Real mess, please help

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Real mess, please help

#1 Post by Mhn15 »

Hello people,

I have two hard drives on my computer one is for Linux and the other for Windows 10.
The problem is with the Windows hard drive.

I have two main partitions on that drive "C:" for OS and it is about 200G and the rest is allocated to "D:" for my important files and it is about 800G :(
There were several partitions that are very small in size like "Recovery" and others that I didn't know what they are and how they got there!
ANYWAY:
I was trying to reinstall Windows again "Clean install" but I was prompted with a message "Can't install Windows on GPT drive"
I didn't know what that meant, so I just formatted and deleted all those annoying little partitions along with OS partition. :mrgreen:
it didn't work and it required the drive to be converted to GPT.
There was a way to do so using the cmd and diskpart command, but that would've formatted the whole drive and I would've lost my precious D: partition as well.

I started reading here and there and found that it is more likely than not that I'm going to lose "D" partition if I ever converted the drive to GPT.
so I thought I should recover Windows and everything I formatted, move my files out of "D", and then format the drive.

From Linux, I launched Testdisk, it found the deleted partitions, BUT here is the thing:
when I clicked "write", it deleted "D" :shock:
"D" is showing right now as free unallocated space

Image


Running a Deep scan I took this screen shot

Image

and this one when it finished:

Image


I want to be out of this mess please help.
and YES I'm a proud rookie :mrgreen:
Top
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Re: Real mess, please help

#2 Post by Mhn15 »

Code: Select all



Wed Dec  1 09:30:46 2021
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.14.0-kali4-amd64 (#1 SMP Debian 5.14.16-1kali1 (2021-11-05)) x86_64
Compiler: GCC 10.3
ext2fs lib: 1.46.4, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.2
User is not root!
Hard disk list


TestDisk exited normally.
Using locale 'en_US.UTF-8'.


Wed Dec  1 09:30:49 2021
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.14.0-kali4-amd64 (#1 SMP Debian 5.14.16-1kali1 (2021-11-05)) x86_64
Compiler: GCC 10.3
ext2fs lib: 1.46.4, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.2
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       1953525168 sectors
/dev/sda: user_max   1953525168 sectors
/dev/sda: native_max 1953525168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       488281250 sectors
/dev/sdb: user_max   488281250 sectors
/dev/sdb: native_max 488281250 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-00RKKA0, S/N:WD-WCC1S6592957, FW:80.00A80
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - WDC WD2500AAJS-75M0A0, S/N:WD-WMAV2DY01994, FW:02.03E02

Partition table type (auto): EFI GPT
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EZEX-00RKKA0
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 38/94/57
NTFS at 67/79/13
Info: size boot_sector 405569108, partition 405569536
Current partition structure:
 1 * HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
 2 P HPFS - NTFS             38  94 57    50 253 11     202752
 3 P HPFS - NTFS             67  79 13 25312 215 55  405569536

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           614400
sectors_per_cluster       8
mft_lcn                   25600
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 67/79/13
filesystem size           405569108
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             67  79 13 25312 209  5  405569108
     NTFS, blocksize=4096, 207 GB / 193 GiB
NTFS at 25312/215/56
filesystem size           1130496
sectors_per_cluster       8
mft_lcn                   47104
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/87/49
filesystem size           1814528
sectors_per_cluster       8
mft_lcn                   75605
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS, blocksize=4096, 929 MB / 886 MiB
NTFS at 96104/205/38
filesystem size           409597952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          96104 205 38 121601  25 24  409597952 [Linux]
     NTFS, blocksize=4096, 209 GB / 195 GiB
NTFS at 121601/57/56
filesystem size           1543923712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
NTFS at 121601/57/56
filesystem size           1543923712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB
This partition ends after the disk limits. (start=1953523711, size=1543923712, end=3497447422, disk end=1953525168)
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1790 GB / 1667 GiB)
The following partition can't be recovered:
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB

