Bad relative sector, partition table gone? SSD failed?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
peti
Posts: 2
Joined: 03 Sep 2021, 20:12

Bad relative sector, partition table gone? SSD failed?

#1 Post by peti »

Hi,
I have a Lenovo Thinkpad Yoga S1 20CD with 256 GB SSD. I purchased it in 2014, came with Win8 which at one point was upgraded to Win10, but I never changed the partitions.

It all worked fine until one day it failed to boot.
I didn't have a windows recovery drive, so I created one on another windows PC (I didn't think it's specific to the computer on which it was created). The laptop was able to boot from the USB stick, but it wasn't able to do any recovery, when I entered to command line mode, it only saw one partition (not the main one). At this point I probably made a mistake by running `bootrec /fixmbr` (given that it used UEFI boot).
Eventually I booted a live image, tried TestDisk locally, dd'd the entire disk into a file, tried TestDisk on it on a different computer... without much results.

Questions part 1
  • are the chances of recovery lower if I just use an image instead of the actual disk? I.e. does TestDisk utilize any additional information about the device that isn't available in the image?
  • I simply used `dd` (with conv=noerror,sync), as I didn't know about `ddrescue`. how is `ddrescue` different, isn't it exact copy either way?
If I select `Intel` for partition table, it does seem to find 4 partitions, but the offsets are obviously conflicting... and the partition types are also a bit odd.
Using 7.2-WIP x86_64 in Linux on the actual laptop and disk:

Code: Select all

Fri Aug 27 19:49:17 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 4.19.0-8-amd64 (#1 SMP Debian 4.19.98-1 (2020-01-26)) x86_64
Compiler: GCC 4.8
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       500118192 sectors
/dev/sda: user_max   500118192 sectors
/dev/sda: native_max 500118192 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - LITEONIT LCS-256M6S, S/N:S0C38670Z1ZSX7018263, FW:1C85205
Disk /dev/sdb - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD Elements 25A2, FW:1021
Disk /dev/sdc - 4089 MB / 3900 MiB - CHS 1022 126 62, sector size=512 - Generic Flash Disk, FW:8.07
Disk /dev/loop0 - 639 MB / 609 MiB - 1248488 sectors (RO), sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 256 GB / 238 GiB - LITEONIT LCS-256M6S
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
check_part_i386 1 type 7E: no test
BAD_RS LBA=2372971140 11327173
check_part_i386 2 type 27: no test
BAD_RS LBA=2744523419 6632306
check_part_i386 3 type 23: no test
BAD_RS LBA=3376438281 8166664
check_part_i386 4 type 57: no test
 2 * Windows RE(store)    147710 158 37 328700 141 53 2907603296
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330
 3 * Sys=23               170838 173 51 409356 186  1 3831792440
 4 * Sys=57               210173 143 28 217580  73 60  118989078

Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
check_part_i386 1 type 7E: no test
BAD_RS LBA=2372971140 11327173
check_part_i386 2 type 27: no test
BAD_RS LBA=2744523419 6632306
check_part_i386 3 type 23: no test
BAD_RS LBA=3376438281 8166664
check_part_i386 4 type 57: no test
Current partition structure:
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330

Bad relative sector.
 2 * Windows RE(store)    147710 158 37 328700 141 53 2907603296

Bad relative sector.
 3 * Sys=23               170838 173 51 409356 186  1 3831792440

Bad relative sector.
 4 * Sys=57               210173 143 28 217580  73 60  118989078

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 2 * Windows RE(store)    147710 158 37 328700 141 53 2907603296
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330
Space conflict between the following two partitions
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330
 3 * Sys=23               170838 173 51 409356 186  1 3831792440
Space conflict between the following two partitions
 3 * Sys=23               170838 173 51 409356 186  1 3831792440
 4 * Sys=57               210173 143 28 217580  73 60  118989078
Using 7.1 i386 in Linux on a different computer on an image:

Code: Select all

Thu Sep  2 12:43:38 2021
Command line: TestDisk /log /media/peti/Elements/thinkpad.dd

