Need clarification on commands, disk geometry

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
amp7
Posts: 2
Joined: 23 Apr 2013, 14:28

Need clarification on commands, disk geometry

#1 Post by amp7 »

Hello all,

I am new to using TestDisk so let me apologise if my question comes across as somewhat naive.

TestDisk initially warned that my disk geometry was wrong. I changed the geometry, did a deeper search, and TestDisk came up with 4 partitions; first one fat other three NTFS, all marked as D and overlapping. I can change partition 2 from D to * without any problems but when I go from D to something else on partitions three and four I get Structure: Bad in red.

The only partition I am interested in keeping is the partition 2. Found many of my more important files on it and copied them to my C: drive.

Is it safe to mark partition 2 with a *, leave the other three as D and proceed?
What exactly does the D option delete? Does the fact that I was able to copy files over to my C: drive mean the disk geometry I provided is correct?
Is there a way to make certain that the geometry is correct?

Just want to make certain that I am not asking the software to delete a portion of partition 2 given that partition 3 overlaps partition 2 and is marked with D or about to do something which will further corrupt the disk.

Thanks Amp7



Tue Apr 23 12:10:08 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-14T19:46:54
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=81964302336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=81964302336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80015491584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=548790272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=47591437824
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 10337 240 63, sector size=512 - WDC WD800JB-00JJA0, S/N:4457572d4143394d373333303039203420202020, FW:05.01C05
Disk /dev/sdb - 81 GB / 76 GiB - CHS 2354213 4 17, sector size=512 - Maxtor 6 Y080L0, FW:YAR4
Drive D: - 548 MB / 523 MiB - CHS 130 64 32, sector size=2048 - HL-DT-ST CD-RW GCE-8520B, FW:1.00

Partition table type (auto): Intel
Disk /dev/sdb - 81 GB / 76 GiB - Maxtor 6 Y080L0
Partition table type: Intel

Analyse Disk /dev/sdb - 81 GB / 76 GiB - CHS 2354213 4 17
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=63 17
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 3 13 1366942 1 17 92952027
1 * HPFS - NTFS 0 3 13 1366942 1 17 92952027

Warning: Bad ending sector (CHS and LBA don't match)

search_part()
Disk /dev/sdb - 81 GB / 76 GiB - CHS 2354213 4 17
FAT12 at 0/3/13
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8

FAT12 at 0/3/13
FAT12 0 3 13 305 3 11 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
Search for partition aborted
Warning: the current number of heads per cylinder is 4 but the correct value may be 255.

Results
L FAT12 0 3 13 305 3 11 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended 0 1 1 305 3 17 20791
5 L FAT12 0 3 13 305 3 11 20739 [NO NAME]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=17
New geometry
Disk /dev/sdb - 81 GB / 76 GiB - CHS 9964 255 63 sector_size=512

Analyse Disk /dev/sdb - 81 GB / 76 GiB - CHS 9964 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 1 5785 254 63 92952027
1 * HPFS - NTFS 0 1 1 5785 254 63 92952027

search_part()
Disk /dev/sdb - 81 GB / 76 GiB - CHS 9964 255 63
FAT12 at 0/1/1
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 0/1/1
FAT12 0 1 1 1 75 12 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* FAT12 0 1 1 1 254 63 32067 [NO NAME]
FAT12, blocksize=4096, 16 MB / 15 MiB

interface_write()
1 * FAT12 0 1 1 1 254 63 32067 [NO NAME]

search_part()
Disk /dev/sdb - 81 GB / 76 GiB - CHS 9964 255 63
FAT12 at 0/1/1
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 0/1/1
FAT12 0 1 1 1 75 12 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
NTFS at 5786/254/63
filesystem size 92968092
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 3931904
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 5786 254 63 92968092
NTFS found using backup sector, blocksize=4096, 47 GB / 44 GiB
NTFS at 5787/0/1
filesystem size 67103505
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4193969
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5787 0 1 9963 254 63 67103505 [New Volume]
NTFS, blocksize=4096, 34 GB / 31 GiB
NTFS at 9962/254/63
filesystem size 97144992
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 6071561
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 3916 1 1 9962 254 63 97144992
NTFS found using backup sector, blocksize=4096, 49 GB / 46 GiB
NTFS at 9963/254/63
filesystem size 67103505
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4193969
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5787 0 1 9963 254 63 67103505 [New Volume]
NTFS found using backup sector, blocksize=4096, 34 GB / 31 GiB
file_pread(5,2,buffer,160088064(9965/5/25)) lseek err Invalid argument
file_pread(5,1,buffer,160088064(9965/5/25)) lseek err Invalid argument
file_pread(5,2,buffer,160086972(9964/243/4)) lseek err Invalid argument
file_pread(5,2,buffer,160087035(9964/244/4)) lseek err Invalid argument
file_pread(5,2,buffer,160087098(9964/245/4)) lseek err Invalid argument
file_pread(5,1,buffer,160087724(9964/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,160087725(9965/0/1)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=7
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=7

Results
FAT12 0 1 1 1 254 63 32067 [NO NAME]
FAT12, blocksize=4096, 16 MB / 15 MiB
HPFS - NTFS 0 1 1 5786 254 63 92968092
NTFS found using backup sector, blocksize=4096, 47 GB / 44 GiB
HPFS - NTFS 3916 1 1 9962 254 63 97144992
NTFS found using backup sector, blocksize=4096, 49 GB / 46 GiB
HPFS - NTFS 5787 0 1 9963 254 63 67103505 [New Volume]
NTFS, blocksize=4096, 34 GB / 31 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 5786 254 63 92968092
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Need clarification on commands, disk geometry

#2 Post by Fiona »

TestDisk and 255 Heads looks correct.
After Deeper Search testdisk found some NTFS partitions.
Did you mark your found NTFS-partitions and did you press p to have a try to list your files?
If your files are displayed on any partitions, please let me know on which ones?

Fiona

amp7
Posts: 2
Joined: 23 Apr 2013, 14:28

Re: Need clarification on commands, disk geometry

#3 Post by amp7 »

Hi Fiona,

Yes, the files were on partition 2. I was able to copy the more important files to my C: drive.

I flagged partition 2 with an *, left the other three partitions with a D, and did the write.
Then TestDisk asked me to recreate my boot record from backup and I did this as well.

Now I can access the drive when it's designated as a slave but I cannot boot from it.
Comes back with "A disk read error occurred. Press CTRL-ALT-DEL to restart". So now I am onto
trying to solve this one.

I assume the problem is some kind of mismatch between what the BIOS expects and the boot record
is providing but just guessing at this point.

If you can point me in the right direction, I would very much appreciate it.

Thanks amp7

Locked