Repairing an NTFS

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Repairing an NTFS

#1 Post by veleiro »

Hi, first post here. I am hoping that with testdisk I can finally fix my problem

I have a Western Digital My Book Essential 1TB external hard drive that I keep like basically all of my data on (the important stuff, as a backup, the unimportant not backed up but would still like to keep). And recently, the whole USB connector came out of the circuit board on the external enclosure! So, not wanting to deal with reconnecting the input to the board, I removed the external HD from its casing and connected it directly to my pc via SATA. In windows, It could not see the drive *Begin mistake*, so I loaded up computer management -> Disk management. Immediately, I was presented with this window. I selected the default MBR option. On top of that, I assigned the drive a letter. So, then I realized that I've done this before (a while back), and I've just overwritten the sectors that show what my data is! *end mistake* Now Windows wants me to format the disk.

I've scanned the hard drive with GetDataBack 4.25 several times, for hours, only to not be able to find any MFTs (and a bad sector towards the end of the disk that I was able to skip over).

So what I want to know is: Do I have a better chance with testdisk, and if so, what route should I take?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Repairing an NTFS

#2 Post by cgrenier »

Try Analyse, Quick Search, Deeper Search... as explaiined in
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
Please post the testdisk.log file or screenshots

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#3 Post by veleiro »

It says the *.log extensions isnt allowed for attachment here.

I spent all day doing the quick search and deeper search, neither found any partition. It seems like nothing was written to the log after both searches too, so I am not sure if that is correct or incorrect. Anyways, here it is


Mon Mar 12 15:31:34 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=159934054400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=8066271232
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000202043392
file_pread(4,1,buffer,312581919(73444/223/19)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 73444 224 19, sector size=512 - WDC WD1600JB-00EVA0, S/N:4457572d414d4b45303332343534 034 0 0 0 0, FW:15.05R15
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EADS-11M2B2, S/N:2020202057202d44435756414335313134383337, FW:80.00A80
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500KS-00MJB0, S/N:2020202057202d4443574e41334b313539353935, FW:02.01C03
Drive E: - 8066 MB / 7692 MiB - CHS 1923 64 32, sector size=2048 - ASUS DRW-1608P3S, FW:1.06

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD10EADS-11M2B2
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
No partition is bootable
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,7,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
No partition is bootable


screenshot is showing the only informative menu yet (fat16? not even close)
Attachments
screen.jpg
screen.jpg (60.77 KiB) Viewed 10125 times

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#4 Post by veleiro »

Actually, the log wrote after I closed the program. Here is the result.


Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
No partition is bootable

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#5 Post by Fiona »

FAT16 >32M is only a partition type windows is using when you create a partition.
File system will be allocated when you format your partition.
But don't format your partition, otherwise you'll override your previous file system.

Your partition is created using Win7 or Vista.
Those partitions are aligned on megabyte boundary.
Intel partitions are aligned on cylinder boundary.
So partition layout is different.

Do you know how your lost partition was created (only NTFS formatted or did you create and format your Partition using Win7 or Vista)?
Did you use any software like backup or encryption included on this disk?
Because it's unusual that GetDataBack doesn't find anything.
Are you absolutely sure that it was NTFS, because your hdd got delivered FAT32 preformatted.

I only need those infos to better diagnose your disk.
Further information to diagnose your disk will follow

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#6 Post by veleiro »

My lost partition was left as it was from the factory, so whatever WD had it as (I was pretty sure it was NTFS though). The only thing i might gave changed was I got rid of the "CD" part where you plug in the disk and there is a partition for MyBook that has like installation files and autorun stuff on it.

As far as I know, I did not use any encryption or backup software on the disk.

Are you saying that the MyBook from WD (http://wdc.com/global/products/specs/?d ... language=1) comes formatted at FAT32 then? If so, its possible that mine was. I assumed NTFS because I checked the FS of an exact copy of my drive that a friend has, and it was NTFS

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#7 Post by Fiona »

Would it be possible to check it using GetDataBack for FAT?
You can scan your drive using the testversion.
I'll exclude any problem about different file systems.
Please let me know if it would find something.

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#8 Post by veleiro »

Yes, I've actually already scanned it with for FAT several times. It goes through the whole thing, says it finds 40k files and a bad sector somewhere 99%, and then after skipping over that at the end it says try using GetDataBack for NTFS

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Repairing an NTFS

#9 Post by cgrenier »

Using TestDisk, Advanced, Type, force the type to NTFS (7), Boot, RebuildBS
If it works, choose Write and confirm, if it doesn't, please post the testdisk.log file content.

veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#10 Post by veleiro »

Is it advisable to backup before I do this? I'm only asking because I have no where to backup a 1TB drive at this moment, nor the funding to do so.

In other words, if it doesn't work, will it be more unrecoverable than it already is?

EDIT: And one more thing I've forgotten to ask. Which partition table type do I select, Intel (like last time)? Maybe I should scan it with another partition type?

Locked