cgsecurity.org

Hello, I have a problem here.

My disk is accessible, Encrypted, but, the content is not visible.

1) From Windows, it says the drive is not accessible. The parameter is incorrect.



2) From Wondershare Recovery, I can see all my files: One of the partition is NTFS D: and one of the partition is Raw Files D:, with a lesser volume. I am thinking, it is caused by the Raw Partition.



3) Therefore, in the Computer Management, because of ONE partition NTFS, another RAW, it returns "Unknown"



4) I am using testdisk 7.2 to recover my files.

- I can see my disk drive.



- I select Intel/PC Partition



- done with few scanning, it takes really fast --> RESULT, cannot find the partition.

- yesterday night, the scanning can be proceed. It takes around 6 hours. I think it is going on well. But --> RESULT, cannot find the partition.

- today, press enter, performing deep scan.

This is how it looks like:


============================

I think, I need to replace the bad segments with the good ones.

I shall post the progress later in this thread.

Anyone has any suggestion please do share.

Cheers,
May

Hi, All the scanning return 0 partition.

This is how it looks like:


I have 2 Option:
1. Load Backup
2. Enter to continue

I select Enter to continue, and this is what I have got:



I can see the below screen from one of my attempts:



it listed 2 line, with the asterisk in front.
it shows that this is corrupted.
I select BACKUP, and this is what I have got:



I read, and the document says, if it can find the partition, then select LIST to list out the files, then I can select WRITE.

Now that at the right hand side, there is no Partition 1, Partition 2... so, it seems that I still cannot find the partition, and the file list.

So, I select Deeper Search.

And, the cycle goes again...






can someone share some light?

How should I go about it?

Hello,

What is the meaning of the below log ?? it says "Fail for Partition Type 07"

I am diagnosing, and I am thinking, the drive could be saved.

I am first time using this software, so, I am not sure, if my steps are correct?

Below is the latest log file:

==================================================================================
Thu May 27 17:53:43 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=510770806784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000397884928
Hard disk list
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - SAMSUNG MZVLB512HBJQ-000L7, S/N:0025_3882_11C7_E64C., FW:5M2QEXF7
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78R7PD, FW:0143

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - Seagate BUP Slim RD
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 243201 80 62 3907027119
1 * HPFS - NTFS 0 32 33 243201 80 62 3907027119

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63

Results
interface_load
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63 Wed May 26 21:36:18 2021
1 * HPFS - NTFS 0 32 33 243201 80 62 3907027119
check_part_i386 failed for partition type 07
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 0 32 32 243201 80 62 3907027120
5 L HPFS - NTFS 0 32 33 243201 80 62 3907027119



==================================================================================

https://en.wikipedia.org/wiki/Partition_type



Question:

1. from the image, fail for partition type 07 - Rebootable YES, so it means my hard disc still has the opportunity to be saved?

2. the problem now is - I still cannot access the partition and the file list. What steps I have missed?

What step should I perform to see the partition, list the files and recover it??

Testdisk does not support encrypted partitions. I wonder how your Wondershare program is able to decrypt encrypted information.

Hi,

Thanks!!!!!

With regards to Wondershare, after I key in my password to unlock the drive, this is what I did -->

And this is how it goes:


See it starts scanning:


See it actually haulted at 50%:


NOW, after another 4 hours, it is at 73%..... it stood at 50% for a long time


=======================================================================

The data seems just at my fingertips, and yet I cannot access it!!

=======================================================================

Yesterday I performed the Deep scan, and this is how it looks like.



For my situation, I can still see Drive D: from My Computer. And right click to Unlock this Drive.

And, it did ask me to key in my Bit Locker password to unlock the drive.

Therefore, the drive can be unlocked! BUT, when I double click to open the drive, it prompt me a message: "Parameter is not correct!"


I am thinking, my situation is more like the one shown in this thread --> viewtopic.php?t=1431


If the encrypted filesystem isn't damaged, you can use TestDisk, select the logical drive (ie. D:), partition type: None, Advanced, Undelete to recover the deleted file.

If the filesystem is ok and the encryption is done file by file, it may be possible to recover the encrypted file using PhotoRec, PhotoRec already supports OpenPGP/GNUPG, eCryptfs.

If the filesystem is damaged and the encryption is done on the whole filesystem, after unlocking the volume with your passphrase, try
- TestDisk, select the logical drive (ie. D:), partition type: None, Advanced, List.
- PhotoRec, remember to select the logical drive



=======================================================================

OK, so, I tried to select the Logical Drive (D:), partition type: None, Advanced, and I need to select the Type

Click Advance >


Select Type >


Look! I tried every one of the type shown, and select Undelete, and it returns me this:

Select Undelete >


It returns me with this, saying "Can't open filesystem. Filesystem seems damanged."


If I select LIST, it returns me with the same result: "Can't open filesystem. Filesystem seems damanged."


---------------------------------------------------------------------------------------

Now, is there other option that I can try?

Appreciate your help on this please...

Thanks for the advice!!!


=======================================================================

here I append the log file:

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - Seagate BUP Slim RD
Partition table type: None

Interface Advanced
P Unknown 0 0 1 243201 80 62 3907029167
Change partition type:
P Unknown 0 0 1 243201 80 62 3907029167

Interface Advanced
P Unknown 0 0 1 243201 80 62 3907029167
Change partition type:
P Unknown 0 0 1 243201 80 62 3907029167
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - Seagate BUP Slim RD
Partition table type: None

Interface Advanced
P Unknown 0 0 1 243201 80 62 3907029167
Change partition type:
P Unknown 0 0 1 243201 80 62 3907029167

Interface Advanced
P Unknown 0 0 1 243201 80 62 3907029167
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - Seagate BUP Slim RD
Partition table type: None

Interface Advanced
P Unknown 0 0 1 243201 80 62 3907029167
Change partition type:
P Unknown 0 0 1 243201 80 62 3907029167
Change partition type:
P Unknown 0 0 1 243201 80 62 3907029167

Analyse Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:
P Unknown 0 0 1 243201 80 62 3907029167

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.



What option that I can still give it a try?

Appreciate your help on this please...

Thanks for the advice!!!



Cheers