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.10.40-1rodete2-amd64 (#1 SMP Debian 5.10.40-1rodete2 (2021-06-22)) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
User is not root!
Hard disk list
Disk /media/peti/Elements/thinkpad.dd - 256 GB / 238 GiB - CHS 31133 255 63, sector size=512

Partition table type (auto): Intel
Geometry from i386 MBR: head=192 sector=44
Disk /media/peti/Elements/thinkpad.dd - 256 GB / 238 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
BAD_RS LBA=2372971140 11327173
BAD_RS LBA=2744523419 6632306
BAD_RS LBA=3376438281 8166664
 2 * Windows RE(store)    147710 158 37 328700 141 53 2907603296
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330
 3 * Sys=23               170838 173 51 409356 186  1 3831792440
 4 * Sys=57               210173 143 28 217580  73 60  118989078

Analyse Disk /media/peti/Elements/thinkpad.dd - 256 GB / 238 GiB - CHS 31133 255 63
Geometry from i386 MBR: head=192 sector=44
BAD_RS LBA=2720002641 13875095
BAD_RS LBA=2372971140 11327173
BAD_RS LBA=2744523419 6632306
BAD_RS LBA=3376438281 8166664
Current partition structure:
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330

Bad relative sector.
 2 * Windows RE(store)    147710 158 37 328700 141 53 2907603296

Bad relative sector.
 3 * Sys=23               170838 173 51 409356 186  1 3831792440

Bad relative sector.
 4 * Sys=57               210173 143 28 217580  73 60  118989078

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 2 * Windows RE(store)    147710 158 37 328700 141 53 2907603296
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330
Space conflict between the following two partitions
 1 * Sys=7E               169312  85  7 305091  64 24 2181288330
 3 * Sys=23               170838 173 51 409356 186  1 3831792440
Space conflict between the following two partitions
 3 * Sys=23               170838 173 51 409356 186  1 3831792440
 4 * Sys=57               210173 143 28 217580  73 60  118989078
I also tried partition type `None`, `EFI GPT`, as well as randomly changing geometry (I don't have much idea what the correct values should be, so just used whatever suggestions I could find online... for other devices) e.g. sector_size=4096, heads=240, etc. but I couldn't get anything more (not even these for `EFI GPT` or `None`), and didn't find anything with `Analyze`/`Deeper Search` either, except for three `LVM magic values`:

Code: Select all

Disk /dev/sda - 256 GB / 238 GiB - LITEONIT LCS-256M6S
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1 31130 233 63  500118192
Image created successfully.

Interface Advanced
   P Unknown                  0   0  1 31130 233 63  500118192

Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
Current partition structure:
   P Unknown                  0   0  1 31130 233 63  500118192

search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63

LVM magic value at 21083/249/47

LVM magic value at 21083/249/50

LVM magic value at 21083/249/53

Results
Questions part 2
  • Does the partition table (printed for `Intel`) make any sense? If so, do those partition types (7E, 23, 57) look correct? If not, what may be the correct type?
  • Does anyone have an idea what the correct geometry should be for a 256GB SSD in a ThinkPad (from 2014)?
  • Any idea what the typical partition table for Windows/ThinkPad looks like (or looked in 2014)? E.g. first 1GB EFI, followed by 4GB FAT for recovery, rest is NTFS.
  • Do partition tables/partitions still actually address using CHS or is the geometry only used for aligning partitions on cylinder boundaries? The later would mean that I wouldn't need to check all the possible geometry configurations, but could just search using heads=sectors=1
  • If geometry does matter, I wonder how I could automate checking all the configurations. I understand that I can specify geometry parameters using command line flags, but I'm not sure how I should parse the output to recognize success
  • Any other suggestions?
Thank you!

Peter

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Bad relative sector, partition table gone? SSD failed?

#2 Post by recuperation »

peti wrote: 10 Sep 2021, 02:54 Hi,
I have a Lenovo Thinkpad Yoga S1 20CD with 256 GB SSD. I purchased it in 2014, came with Win8 which at one point was upgraded to Win10, but I never changed the partitions.

