cgsecurity.org

Hello all,

i wonder if someone can help me. This is the issue:

Accidently i deleted a partion with gparted wile shorting the partition. i shorted the partition and the partition was deleted (so, heres is ne thing - delete, resize and create a partion).
Next i tried to recover the partition with no luck. Than i created another fullsize partition and tried to recover the partition with no luck... Am i missing something?

No data was writen in this partition/Disk - Only 2 partitions were created.
The Disk is in this partition format: 1 boot partition / 1 Primary (no data) partition / 1 Windows Recovery partition

Oneother thing if i may... can i recover windows with my disk has it is?

Thanks in advanced

Mayuru wrote: 26 Sep 2020, 11:21 Accidently i deleted a partion with gparted wile shorting the partition. i shorted the partition and the partition was deleted (so, heres is ne thing - delete, resize and create a partion).
Next i tried to recover the partition with no luck. Than i created another fullsize partition and tried to recover the partition with no luck... Am i missing something?

No data was writen in this partition/Disk - Only 2 partitions were created.
The Disk is in this partition format: 1 boot partition / 1 Primary (no data) partition / 1 Windows Recovery partition

You did not tell which partition is affected neither you posted a logfile for others to see.
If you did not succeed using Testdisk including the deep search function there is Photorec left.

Oneother thing if i may... can i recover windows with my disk has it is?

I apologize I don't understand what "with my disk has it is?" means.

Hey, thanks for the reply and sorry my not so good english.

i manage to find the partition that i wanted and now i just need to recover it without messing up .


Here is the log:



Sun Sep 27 00:33:35 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Função incorreta.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Função incorreta.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Função incorreta.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Função incorreta.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Função incorreta.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Função incorreta.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Função incorreta.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Função incorreta.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=235764624384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=498210963456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=0
Warning: can't get size for \\.\T:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=0
Warning: can't get size for \\.\U:
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - TOSHIBA-TR200, S/N:Z7LB654OK46S, FW:SBFA12.6
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA WDC WD5000BPVT-2, S/N:A11R0983, FW:1A01

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - ATA WDC WD5000BPVT-2
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Info: size boot_sector 716793, partition 716800
NTFS at 44/190/19
check_part_i386 3 type 27: no test
Current partition structure:
1 * HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
2 P HPFS - NTFS 44 190 19 60615 113 42 973068288 [Novo volume]
3 P Windows RE(store) 60615 146 12 60742 41 35 2033664

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-196
FAT2 : 197-392
start_rootdir : 393
Data : 425-401560
sectors : 401562
cluster_size : 8
no_of_cluster : 50142 (2 - 50143)
fat_length 196 calculated 196

FAT16 at 0/1/1
FAT16 >32M 0 1 1 24 254 63 401562 [DellUtility]
FAT16, blocksize=4096, 205 MB / 196 MiB
NTFS at 44/190/19
filesystem size 973068288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 60615 113 42 973068288 [Novo volume]
NTFS, blocksize=4096, 498 GB / 463 GiB
NTFS at 60615/146/12
filesystem size 2033664
sectors_per_cluster 8
mft_lcn 84736
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60615 146 12 60742 41 35 2033664
NTFS, blocksize=4096, 1041 MB / 993 MiB
NTFS at 60801/80/15
filesystem size 976054265
sectors_per_cluster 8
mft_lcn 683597
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 26 60801 80 15 976054265
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
NTFS at 60801/80/15
filesystem size 976054265
sectors_per_cluster 8
mft_lcn 683597
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,982241901(61141/186/19)) lseek err Invalid argument
file_pread(5,1,buffer,982241901(61141/186/19)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 60801 80 15 121557 225 4 976054265
NTFS, blocksize=4096, 499 GB / 465 GiB
This partition ends after the disk limits. (start=976773119, size=976054265, end=1952827383, disk end=976773168)
file_pread(5,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(5,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(5,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(5,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(5,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(5,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(5,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(5,16,buffer,976773168(60801/81/1)) ReadFile O período de tempo de espera do semáforo expirou.

