Real mess, please help
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Real mess, please help
Hello people,
I have two hard drives on my computer one is for Linux and the other for Windows 10.
The problem is with the Windows hard drive.
I have two main partitions on that drive "C:" for OS and it is about 200G and the rest is allocated to "D:" for my important files and it is about 800G
There were several partitions that are very small in size like "Recovery" and others that I didn't know what they are and how they got there!
ANYWAY:
I was trying to reinstall Windows again "Clean install" but I was prompted with a message "Can't install Windows on GPT drive"
I didn't know what that meant, so I just formatted and deleted all those annoying little partitions along with OS partition.
it didn't work and it required the drive to be converted to GPT.
There was a way to do so using the cmd and diskpart command, but that would've formatted the whole drive and I would've lost my precious D: partition as well.
I started reading here and there and found that it is more likely than not that I'm going to lose "D" partition if I ever converted the drive to GPT.
so I thought I should recover Windows and everything I formatted, move my files out of "D", and then format the drive.
From Linux, I launched Testdisk, it found the deleted partitions, BUT here is the thing:
when I clicked "write", it deleted "D"
"D" is showing right now as free unallocated space
Running a Deep scan I took this screen shot
and this one when it finished:
I want to be out of this mess please help.
and YES I'm a proud rookie
I have two hard drives on my computer one is for Linux and the other for Windows 10.
The problem is with the Windows hard drive.
I have two main partitions on that drive "C:" for OS and it is about 200G and the rest is allocated to "D:" for my important files and it is about 800G
There were several partitions that are very small in size like "Recovery" and others that I didn't know what they are and how they got there!
ANYWAY:
I was trying to reinstall Windows again "Clean install" but I was prompted with a message "Can't install Windows on GPT drive"
I didn't know what that meant, so I just formatted and deleted all those annoying little partitions along with OS partition.
it didn't work and it required the drive to be converted to GPT.
There was a way to do so using the cmd and diskpart command, but that would've formatted the whole drive and I would've lost my precious D: partition as well.
I started reading here and there and found that it is more likely than not that I'm going to lose "D" partition if I ever converted the drive to GPT.
so I thought I should recover Windows and everything I formatted, move my files out of "D", and then format the drive.
From Linux, I launched Testdisk, it found the deleted partitions, BUT here is the thing:
when I clicked "write", it deleted "D"
"D" is showing right now as free unallocated space
Running a Deep scan I took this screen shot
and this one when it finished:
I want to be out of this mess please help.
and YES I'm a proud rookie
Re: Real mess, please help
Code: Select all
Wed Dec 1 09:30:46 2021
Command line: TestDisk
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.14.0-kali4-amd64 (#1 SMP Debian 5.14.16-1kali1 (2021-11-05)) x86_64
Compiler: GCC 10.3
ext2fs lib: 1.46.4, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.2
User is not root!
Hard disk list
TestDisk exited normally.
Using locale 'en_US.UTF-8'.
Wed Dec 1 09:30:49 2021
Command line: TestDisk /debug
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.14.0-kali4-amd64 (#1 SMP Debian 5.14.16-1kali1 (2021-11-05)) x86_64
Compiler: GCC 10.3
ext2fs lib: 1.46.4, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.2
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 488281250 sectors
/dev/sdb: user_max 488281250 sectors
/dev/sdb: native_max 488281250 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-00RKKA0, S/N:WD-WCC1S6592957, FW:80.00A80
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - WDC WD2500AAJS-75M0A0, S/N:WD-WMAV2DY01994, FW:02.03E02
Partition table type (auto): EFI GPT
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EZEX-00RKKA0
Partition table type: Intel
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 38/94/57
NTFS at 67/79/13
Info: size boot_sector 405569108, partition 405569536
Current partition structure:
1 * HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
2 P HPFS - NTFS 38 94 57 50 253 11 202752
3 P HPFS - NTFS 67 79 13 25312 215 55 405569536
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size 202752
sectors_per_cluster 8
mft_lcn 8448
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 50 253 11 202752
NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 67/79/13
filesystem size 405569108
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 67 79 13 25312 209 5 405569108
NTFS, blocksize=4096, 207 GB / 193 GiB
NTFS at 25312/215/56
filesystem size 1130496
sectors_per_cluster 8
mft_lcn 47104
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/87/49
filesystem size 1814528
sectors_per_cluster 8
mft_lcn 75605
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS, blocksize=4096, 929 MB / 886 MiB
NTFS at 96104/205/38
filesystem size 409597952
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 96104 205 38 121601 25 24 409597952 [Linux]
NTFS, blocksize=4096, 209 GB / 195 GiB
NTFS at 121601/57/56
filesystem size 1543923712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
