cgsecurity.org

Hi,

a few days ago one of my hard drives crashed when my PC got a BSOD. After this, the drive (originally NTFS is listed as RAW). Because the drive contains important information, I 'm uncertain how to continue.

I already did the analysis and tried a "Deeper Search" (this took multiple days and did not slightly finish). I know for sure the drive only contained two portions (one "Windows Reserved" and the data partition).

When looking into the analysis, I can see there are three portions:



The #2 is the original NTFS partition. When looking into the file structure in the analysis ("p") I can't see any file.

My questions:

• Why are there two #1?
  Is MS Reserved a correct type?
  How can I restore the filetype (NTFS) on #2?
  If the deeper search is not working because the disk is to big, how can I resolve the problem?

Best regards,
Heurazio

Please read the chapter about repairing filesystem in https://www.cgsecurity.org/testdisk.pdf and tell us what you have tried.

Hi,

I tried checkdisk with the result:

german/english:

Der Typ des Dateisystems ist NTFS.
Version und Status des Volumes konnten nicht festgestellt werden. CHKDSK wurde abgebrochen.

The type of the filesystem is NTFS. Version and status of the volume could not be determined. CHKDSK was canceled.

I also tried to repair the bootsektor using testdisk but both bootsektors (main and backup) are status "OK".

I tried to rebuild the Bootsektor but it's also running into an infinite loop (as you can see, the boarders are exceeded)

When I try to repair the MFT I get: