cgsecurity.org

Posted: **30 Jun 2020, 21:55**

Thanks for the testdisk and Photorec tool !! Awesome work !

Windows 10 upgrade left my data drive in RAW state. My 4TB data drive with all my photos, videos and documents.

Background : Running Windows 7 tried Windows 10 upgrade on the desktop. Windows 10 Upgrade ran for sometime and was NOT successful and reverted the upgrade and said it put my system back to Windows 7.

- System is bootable and usable running Windows 7, Boot Drive C: and Drive E & L are OK

BUT the upgrade left my K Drive "RAW"

- Prior to Windows 10 I had MOVED all my personal data to internal drive K: [ 4 TB Seagate Internal SATA drive ]
- When accessing my K drive [which is RAW]
Windows says need to format and gives me the popup not accessible and does not contain recognizable FS.

I'm recovering the files
- Recovered some files using Photorec
- Also recovered files using RecoverIT and EaseUS Data Recovery

There are still files missing and not recovered.

Is there anyway I can fix my K Drive "RAW" back to "NTFS" WITHOUT losing my data.

Below is the output from testdrive. Please let me know if you need any additional details.

Would really appreciate if you can help me fixing this Drive [without losing data].

Thanks

Posted: **01 Jul 2020, 07:23**

Try TestDisk, Advanced, Boot, RebuildBS, List.
If you can see your files, choose Write, confirm, Quit and restart your computer.

Run "cmd" (right click run as administrator) and "chkdsk /f k:". What is the result ?

Posted: **01 Jul 2020, 23:30**

Thanks for replying to the post. Much Appreciated.

FYI :

Analyse Selection shows the below

Code: Select all

Analyse

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 1801 GB / 1678 GiB - CHS 219051 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 2 P MS Data                   264192 7814035455 7813771264 [Basic data partitio
 2 P MS Data                   264192 7814035455 7813771264 [Basic data partitio
n]



                P=Primary  D=Deleted
>[Quick Search]  [ Backup ]

Sorry about the step by step instructions.

I think I'm in the correct screen now

After I select Menu option "Advanced"

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 1801 GB / 1678 GiB - CHS 219051 255 63

     Partition                  Start        End    Size in sectors
  1 P MS Reserved                   34     262177     262144 [Microsoft reserved
> 2 P MS Data                   264192 7814035455 7813771264 [Basic data partition]

After selecting Partition 2 -> "MS Data 264192 7814035455 7813771264 [Basic data partition] "
Select menu option "Type"

Under Choose the Partition Type

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

 2 P MS Data                   264192 7814035455 7813771264 [Basic data partiti
Please choose the partition type, press Enter when done.

 EFI System                Linux LVM                 Solaris /boot
 Extended Boot             Linux Reserved            Solaris /
 MBR                       Linux /home               Solaris Swap
 FreeBSD                   Linux /src                Solaris Backup
 FreeBSD Swap              Linux filesys. data       Solaris /usr
 FreeBSD UFS               HPUX Data                 Solaris /var
 FreeBSD Vinum             HPUX Service              Solaris /home
 FreeBSD ZFS               Apple APFS                Solaris EFI Alt.
 MS Reserved               Mac HFS                   Solaris Reserved1
>MS Data                   Mac UFS                   Solaris Reserved2
 MS LDM MetaData           Mac Raid                  Solaris Reserved3
 MS LDM Data               Mac Raid (Offline)        Solaris Reserved4
 Windows Recovery Env      Mac Boot                  Solaris Reserved5
 Linux Raid                Mac Label
 Linux Swap                Mac TV Recovery

[ Proceed ]

Select entry > "MS Data" and then [ Proceed ]

Takes me to

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

 2 P Unknown                   264192 7814035455 7813771264 [Basic data partitio
Please choose the partition type, press Enter when done.

>Unknown                   HFS+                      Netware
 BeFS                      HFSX                      NTFS
 btrfs                     HPFS                      OpenBSD

Selecting item -> "NTFS"

Selecting menu option to " List " says "Can't open filesystem. Filesystem seems damaged.

If I Select menu Option >"[ Boot ]"

[ Boot ] Menu Option takes me to the below screen with error/warning message

ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical

Should I be selecting Menu option == > "[ Rebuild BS]" ?

Screen shot with messages below

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdc - 1801 GB / 1678 GiB - CHS 219051 255 63
     Partition                  Start        End    Size in sectors
 2 P MS Data                   264192 7814035455 7813771264 [Basic data partition]
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

>[  Quit  ]  [Rebuild BS]  [  Dump  ]
                            Return to Advanced menu

Posted: **02 Jul 2020, 14:30**

I did the "[ Rebuild BS ]" it finished with message

Extrapolated boot sector and current boot sector are different.

Did the list to see files, there are some files but my the main photos and video folders are empty.

Should I still select the [ Write ] option ? and then recycle and chkdsk /f drive: Would chkdsk be able to fix the files missing in photos and video folders ?

Would appreciate if you can please let me know

[ Rebuild BS ]
Completed with the below messages

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 1801 GB / 1678 GiB - CHS 219051 255 63
     Partition                  Start        End    Size in sectors
 2 P MS Data                   264192 7814035455 7813771264 [Basic data partition]
filesystem size           7813771264 8608572918651759008
sectors_per_cluster       8 43
mft_lcn                   786432 5000227602372420001
mftmirr_lcn               2 6953868991201561143
clusters_per_mft_record   -10 13
clusters_per_index_record 1 32
Extrapolated boot sector and current boot sector are different.

 [  Dump  ] >[  List  ]  [ Write  ]  [  Quit  ]
                           List directories and files

Posted: **04 Jul 2020, 06:42**

For the case where the result does not meet your expectations I would duplicate the drive with ddrescue before modifying it (changing bootsector, running chkdsk).
If that solution fails you might have more chances with third party software.

cgsecurity.org

Windows 10 Upgrade left my Data drive K: [RAW]

Windows 10 Upgrade left my Data drive K: [RAW]

Re: Windows 10 Upgrade left my Data drive K: [RAW]

Re: Windows 10 Upgrade left my Data drive K: [RAW]

Re: Windows 10 Upgrade left my Data drive K: [RAW]

Re: Windows 10 Upgrade left my Data drive K: [RAW]