cgsecurity.org

I have a Seagate 2TB drive connected via USB on Windows 7. Originally it had two NTFS partitions, one 48GB and one 1815GB. I used software called Macrorit Partition Expert to delete the 48GB partition and resize the remaining partition to take up all of the space on the drive. Afterwards I was left with a drive with one RAW partition. I followed the steps listed in the step-by-step to recover a RAW partition with Testdisk 7.1. It showed the both of the old partitions including the correct sizes and labels. After choosing "Write" it said to reboot. I rebooted and now I have the 48GB partition restored, which originally contained nothing (and still does), but the 1815gb partition is still listed as raw. Testdisk shows it as NTFS with the correct label, Windows disk management shows it as RAW, and Windows Explorer says "E:\ is not accessible. The file or directory is corrupted and unreadable."

I tried the step-by-step instructions again and nothing changed.

When I choose P to list files for the 48GB partition it does so correctly. When I choose P to list files for the 1815GB partition Testdisk exits with a dump. The dump file begins with "Exception: STATUS_ACCESS_VIOLATION at eip=0046A87A"
The end of the log file says "ntfs_attr_open failed: No such file or directory. 1 [main] testdisk_win 892 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump"

I tried Repair MFT in the Testdisk Advanced menu and it exits with a dump. The dump file begins with "Exception: STATUS_ACCESS_VIOLATION at eip=0046A87A"
The end of the log file says again "ntfs_attr_open failed: No such file or directory. 1 [main] testdisk_win 5092 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump"

I tried the Advanced menu to check the boot sector and it says the boot sector and backup boot sector are both OK and identical.

I tried chkdsk /f e: and I get:

The type of the file system is NTFS.
Volume label is Tigger.
Corrupt master file table. Windows will attempt to recover
master file table from disk.
Windows cannot recover master file table. CHKDSK aborted.

I tried Photorec and when I try to search only the 1815GB partition, the application crashes. If I try to search the whole drive it recovers files but splits them (one file is now a dozen or more separate files) and uses a seemingly random number file system, making the recovered files useless.

If I use MiniTool Partition Wizard 12, it says the 1815GB partition is NTFS and 100% used (It should be 92% used). It can also read files on that partition, but can not see file names. This is especially frustrating because recovering the file names is actually more important than recovering the data itself. The data are useless without the file names.

Is this a lost cause, or is there another avenue I can try? If I should post a log file, let me know which attempt I should post the log file for.
Thanks in advance, any help is greatly appreciated.

Can you try latest PhotoRec 7.2-WIP ? (Select the partition, Search, Whole) Does the application work better ?

Thank you for the reply. PhotoRec 7.2-WIP does the same thing.

Using either qphotorec_win or photorec_win, choosing "Whole" runs a scan, but the recovered files have randomly generated names which I can't use, for example: f0894068.mpg, f0894500.mpg, f0897292.mpg, and so on. Some of the files have the randomly generated name followed by the original file name with under scores between the words. But there are few of these, and they seem to be only certain file types, like zip and html, for example f10001024_vs_w2k_1.zip. All audio and video files, as well as text files, DLL files, etc are only numbered.

Choosing "Free" on either causes the program to terminate immediately.

Is there any way to still recover the partition since this software and others can still see it as NTFS but can't see the files?

I've found that the program called Recuva is able to retrieve files with their file names intact, but the directory structure is still lost. This makes it possible to retrieve files if I can remember the specific file name, but otherwise it's basically 60,000 files in one folder. I have a feeling I won't be able to get any farther than this.

DrVlikhell wrote: 11 May 2020, 11:40 Is there any way to still recover the partition since this software and others can still see it as NTFS but can't see the files?

You can try out one third party tool after another or pay for a professional recovery service.

Otherwise never resize any partition at the beginning. Extending a partition with free space can be considered acceptable.
Moving the beginning of a partition is such a dangerous operation that you are better off buying a drive having at least the same capacity.
You partition the new drive and copy stuff from source to target. Finally you run another program to compare the contents.