It all worked fine until one day it failed to boot.
I didn't have a windows recovery drive, so I created one on another windows PC (I didn't think it's specific to the computer on which it was created). The laptop was able to boot from the USB stick, but it wasn't able to do any recovery, when I entered to command line mode, it only saw one partition (not the main one). At this point I probably made a mistake by running `bootrec /fixmbr` (given that it used UEFI boot).
Eventually I booted a live image, tried TestDisk locally, dd'd the entire disk into a file, tried TestDisk on it on a different computer... without much results.

Questions part 1
  • are the chances of recovery lower if I just use an image instead of the actual disk? I.e. does TestDisk utilize any additional information about the device that isn't available in the image?
Testdisk is probably using the total size and the geometry information. Look into this clean log file here:

viewtopic.php?f=9&t=11649
[*]I simply used `dd` (with conv=noerror,sync), as I didn't know about `ddrescue`. how is `ddrescue` different, isn't it exact copy either way?
[/list]
ddrescue is using some smart logic to avoid erroneous zones in order to maintain a high transfer rate. The difficult stuff comes last and this way a higher percentage of data can be recovered in a given time.

Questions part 2
  • Does the partition table (printed for `Intel`) make any sense?
No.
If so, do those partition types (7E, 23, 57) look correct?
No.
If not, what may be the correct type?
I have no idea.
[*]Does anyone have an idea what the correct geometry should be for a 256GB SSD in a ThinkPad (from 2014)?
Not me. And I guess it does not help anyway.
[*]Any idea what the typical partition table for Windows/ThinkPad looks like (or looked in 2014)? E.g. first 1GB EFI, followed by 4GB FAT for recovery, rest is NTFS.
Unspecific question. The device in question is a Yoga.
[*]Do partition tables/partitions still actually address using CHS
The old MBR-style table is filled the CHS values. My Windows XP machine use that information to start up.
or is the geometry only used for aligning partitions on cylinder boundaries?

There is no "OR". XP did align on cylinder boundaries. Modern operating systems do not align on cylinder boundaries and they don't rely on the CHS figures in the partition table to boot.


The later would mean that I wouldn't need to check all the possible geometry configurations, but could just search using heads=sectors=1
[*]If geometry does matter, I wonder how I could automate checking all the configurations. I understand that I can specify geometry parameters using command line flags, but I'm not sure how I should parse the output to recognize success
[*]Any other suggestions?
Use smartmontools to be able to read the autobiography of your drive.
[/list]

peti
Posts: 2
Joined: 03 Sep 2021, 20:12

Re: Bad relative sector, partition table gone? SSD failed?

#3 Post by peti »

Thanks for the prompt reply!
recuperation wrote: 10 Sep 2021, 11:53
peti wrote: 10 Sep 2021, 02:54 [*]Any idea what the typical partition table for Windows/ThinkPad looks like (or looked in 2014)? E.g. first 1GB EFI, followed by 4GB FAT for recovery, rest is NTFS.
Unspecific question. The device in question is a Yoga.
Well, it's a ThinkPad Yoga, so I'd assume that the factory set up is similar to that of other ThinkPad devices...
recuperation wrote: 10 Sep 2021, 11:53
peti wrote: 10 Sep 2021, 02:54 [*]Do partition tables/partitions still actually address using CHS
The old MBR-style table is filled the CHS values. My Windows XP machine use that information to start up.
peti wrote: 10 Sep 2021, 02:54 or is the geometry only used for aligning partitions on cylinder boundaries?

There is no "OR". XP did align on cylinder boundaries. Modern operating systems do not align on cylinder boundaries and they don't rely on the CHS figures in the partition table to boot.
So there's no point trying to guess the correct geometry as the partition table I'm trying to recover is independent of geometry anyways (i.e. if testdisk cannot recover an EFI partition table with a random geometry it wouldn't be able to recover it using the correct geometry either), right?

Locked