Help recovering drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
muffinman
Posts: 3
Joined: 15 Apr 2013, 13:07

Help recovering drive

#1 Post by muffinman »

Hi guys,

Hoping you can help me out with recovering a drive.

I've attached a log file.

Essentially in windows it's coming up as RAW type. When I run testdisk, it can see the old partition, and the files in it. when I write the partition info, and reboot the computer, it just stays as RAW. I'm not sure if I'm missing a step here somewhere. maybe I'm setting it as the wrong type of partition?

I hope the attached logfile helps? If anyone can please help, and let me know what I can do to recover all the files, that'd be greatly appreciated!

Thanks,
muffinman

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help recovering drive

#2 Post by Fiona »

If a partition appears as RAW indicates, either a faulty boot sector or a damaged file system.
Your partition is available because it appears as RAW.
Another opportunity could be that your partition in your partition table doesn't match.
Diagnose would be, to have a try to repair your boot sector.
But before, a screen shot of your current partition structur would be appreciated.
It's your screen if you confirm at analyse in TestDisk.
If you'd like to, you can copy and paste the content of your testdisk.log.
You'lll find it in your testdisk folder.

Fiona

Gil42
Posts: 3
Joined: 14 Apr 2013, 04:09

Re: Help recovering drive

#3 Post by Gil42 »

Fiona,

I think me, this guy and some other people I've seen in this forum have the same problem: we write the new partition structure, but nothing happens! Replies are always toward the problem itself (disk shown as RAW, etc) and not towards the fact that TestDisk changed nothing on the drive.

I think we are missing some step, like if you tell TeskDisk to write new partition structure, it only schedules changes but doesn't do anything. Due to the fact that it asks to reboot the computer, I'm led to believe it will only make the changes on next startup. Maybe because it's a removable drive, it won't be there anymore on next startup. Or maybe it's a bug on TestDisk that should be closer looked at.

Well, I don't know, I just think that TestDisk is not doing anything on several cases on this forum, and am hoping that someone will give us a light on this subject.

Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Help recovering drive

#4 Post by Lito »

May be i am wrong, but the step people seem to miss is:
if you cannot see the files that your trying to save don't Write to the disk.
If you can see your data, the structure and files you recognize, save them first
to a different disk. The rest of operations revolve around getting the right Diagnostic and for that
we all need some sort of help from the TestDisk team members because of their expertise.
With a bit of luck people get around to read the instructions and get on with rebuilding, be it the Boot Sector,
the File Table or whatever. Must not expect miracles though. After you Write might be you should expect to go back to TestDisk and check if the job is finished, ie.: you can see your data, not go looking through Windows to find the disk.
One thing you have to remember is that you came to TestDisk to solve a problem that Windows either created or could not solve. Whilst this is not true for everyone, it is for a lot of cases if you look through the posts in the forum.

Gil42
Posts: 3
Joined: 14 Apr 2013, 04:09

Re: Help recovering drive

#5 Post by Gil42 »

Thanks for the reply, here are some comments:
Lito wrote:May be i am wrong, but the step people seem to miss is:
if you cannot see the files that your trying to save don't Write to the disk.
If you can see your data, the structure and files you recognize, save them first
to a different disk.
Did that... I could see the files and backed them up as much as I had other free storage to. Then I told TestDisk to write the new partition structure.
Lito wrote:After you Write might be you should expect to go back to TestDisk and check if the job is finished, ie.: you can see your data, not go looking through Windows to find the disk.
Did that too, I went right back to TestDisk and what I saw was the exact same thing as before, that's why I think TestDisk never actually wrote anything to my disk.

muffinman
Posts: 3
Joined: 15 Apr 2013, 13:07

Re: Help recovering drive

#6 Post by muffinman »

Fiona wrote:If a partition appears as RAW indicates, either a faulty boot sector or a damaged file system.
Your partition is available because it appears as RAW.
Another opportunity could be that your partition in your partition table doesn't match.
Diagnose would be, to have a try to repair your boot sector.
But before, a screen shot of your current partition structur would be appreciated.
It's your screen if you confirm at analyse in TestDisk.
If you'd like to, you can copy and paste the content of your testdisk.log.
You'lll find it in your testdisk folder.

Fiona
Hi Fiona,
Here's the current partition structure under the Quick analyse screen,

Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Partition Start End Size in sectors
>* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]

Here's the log file, after a deep analysis;
Sun Apr 14 11:15:50 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-11T19:48:47
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500106788864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202241024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=250056705024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=519241728
filewin32_getfilesize(\\.\J:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\J:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\J:
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:2020202057202d444d575a413141363232323139, FW:51.0AB51
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500JS-40MVB1, S/N:2020202057202d444d574e413159373236303139, FW:10.02E01
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-00TMA0, S/N:2020202057202d444d5750413157313433313034, FW:12.01C01
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST31000333AS, S/N:2020202020202020202020205435304551353239, FW:SD15
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKX-001CA0, S/N:2020202057202d444d5759413055333430353838, FW:15.01H15
Drive H: - 519 MB / 495 MiB - CHS 123 64 32, sector size=2048 - PIONEER DVD-RW DVR-216, FW:1.04

Partition table type (auto): Intel
Disk /dev/sda - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(4,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(4,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(4,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(4,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(4,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(4,7,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(4,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(4,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(4,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(4,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(4,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,16,buffer,984883326(61306/38/43)) ReadFile Data error (cyclic redundancy check).

file_pread(4,16,buffer,1877338112(116858/227/42)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,1877338112(116858/227/42)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,1877338111(116858/227/41)) ReadFile Data error (cyclic redundancy check).

file_pread(4,15,buffer,1877338113(116858/227/43)) ReadFile Data error (cyclic redundancy check).

file_pread(4,16,buffer,1877338175(116858/228/42)) ReadFile Data error (cyclic redundancy check).

file_pread(4,16,buffer,1877338191(116858/228/58)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,1877338191(116858/228/58)) ReadFile Data error (cyclic redundancy check).

BAD_RS LBA=2487853387 485930
check_part_i386 failed for partition type 01
FAT12 154861 181 20 320756 17 63 2665092887
This partition ends after the disk limits. (start=2487853387, size=2665092887, end=857978977, disk end=3907029168)
NTFS at 243201/45/44
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(4,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(4,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(4,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(4,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(4,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2638 GB / 2457 GiB)
The following partition can't be recovered:
FAT12 154861 181 20 320756 17 63 2665092887

Results
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
NTFS, blocksize=4096, 2000 GB / 1863 GiB


dir_partition inode=5
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Apr-2013 03:11 .
5 dr-xr-xr-x 0 0 0 11-Apr-2013 03:11 ..
35 dr-xr-xr-x 0 0 0 18-Feb-2012 10:40 $RECYCLE.BIN
3114 -r--r--r-- 0 0 370845362 26-Jun-2010 14:30 Deceived Cinematic Trailer.avi
13653 dr-xr-xr-x 0 0 0 26-May-2012 17:43 Downloads
3080 -r--r--r-- 0 0 384624737 11-Aug-2012 13:49 Lily Dance.MOV
42 dr-xr-xr-x 0 0 0 7-Apr-2013 15:15 Moviez
3425 dr-xr-xr-x 0 0 0 31-Jan-2011 22:31 msdownld.tmp
3346 dr-xr-xr-x 0 0 0 11-Sep-2011 15:51 Norton Backups
3426 dr-xr-xr-x 0 0 0 1-Feb-2011 07:25 Pictures
3188 -r--r--r-- 0 0 4714890240 16-Mar-2011 21:51 Sodexo Email backup.pst
3328 -r--r--r-- 0 0 4776600576 14-Mar-2011 20:02 Sodexo Emails.pst
13077 dr-xr-xr-x 0 0 0 7-Mar-2012 22:06 The Book Wakeboard Instructional Series
3112 -r--r--r-- 0 0 214665010 26-Jun-2010 12:39 The Force Unleashed 2 Trailer.avi
3113 -r--r--r-- 0 0 269118871 26-Jun-2010 12:40 The Old Republic - Hope.wmv
13858 dr-xr-xr-x 0 0 0 29-Jun-2012 07:29 The Pink Panther Cartoons
2956 dr-xr-xr-x 0 0 0 10-Apr-2013 02:30 Trailers
3347 dr-xr-xr-x 0 0 0 11-Sep-2011 15:51 VProRecovery
3115 -r--r--r-- 0 0 3319478272 8-Mar-2011 09:58 Windows_7_Professional_with_Service_Pack_1_64_bit_English_X17-24281.IMG
13500 dr-xr-xr-x 0 0 0 16-Sep-2012 15:29 Word
12701 dr-xr-xr-x 0 0 0 14-May-2011 17:53 Omi's Kitchen 1 2011-05-14 - 2011-05-14
15078 -r--r--r-- 0 0 6822254592 17-Jan-2013 09:23 SW_DVD9_NTRL_Win_Small_Bus_Svr_Std_2011_64Bit_English_FPP_VL_X16-93854.ISO
3393 dr-xr-xr-x 0 0 0 23-Dec-2010 21:48 System Volume Information

interface_write()
1 * HPFS - NTFS 0 32 33 243201 45 44 3907024896 [Store]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.


I hope this helps?

muffinman
Posts: 3
Joined: 15 Apr 2013, 13:07

Re: Help recovering drive

#7 Post by muffinman »

Anyone please?

Locked