Results
     HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS, blocksize=4096, 314 MB / 300 MiB
     HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS, blocksize=4096, 103 MB / 99 MiB
     HPFS - NTFS             67  79 13 25312 215 55  405569536
     NTFS, blocksize=4096, 207 GB / 193 GiB
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS, blocksize=4096, 578 MB / 552 MiB
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS, blocksize=4096, 929 MB / 886 MiB
     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
     HPFS - NTFS          96104 205 38 121601  25 24  409597952 [Linux]
     NTFS, blocksize=4096, 209 GB / 195 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 614400 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 616448" | dmsetup create test1
echo "0 405569536 linear /dev/sda 1081344" | dmsetup create test2
echo "0 1130496 linear /dev/sda 406650880" | dmsetup create test3
echo "0 1814528 linear /dev/sda 407783424" | dmsetup create test4
echo "0 1543923712 linear /dev/sda 409600000" | dmsetup create test5
echo "0 409597952 linear /dev/sda 1543923712" | dmsetup create test6

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 38/94/57
NTFS at 67/79/13
Info: size boot_sector 405569108, partition 405569536
Current partition structure:
 1 * HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
 2 P HPFS - NTFS             38  94 57    50 253 11     202752
 3 P HPFS - NTFS             67  79 13 25312 215 55  405569536

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           614400
sectors_per_cluster       8
mft_lcn                   25600
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 67/79/13
filesystem size           405569108
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             67  79 13 25312 209  5  405569108
     NTFS, blocksize=4096, 207 GB / 193 GiB
NTFS at 25312/215/56
filesystem size           1130496
sectors_per_cluster       8
mft_lcn                   47104
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/87/49
filesystem size           1814528
sectors_per_cluster       8
mft_lcn                   75605
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS, blocksize=4096, 929 MB / 886 MiB
NTFS at 121601/57/56
filesystem size           1543923712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
NTFS at 121601/57/56
filesystem size           1543923712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB
This partition ends after the disk limits. (start=1953523711, size=1543923712, end=3497447422, disk end=1953525168)
Search for partition aborted
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1790 GB / 1667 GiB)
The following partition can't be recovered:
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB

Results
     HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS, blocksize=4096, 314 MB / 300 MiB
     HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS, blocksize=4096, 103 MB / 99 MiB
     HPFS - NTFS             67  79 13 25312 215 55  405569536
     NTFS, blocksize=4096, 207 GB / 193 GiB
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS, blocksize=4096, 578 MB / 552 MiB
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS, blocksize=4096, 929 MB / 886 MiB
     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 614400 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 616448" | dmsetup create test1
echo "0 405569536 linear /dev/sda 1081344" | dmsetup create test2
echo "0 1130496 linear /dev/sda 406650880" | dmsetup create test3
echo "0 1814528 linear /dev/sda 407783424" | dmsetup create test4
echo "0 1543923712 linear /dev/sda 409600000" | dmsetup create test5
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           614400
sectors_per_cluster       8
mft_lcn                   25600
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/56
filesystem size           614400
sectors_per_cluster       8
mft_lcn                   25600
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS found using backup sector, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 50/253/11
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS found using backup sector, blocksize=4096, 103 MB / 99 MiB
NTFS at 67/79/13
filesystem size           405569108
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             67  79 13 25312 209  5  405569108
     NTFS, blocksize=4096, 207 GB / 193 GiB
file_pread(4,16,buffer,6012928(374/73/20)) read err: Partial read
file_pread(4,16,buffer,6012927(374/73/19)) read err: Partial read
file_pread(4,16,buffer,6012944(374/73/36)) read err: Input/output error
file_pread(4,1,buffer,6012944(374/73/36)) read err: Input/output error
BAD_RS LBA=2752240801 11304442
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                171319  16 59 187755  39 24  264045755
This partition ends after the disk limits. (start=2752240801, size=264045755, end=3016286555, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/120, s_mnt_count=7/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3943936
recover_EXT2: part_size 31551488
Filesystem created: Fri Oct 15 20:30:45 2021
Last mount time:    Thu Oct 21 03:33:05 2021
     Linux                17731  91 25 19695  88 41   31551488
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB

recover_EXT2: s_block_group_nr=0/120, s_mnt_count=7/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3943936
recover_EXT2: part_size 31551488
Filesystem created: Fri Oct 15 20:30:45 2021
Last mount time:    Thu Oct 21 03:33:05 2021
     Linux                17731 221 27 19695 218 43   31551488
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB

recover_EXT2: s_block_group_nr=0/120, s_mnt_count=7/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3943936
recover_EXT2: part_size 31551488
Filesystem created: Fri Oct 15 20:30:45 2021
Last mount time:    Thu Oct 21 03:33:05 2021
     Linux                17732  96 29 19696  93 45   31551488
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
NTFS at 25312/215/56
filesystem size           1130496
sectors_per_cluster       8
mft_lcn                   47104
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/55/16
filesystem size           1130496
sectors_per_cluster       8
mft_lcn                   47104
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS found using backup sector, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/87/49
filesystem size           1814528
sectors_per_cluster       8
mft_lcn                   75605
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS, blocksize=4096, 929 MB / 886 MiB
NTFS at 25496/74/50
filesystem size           1814528
sectors_per_cluster       8
mft_lcn                   75605
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS found using backup sector, blocksize=4096, 929 MB / 886 MiB
NTFS at 25496/107/19
filesystem size           408518656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             67  79 13 25496 107 19  408518656
     NTFS found using backup sector, blocksize=4096, 209 GB / 194 GiB
NTFS at 96104/205/37
filesystem size           1134323712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25496 107 20 96104 205 37 1134323712
     NTFS found using backup sector, blocksize=4096, 580 GB / 540 GiB
NTFS at 96104/205/38
filesystem size           409597952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          96104 205 38 121601  25 24  409597952 [Linux]
     NTFS, blocksize=4096, 209 GB / 195 GiB
NTFS at 121601/57/56
filesystem size           1543923712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
NTFS at 121601/57/56
filesystem size           1543923712
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB
This partition ends after the disk limits. (start=1953523711, size=1543923712, end=3497447422, disk end=1953525168)
NTFS at 25496/107/19
filesystem size           408518656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 25496/107/19
filesystem size           408518656
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1790 GB / 1667 GiB)
The following partitions can't be recovered:
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB
     FAT12                171319  16 59 187755  39 24  264045755

Results
   * HPFS - NTFS              0  32 33    38  94 56     614400 [Recovery]
     NTFS, blocksize=4096, 314 MB / 300 MiB
   P HPFS - NTFS             38  94 57    50 253 11     202752
     NTFS, blocksize=4096, 103 MB / 99 MiB
     HPFS - NTFS             67  79 13 25312 215 55  405569536
     NTFS, blocksize=4096, 207 GB / 193 GiB
     HPFS - NTFS             67  79 13 25496 107 19  408518656
     NTFS found using backup sector, blocksize=4096, 209 GB / 194 GiB
     Linux                17731  91 25 19695  88 41   31551488
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
     Linux                17731 221 27 19695 218 43   31551488
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
     Linux                17732  96 29 19696  93 45   31551488
     ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
     HPFS - NTFS          25312 215 56 25383  55 16    1130496
     NTFS, blocksize=4096, 578 MB / 552 MiB
     HPFS - NTFS          25383  87 49 25496  74 50    1814528
     NTFS, blocksize=4096, 929 MB / 886 MiB
     HPFS - NTFS          25496 107 19 50925 135 25  408518656
     NTFS, blocksize=4096, 209 GB / 194 GiB
     HPFS - NTFS          25496 107 20 96104 205 37 1134323712
     NTFS found using backup sector, blocksize=4096, 580 GB / 540 GiB
     HPFS - NTFS          25496 107 20 121601  57 56 1543923712
     NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
     HPFS - NTFS          96104 205 38 121601  25 24  409597952 [Linux]
     NTFS, blocksize=4096, 209 GB / 195 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 614400 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 616448" | dmsetup create test1
echo "0 405569536 linear /dev/sda 1081344" | dmsetup create test2
echo "0 408518656 linear /dev/sda 1081344" | dmsetup create test3
echo "0 31551488 linear /dev/sda 284854272" | dmsetup create test4
echo "0 31551488 linear /dev/sda 284862464" | dmsetup create test5
echo "0 31551488 linear /dev/sda 284870656" | dmsetup create test6
echo "0 1130496 linear /dev/sda 406650880" | dmsetup create test7
echo "0 1814528 linear /dev/sda 407783424" | dmsetup create test8
echo "0 408518656 linear /dev/sda 409599999" | dmsetup create test9
echo "0 1134323712 linear /dev/sda 409600000" | dmsetup create test10
echo "0 1543923712 linear /dev/sda 409600000" | dmsetup create test11
echo "0 409597952 linear /dev/sda 1543923712" | dmsetup create test12
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47  size: 1024   usa_ofs: 2167  usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
Top
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Re: Real mess, please help

#3 Post by Mhn15 »

one thing I might add is that the D: partition that got deleted was encrypted by Bitlocker.
I say this now because testdisk shows this message:

Image

So is there any relationship between the encryption of the partition and testdisk inability to show the contents of it?
Top
recuperation
Posts: 3036
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Real mess, please help

#4 Post by recuperation »

Mhn15 wrote: 03 Dec 2021, 22:35 one thing I might add is that the D: partition that got deleted was encrypted by Bitlocker.
I say this now because testdisk shows this message:

Image

So is there any relationship between the encryption of the partition and testdisk inability to show the contents of it?
Yes. You can't read out encrypted content.

It looks like Testdisk does not recognize a partition encrypted by bitlocker
https://www.cgsecurity.org/wiki/TestDisk
but on the other hand it found this one

Code: Select all

The following partitions can't be recovered:
     HPFS - NTFS          121601  57 56 217706   8 29 1543923712
     NTFS, blocksize=4096, 790 GB / 736 GiB
that can be found on one of your pictures as well.
I don't know if Bitlocker partitions have a special reserved partition type and I don't know the on-disk Bitlocker setup for encrypted partitions.
It may be possible to write a partition table including this partition and trying to open it with a Windows machine understanding Bitlocker.

MHN15, you should not be proud.

1. Private messages do not reduce the answering time. I have a job and immediate service is something you can buy at high mark-ups from professional recovery labs.
2. You should not be proud but rather be careful as a rookie. When doing risky operations at the open heart (deleting partitioning, operating system installation) you should have backed up your data partition.
3. If I really don't answer it's typically because the posting is annoying - not in your case. I used to tell people why and they tell me that I am unfriendly. So I simply ignore such posts. To understand my attitude you can read this post that I sometimes modifies:
viewtopic.php?p=34916

If on the other hand, I miss some information that you already gave or if I ask for it again, feel free to point out to the posting where you provided that information.
Top
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Re: Real mess, please help

#5 Post by Mhn15 »

Many thanks for you reply
so should I just go ahead and write with these partition letters?

Image
Top
recuperation
Posts: 3036
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Real mess, please help

#6 Post by recuperation »

Yes, the selected green one.
Top
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Re: Real mess, please help

#7 Post by Mhn15 »

MHN15, you should not be proud.

1. Private messages do not reduce the answering time. I have a job and immediate service is something you can buy at high mark-ups from professional recovery labs.
2. You should not be proud but rather be careful as a rookie. When doing risky operations at the open heart (deleting partitioning, operating system installation) you should have backed up your data partition.
3. If I really don't answer it's typically because the posting is annoying - not in your case. I used to tell people why and they tell me that I am unfriendly. So I simply ignore such posts. To understand my attitude you can read this post that I sometimes modifies:
viewtopic.php?p=34916

If on the other hand, I miss some information that you already gave or if I ask for it again, feel free to point out to the posting where you provided that information.
Sorry, I just saw this,

I totally appreciate your help, and always value the help I get.
I always assume that the people who help others could spend their time doing better things of their own.

I provided help for other in areas that I know over the years, so I say you have the right to be annoyed when others don't realize how easy you made it to them considering the alternative.

Many thanks to you again,,
Last edited by Mhn15 on 04 Dec 2021, 02:21, edited 2 times in total.
Top
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Re: Real mess, please help

#8 Post by Mhn15 »

Sorry to bother you again, but I was prompted with this,,

Image
Top
recuperation
Posts: 3036
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Real mess, please help

#9 Post by recuperation »

As I can't tell you which differences exist between a Bitlocker partition and an unencrypted one I can't tell you if the backup boot sector may be different from the boot sector due to encryption.

You can try this option after backing up your boot sector to see if that gives you acces to your partition.
Top
Mhn15
Posts: 7
Joined: 02 Dec 2021, 15:29

Re: Real mess, please help

#10 Post by Mhn15 »

recuperation wrote: 04 Dec 2021, 11:09 As I can't tell you which differences exist between a Bitlocker partition and an unencrypted one I can't tell you if the backup boot sector may be different from the boot sector due to encryption.

You can try this option after backing up your boot sector to see if that gives you acces to your partition.
Hello Recuperation,
I'm still working on this issue,
I did write the disk image to an external hard drive, but it won't mount.
When I try to mount the image through Disk Management, it used to say this image is corrupt.
Now it says wrong parameter,
parameter.png
parameter.png (5.35 KiB) Viewed 4129 times
I checked the image parameters using DMDE and I got this
Eparameter2dmde.png
Eparameter2dmde.png (33.87 KiB) Viewed 4129 times

Anyway I was searching the forums and I found you suggesting using a hex editor for someone.
I noticed two things on the decoded text column:
1 - "A disk read error occurred...BOOTMGRis compressed..Press Ctrl+Alt+Del to restart."
2- "An operating system wasn't found. Try disconnecting any drives that don't..contain an operating system."

Code: Select all

Offset(h)   00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0000000000  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  ëR.NTFS    .....
0000000010  00 00 00 00 00 F8 00 00 3F 00 FF 00 01 00 00 00  .....ø..?.ÿ.....
0000000020  00 00 00 00 80 00 80 00 FF E7 F5 5B 00 00 00 00  ....€.€.ÿçõ[....
0000000030  00 00 0C 00 00 00 00 00 02 00 00 00 00 00 00 00  ................
0000000040  F6 00 00 00 01 00 00 00 BD 19 DC 52 3F DC 52 A2  ö.......½.ÜR?ÜR¢
0000000050  00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07  ....ú3ÀŽÐ¼.|ûhÀ.
0000000060  1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00 4E  ..hf.ˈ...f.>..N
0000000070  54 46 53 75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB  TFSu.´A»ªUÍ.r..û
0000000080  55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC  Uªu.÷Á..u.éÝ..ƒì
0000000090  18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13  .h..´HŠ...‹ô..Í.
00000000A0  9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3  ŸƒÄ.žX.rá;...uÛ£
00000000B0  0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8  ..Á.....Z3Û¹. +È
00000000C0  66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8  fÿ.......ŽÂÿ...è
00000000D0  4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D  K.+Èwï¸.»Í.f#Àu-
00000000E0  66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16  f.ûTCPAu$.ù..r..
00000000F0  68 07 BB 16 68 52 11 16 68 09 00 66 53 66 53 66  h.».hR..h..fSfSf
0000000100  55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF  U...h¸.fa..Í.3À¿
0000000110  0A 13 B9 F6 0C FC F3 AA E9 FE 01 90 90 66 60 1E  ..¹ö.üóªéþ...f`.
0000000120  06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00  .f¡..f.....fh...
0000000130  00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E  .fP.Sh..h..´BŠ..
0000000140  00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F  ...‹ôÍ.fY[ZfYfY.
0000000150  0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF  .‚..fÿ.......ŽÂÿ
0000000160  0E 16 00 75 BC 07 1F 66 61 C3 A1 F6 01 E8 09 00  ...u¼..faáö.è..
0000000170  A1 FA 01 E8 03 00 F4 EB FD 8B F0 AC 3C 00 74 09  ¡ú.è..ôëý‹ð¬<.t.
0000000180  B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20 64 69  ´.»..Í.ëòÃ..A di
0000000190  73 6B 20 72 65 61 64 20 65 72 72 6F 72 20 6F 63  sk read error oc
00000001A0  63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D 47 52  curred...BOOTMGR
00000001B0  20 69 73 20 63 6F 6D 70 72 65 73 73 65 64 00 0D   is compressed..
00000001C0  0A 50 72 65 73 73 20 43 74 72 6C 2B 41 6C 74 2B  .Press Ctrl+Alt+
00000001D0  44 65 6C 20 74 6F 20 72 65 73 74 61 72 74 0D 0A  Del to restart..
00000001E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000001F0  00 00 00 00 00 00 8A 01 A7 01 BF 01 00 00 55 AA  ......Š.§.¿...Uª
0000000200  07 00 42 00 4F 00 4F 00 54 00 4D 00 47 00 52 00  ..B.O.O.T.M.G.R.
0000000210  04 00 24 00 49 00 33 00 30 00 00 D4 00 00 00 24  ..$.I.3.0..Ô...$
0000000220  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000000230  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000000240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000000250  00 00 00 00 00 00 E9 C0 00 90 05 00 4E 00 54 00  ......éÀ....N.T.
0000000260  4C 00 44 00 52 00 07 00 42 00 4F 00 4F 00 54 00  L.D.R...B.O.O.T.
0000000270  54 00 47 00 54 00 07 00 42 00 4F 00 4F 00 54 00  T.G.T...B.O.O.T.
0000000280  4E 00 58 00 54 00 00 00 00 00 00 00 00 00 00 00  N.X.T...........
0000000290  00 00 00 00 00 00 00 00 00 00 0D 0A 41 6E 20 6F  ............An o
00000002A0  70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 20  perating system 
00000002B0  77 61 73 6E 27 74 20 66 6F 75 6E 64 2E 20 54 72  wasn't found. Tr
00000002C0  79 20 64 69 73 63 6F 6E 6E 65 63 74 69 6E 67 20  y disconnecting 
00000002D0  61 6E 79 20 64 72 69 76 65 73 20 74 68 61 74 20  any drives that 
00000002E0  64 6F 6E 27 74 0D 0A 63 6F 6E 74 61 69 6E 20 61  don't..contain a
00000002F0  6E 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  n operating syst
0000000300  65 6D 2E 00 00 00 00 00 00 00 00 00 00 00 00 00  em..............
0000000310  00 00 00 00 00 00 00 9A 02 66 0F B7 06 0B 00 66  .......š.f.·...f
0000000320  0F B6 1E 0D 00 66 F7 E3 66 A3 52 02 66 8B 0E 40  .¶...f÷ãf£R.f‹.@
0000000330  00 80 F9 00 0F 8F 0E 00 F6 D9 66 B8 01 00 00 00  .€ù.....öÙf¸....
0000000340  66 D3 E0 EB 08 90 66 A1 52 02 66 F7 E1 66 A3 86  fÓàë..f¡R.f÷áf£†
0000000350  02 66 0F B7 1E 0B 00 66 33 D2 66 F7 F3 66 A3 56  .f.·...f3Òf÷óf£V
0000000360  02 E8 A2 04 66 8B 0E 4E 02 66 89 0E 26 02 66 03  .è¢.f‹.N.f‰.&.f.
0000000370  0E 86 02 66 89 0E 2A 02 66 03 0E 86 02 66 89 0E  .†.f‰.*.f..†.f‰.
0000000380  2E 02 66 03 0E 86 02 66 89 0E 3E 02 66 03 0E 86  ..f..†.f‰.>.f..†
0000000390  02 66 89 0E 46 02 66 B8 90 00 00 00 66 8B 0E 26  .f‰.F.f¸....f‹.&
00000003A0  02 E8 90 09 66 0B C0 0F 84 BF FD 66 A3 32 02 66  .è..f.À.„¿ýf£2.f
00000003B0  B8 A0 00 00 00 66 8B 0E 2A 02 E8 77 09 66 A3 36  ¸ ...f‹.*.èw.f£6
00000003C0  02 66 B8 B0 00 00 00 66 8B 0E 2E 02 E8 65 09 66  .f¸°...f‹...èe.f
00000003D0  A3 3A 02 66 A1 32 02 66 0B C0 0F 84 8C FD 67 80  £:.f¡2.f.À.„Œýg€
00000003E0  78 08 00 0F 85 83 FD 67 66 8D 50 10 67 03 42 04  x...…ƒýgf.P.g.B.
00000003F0  67 66 0F B6 48 0C 66 89 0E 92 02 67 66 8B 48 08  gf.¶H.f‰.’.gf‹H.
0000000400  66 89 0E 8E 02 66 A1 8E 02 66 0F B7 0E 0B 00 66  f‰.Ž.f¡Ž.f.·...f
0000000410  33 D2 66 F7 F1 66 A3 96 02 66 A1 46 02 66 03 06  3Òf÷ñf£–.f¡F.f..
0000000420  8E 02 66 A3 4A 02 66 83 3E 36 02 00 0F 84 1D 00  Ž.f£J.fƒ>6...„..
Top
Locked

Return to “Partition Recovery”