread(6,16,buffer,4923455(306/120/6)) read err: Invalid argument
file_pread(6,1,buffer,4923456(306/120/7)) read err: Invalid argument
file_pread(6,8,buffer,4923471(306/120/22)) read err: Invalid argument
file_pread(6,16,buffer,4925566(306/153/38)) read err: Invalid argument
file_pread(6,1,buffer,4925568(306/153/40)) read err: Invalid argument
file_pread(6,16,buffer,4934003(307/32/33)) read err: Invalid argument
file_pread(6,1,buffer,4934003(307/32/33)) read err: Invalid argument
file_pread(6,16,buffer,6598672(410/190/53)) read err: Invalid argument
file_pread(6,1,buffer,6598672(410/190/53)) read err: Invalid argument
file_pread(6,16,buffer,26388606(1642/156/49)) read err: Invalid argument
file_pread(6,1,buffer,26388606(1642/156/49)) read err: Invalid argument
file_pread(6,16,buffer,34019328(2117/154/22)) read err: Invalid argument
file_pread(6,1,buffer,34019328(2117/154/22)) read err: Invalid argument
file_pread(6,7,buffer,34019329(2117/154/23)) read err: Invalid argument
file_pread(6,16,buffer,34019391(2117/155/22)) read err: Invalid argument
file_pread(6,1,buffer,34019391(2117/155/22)) read err: Invalid argument
file_pread(6,8,buffer,34019407(2117/155/38)) read err: Invalid argument
file_pread(6,11,buffer,34019454(2117/156/22)) read err: Invalid argument

LVM magic value at 55837/73/45
NTFS at 114943/120/58
filesystem size           104857600
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          114943 120 58 121470 142 16  104857600 [Recover]
     NTFS, 53 GB / 50 GiB
NTFS at 121470/142/17
filesystem size           2098608
sectors_per_cluster       8
mft_lcn                   87442
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          121470 142 17 121601  48 31    2098608
     NTFS, 1074 MB / 1024 MiB
file_pread(6,2,buffer,1953525200(121601/81/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525200(121601/81/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525231(121601/82/1)) lseek err Invalid argument
file_pread(6,1,buffer,1953525231(121601/82/1)) lseek err Invalid argument
file_pread(6,2,buffer,1953525263(121601/82/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525263(121601/82/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,7,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(6,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(6,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(6,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, 104 MB / 100 MiB
   P HPFS - NTFS          114943 120 58 121470 142 16  104857600 [Recover]
     NTFS, 53 GB / 50 GiB
   P HPFS - NTFS          121470 142 17 121601  48 31    2098608
     NTFS, 1074 MB / 1024 MiB

interface_write()
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
 2 P HPFS - NTFS          114943 120 58 121470 142 16  104857600 [Recover]
 3 P HPFS - NTFS          121470 142 17 121601  48 31    2098608  
After the deeper search it shows this screen (not in the log file (yet)).
Testdisk console after deeper search
Testdisk console after deeper search
disk2-image-testdisk-1.png (53.4 KiB) Viewed 3689 times
All partitions are now marked as deleted. Quick look at the partition now named "boot" shows files, so I am hopeful that I can recover the drive. I guess I need to change the D into *, P and perhaps L, but the big question what partition should get what mark? Could anybody help me out with this?

Also, do the read and lseek errors in the log, mean the disk is bad and should I have it replaced? The system still has warranty.

Tnx,

Niels

Niels
Posts: 3
Joined: 06 Jan 2013, 21:20

Re: NTFS disks went RAW

#2 Post by Niels »

Hi,

I read up on Windows 7. First partition should contain the boot files and must be marked primary bootable. The others should be primary. After making the changes I saved the partitioning table; no errors here. Next I tried to replace the damaged boot sector with the Backup BS. Unfortunately I got a writer error. Turns out the drive has bad sector(s) at the location of the boot sector. Is it possible to recover from this by writing the boot sector at a different location?

Any help on that is appreciated, even if it is just for future knowledge.

Currently I am running GetDataBack for NTFS. Results look very promising, so at least I will get (most) of my data back.

Also I have tested the disk with a tool from Hitachi/HGST (it is a Hitachi disk) called Drive Fitness Test for Windows. This reports
ReadErrorCeck: Pass;
SmartSelfTest: Fail
So I guess the disk is broken and should be returned.

Niels

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: NTFS disks went RAW

#3 Post by Fiona »

Would it be possible to check your disk using Crystal Disk Info?
http://crystalmark.info/software/Crysta ... dex-e.html
As long as TestDisk displays your data, you can copy them too.
Might be a good solution to save/backup valueable data first.
Don't stress your disk as much if it already contains bad sectors?

Fiona

Niels
Posts: 3
Joined: 06 Jan 2013, 21:20

Re: NTFS disks went RAW

#4 Post by Niels »

Hi,

Crystal Disk Info shows this
Crystal Disk Info
Crystal Disk Info
CrystalDiskInfoStatus.png (100.05 KiB) Viewed 3681 times
Niels

Locked