Need help partition recovery

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
yeakyau
Posts: 4
Joined: 26 Sep 2013, 02:26

1TB hard disk found alot partition

#1 Post by yeakyau »

Dear SIr /Madam,
I had one 1 TB hard disk cavair green actually uses to do testing on windows 8 / windows 7 etc..
last few day i used to backup my data transfer into this hard disk, suddenly it corrupted after using a ide / sata converter.
now i doing a deep search found alot of partition.. just wondering which should I choose i'm confusing when i press P to list the file in the partition it not found.. and i accident quite it have to scan all over again and again...

Image

yeakyau
Posts: 4
Joined: 26 Sep 2013, 02:26

Need help partition recovery

#2 Post by yeakyau »

HI,
need help how to recovery my partition.
I have 2 partition one is windows 8 C: . D: my backup document.
I just wonder which partition should i choose..
below is my print screen.
after perform a search i press P list to list out the directory it doesn't show any file or folder,
however my data parition should be around 600GB, and this hard disk has been used to do testing install windows.
Image
Image
HERE IS MY LOG FILE
ri Sep 27 00:39:48 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=266616176640
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=266721034240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=466759974912
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 129201 240 63, sector size=512 - WDC WD1002FAEX-00Z3A0, S/N:2020202057202d44435754413652333832393230, FW:05.01D05
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EARS-003BB1, S/N:2020202057202d44435756414a35383936333938, FW:80.00A80

Partition table type default to Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD10EARS-003BB1
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 976751937
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60799 254 63 976751937
NTFS, blocksize=4096, 500 GB / 465 GiB
NTFS at 71798/12/23
heads/cylinder 240 (NTFS) != 255 (HD)
filesystem size 6393856
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 71798 12 23 72196 12 8 6393856 [New Volume]
NTFS, blocksize=4096, 3273 MB / 3122 MiB
NTFS at 111358/107/46
heads/cylinder 240 (NTFS) != 255 (HD)
filesystem size 787314688
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 111358 107 46 160366 126 16 787314688 [New Volume]
NTFS, blocksize=4096, 403 GB / 375 GiB
This partition ends after the disk limits. (start=1788973056, size=787314688, end=2576287743, disk end=1953525168)
NTFS at 121599/254/63
filesystem size 976751937
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60800 1 1 121599 254 63 976751937
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 121599/254/63
filesystem size 976751937
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,4096,buffer,1959795455(121991/159/24)) lseek err Invalid argument
file_pread(5,1,buffer,1959795455(121991/159/24)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121599 254 63 182399 253 62 976751937
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=1953503999, size=976751937, end=2930255935, disk end=1953525168)
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1500 GB / 1397 GiB)
The following partitions can't be recovered:
HPFS - NTFS 111358 107 46 160366 126 16 787314688 [New Volume]
NTFS, blocksize=4096, 403 GB / 375 GiB
HPFS - NTFS 121599 254 63 182399 253 62 976751937
NTFS, blocksize=4096, 500 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=4
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 60799 254 63 976751937
NTFS, blocksize=4096, 500 GB / 465 GiB
HPFS - NTFS 60800 1 1 121599 254 63 976751937
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
HPFS - NTFS 71798 12 23 72196 12 8 6393856 [New Volume]
NTFS, blocksize=4096, 3273 MB / 3122 MiB
Can't open backup.log file: No such file or directory
interface_load

interface_write()
1 * HPFS - NTFS 0 1 1 60799 254 63 976751937

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: 1TB hard disk found alot partition

#3 Post by cgrenier »

There are CHS (Cylinder, Head, Sector) for the beginning and end of the partition. The last number is its size in sector.
The partition listed in the first screenshot is using the first half of the disk.

You need to try to list the content of each partition.

yeakyau
Posts: 4
Joined: 26 Sep 2013, 02:26

Re: Need help partition recovery

#4 Post by yeakyau »

it is using "p" to list out the content? =)

yeakyau
Posts: 4
Joined: 26 Sep 2013, 02:26

Re: Need help partition recovery

#5 Post by yeakyau »

May i know why it take so slow to copy the data to the new HDD, almost 1days, only get 165GB data it run quiet slow

Locked