file_pread(5,3,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_pread(5,3,buffer,976773231(60801/82/1)) lseek err Invalid argument
file_pread(5,11,buffer,976773294(60801/83/1)) lseek err Invalid argument
file_pread(5,2,buffer,976775216(60801/113/33)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 999 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60801 80 15 121557 225 4 976054265
NTFS, blocksize=4096, 499 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* FAT16 >32M 0 1 1 24 254 63 401562 [DellUtility]
FAT16, blocksize=4096, 205 MB / 196 MiB
HPFS - NTFS 44 190 19 60615 113 42 973068288 [Novo volume]
NTFS, blocksize=4096, 498 GB / 463 GiB
HPFS - NTFS 44 190 26 60801 80 15 976054265
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
HPFS - NTFS 60615 146 12 60742 41 35 2033664
NTFS, blocksize=4096, 1041 MB / 993 MiB

interface_write()
1 * FAT16 >32M 0 1 1 24 254 63 401562 [DellUtility]

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
FAT16 at 0/1/1
FAT1 : 1-196
FAT2 : 197-392
start_rootdir : 393
Data : 425-401560
sectors : 401562
cluster_size : 8
no_of_cluster : 50142 (2 - 50143)
fat_length 196 calculated 196

FAT16 at 0/1/1
FAT16 >32M 0 1 1 24 254 63 401562 [DellUtility]
FAT16, blocksize=4096, 205 MB / 196 MiB
NTFS at 0/32/33
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 44 190 11 716793 [System Reserved]
NTFS, blocksize=4096, 366 MB / 349 MiB
NTFS at 44/190/18
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 40 44 190 18 716793
NTFS found using backup sector, blocksize=4096, 366 MB / 349 MiB
NTFS at 44/190/19
filesystem size 973068288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 60615 113 42 973068288 [Novo volume]
NTFS, blocksize=4096, 498 GB / 463 GiB
NTFS at 89/93/4
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 26 89 93 4 716793
NTFS found using backup sector, blocksize=4096, 366 MB / 349 MiB
NTFS at 29365/160/43
filesystem size 471039993
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 26 29365 160 43 471039993
NTFS found using backup sector, blocksize=4096, 241 GB / 224 GiB
NTFS at 30123/254/63
filesystem size 483223212
sectors_per_cluster 8
mft_lcn 683597
mftmirr_lcn 1514
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 30123 254 63 483223212
NTFS found using backup sector, blocksize=4096, 247 GB / 230 GiB
NTFS at 60615/113/42
filesystem size 973068288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 19 60615 113 42 973068288 [Novo volume]
NTFS found using backup sector, blocksize=4096, 498 GB / 463 GiB
NTFS at 60615/146/12
filesystem size 2033664
sectors_per_cluster 8
mft_lcn 84736
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60615 146 12 60742 41 35 2033664
NTFS, blocksize=4096, 1041 MB / 993 MiB
NTFS at 60742/41/35
filesystem size 2033664
sectors_per_cluster 8
mft_lcn 84736
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60615 146 12 60742 41 35 2033664
NTFS found using backup sector, blocksize=4096, 1041 MB / 993 MiB
NTFS at 60801/47/46
filesystem size 944058368
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2036 69 18 60801 47 46 944058368
NTFS found using backup sector, blocksize=4096, 483 GB / 450 GiB
file_pread(5,2,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,2,buffer,976773200(60801/81/33)) lseek err Invalid argument
file_pread(5,1,buffer,976773200(60801/81/33)) lseek err Invalid argument
NTFS at 60801/80/15
filesystem size 976054265
sectors_per_cluster 8
mft_lcn 683597
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 44 190 26 60801 80 15 976054265
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
NTFS at 60801/80/15
filesystem size 976054265
sectors_per_cluster 8
mft_lcn 683597
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,982241901(61141/186/19)) lseek err Invalid argument
file_pread(5,1,buffer,982241901(61141/186/19)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 60801 80 15 121557 225 4 976054265
NTFS, blocksize=4096, 499 GB / 465 GiB
This partition ends after the disk limits. (start=976773119, size=976054265, end=1952827383, disk end=976773168)
file_pread(5,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(5,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(5,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(5,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(5,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(5,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(5,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(5,16,buffer,976773168(60801/81/1)) ReadFile O período de tempo de espera do semáforo expirou.

file_pread(5,3,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_pread(5,3,buffer,976773231(60801/82/1)) lseek err Invalid argument
file_pread(5,11,buffer,976773294(60801/83/1)) lseek err Invalid argument
file_pread(5,2,buffer,976775216(60801/113/33)) lseek err Invalid argument
NTFS at 0/32/33
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/11
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/18
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/11
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/18
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/19
filesystem size 973068288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/11
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/18
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/19
filesystem size 973068288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/11
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/18
filesystem size 716793
sectors_per_cluster 8
mft_lcn 16260
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 44/190/19
filesystem size 973068288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 999 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60801 80 15 121557 225 4 976054265
NTFS, blocksize=4096, 499 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
FAT16 >32M 0 1 1 24 254 63 401562 [DellUtility]
FAT16, blocksize=4096, 205 MB / 196 MiB
HPFS - NTFS 0 32 33 44 190 18 716800 [System Reserved]
NTFS, blocksize=4096, 367 MB / 350 MiB
HPFS - NTFS 0 32 40 44 190 18 716793
NTFS found using backup sector, blocksize=4096, 366 MB / 349 MiB
HPFS - NTFS 44 190 11 89 92 52 716793
NTFS, blocksize=4096, 366 MB / 349 MiB
HPFS - NTFS 44 190 18 89 92 59 716793
NTFS, blocksize=4096, 366 MB / 349 MiB
HPFS - NTFS 44 190 19 30124 5 25 483223552
NTFS found using backup sector, blocksize=4096, 247 GB / 230 GiB
HPFS - NTFS 44 190 19 60615 113 42 973068288 [Novo volume]
NTFS, blocksize=4096, 498 GB / 463 GiB
HPFS - NTFS 44 190 26 89 93 4 716793
NTFS found using backup sector, blocksize=4096, 366 MB / 349 MiB
HPFS - NTFS 44 190 26 29365 160 43 471039993
NTFS found using backup sector, blocksize=4096, 241 GB / 224 GiB
HPFS - NTFS 44 190 26 60801 80 15 976054265
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
HPFS - NTFS 2036 69 18 60801 47 46 944058368
NTFS found using backup sector, blocksize=4096, 483 GB / 450 GiB
HPFS - NTFS 60615 146 12 60742 41 35 2033664
NTFS, blocksize=4096, 1041 MB / 993 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

Did you run an analysis on the drive that you messed up?
Did you run deep search?
Are you able to find the data you are missing using the "p"-key ("list files")?

Yes i run the analysis and Deep Search. Now i found the partition, by chance (as i´m new at Testdisk)
And yes, the "p" key showed me the files i lost

Here are 2 images:




I think i only need to recover. Is that right?

I can't see your images.
Please upload them using the attachment tab on the bottom of the page.

Anyway, when being in the "list files" menu, you are able to select files and folders and trigger copying them to a target location.
Be careful to copy to a location on another healthy drive!

I see...
But can i recover the partition? If i can recover, what is the best way?

Images attached

Copying your desired files or even the content of the whole partition to another drive is non-destructive.

Your system reserved partition ends at 44 190 18.
Your chosen partition where you listed your files starts at 44 190 19.
In an MBR-style partitioning scheme there is at least one free sector required between each partition.
There is no unused sector between those two, unfortunately.

Maybe your disk was partitioned in GPT mode, I don't know. In this case this additional free sector is not required.
I don't know how your setup has been initially.

I would recommend copying for you.

Ok thanks!
I will accept your solution - Copy the files.
Maybe the disk will boot again after copy all the files to its original place, as my ideia was to get the drive booting again. If there is no chance to do that, no worry, i will try to work arround.
Perhaps Gparted will help.

Well... I have tryed to copy the files, but the Windows/Users/Program Files/... folders are empty.
Any ideas?