NTFS at 121601/57/56
filesystem size 1543923712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
This partition ends after the disk limits. (start=1953523711, size=1543923712, end=3497447422, disk end=1953525168)
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1790 GB / 1667 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
Results
HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS, blocksize=4096, 314 MB / 300 MiB
HPFS - NTFS 38 94 57 50 253 11 202752
NTFS, blocksize=4096, 103 MB / 99 MiB
HPFS - NTFS 67 79 13 25312 215 55 405569536
NTFS, blocksize=4096, 207 GB / 193 GiB
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS, blocksize=4096, 578 MB / 552 MiB
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS, blocksize=4096, 929 MB / 886 MiB
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
HPFS - NTFS 96104 205 38 121601 25 24 409597952 [Linux]
NTFS, blocksize=4096, 209 GB / 195 GiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 614400 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 616448" | dmsetup create test1
echo "0 405569536 linear /dev/sda 1081344" | dmsetup create test2
echo "0 1130496 linear /dev/sda 406650880" | dmsetup create test3
echo "0 1814528 linear /dev/sda 407783424" | dmsetup create test4
echo "0 1543923712 linear /dev/sda 409600000" | dmsetup create test5
echo "0 409597952 linear /dev/sda 1543923712" | dmsetup create test6
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 38/94/57
NTFS at 67/79/13
Info: size boot_sector 405569108, partition 405569536
Current partition structure:
1 * HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
2 P HPFS - NTFS 38 94 57 50 253 11 202752
3 P HPFS - NTFS 67 79 13 25312 215 55 405569536
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size 202752
sectors_per_cluster 8
mft_lcn 8448
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 50 253 11 202752
NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 67/79/13
filesystem size 405569108
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 67 79 13 25312 209 5 405569108
NTFS, blocksize=4096, 207 GB / 193 GiB
NTFS at 25312/215/56
filesystem size 1130496
sectors_per_cluster 8
mft_lcn 47104
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/87/49
filesystem size 1814528
sectors_per_cluster 8
mft_lcn 75605
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS, blocksize=4096, 929 MB / 886 MiB
NTFS at 121601/57/56
filesystem size 1543923712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
NTFS at 121601/57/56
filesystem size 1543923712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
This partition ends after the disk limits. (start=1953523711, size=1543923712, end=3497447422, disk end=1953525168)
Search for partition aborted
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1790 GB / 1667 GiB)
The following partition can't be recovered:
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
Results
HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS, blocksize=4096, 314 MB / 300 MiB
HPFS - NTFS 38 94 57 50 253 11 202752
NTFS, blocksize=4096, 103 MB / 99 MiB
HPFS - NTFS 67 79 13 25312 215 55 405569536
NTFS, blocksize=4096, 207 GB / 193 GiB
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS, blocksize=4096, 578 MB / 552 MiB
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS, blocksize=4096, 929 MB / 886 MiB
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 614400 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 616448" | dmsetup create test1
echo "0 405569536 linear /dev/sda 1081344" | dmsetup create test2
echo "0 1130496 linear /dev/sda 406650880" | dmsetup create test3
echo "0 1814528 linear /dev/sda 407783424" | dmsetup create test4
echo "0 1543923712 linear /dev/sda 409600000" | dmsetup create test5
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/56
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS found using backup sector, blocksize=4096, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size 202752
sectors_per_cluster 8
mft_lcn 8448
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 50 253 11 202752
NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 50/253/11
filesystem size 202752
sectors_per_cluster 8
mft_lcn 8448
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 50 253 11 202752
NTFS found using backup sector, blocksize=4096, 103 MB / 99 MiB
NTFS at 67/79/13
filesystem size 405569108
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 67 79 13 25312 209 5 405569108
NTFS, blocksize=4096, 207 GB / 193 GiB
file_pread(4,16,buffer,6012928(374/73/20)) read err: Partial read
file_pread(4,16,buffer,6012927(374/73/19)) read err: Partial read
file_pread(4,16,buffer,6012944(374/73/36)) read err: Input/output error
file_pread(4,1,buffer,6012944(374/73/36)) read err: Input/output error
BAD_RS LBA=2752240801 11304442
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 171319 16 59 187755 39 24 264045755
This partition ends after the disk limits. (start=2752240801, size=264045755, end=3016286555, disk end=1953525168)
recover_EXT2: s_block_group_nr=0/120, s_mnt_count=7/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3943936
recover_EXT2: part_size 31551488
Filesystem created: Fri Oct 15 20:30:45 2021
Last mount time: Thu Oct 21 03:33:05 2021
Linux 17731 91 25 19695 88 41 31551488
ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
recover_EXT2: s_block_group_nr=0/120, s_mnt_count=7/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3943936
recover_EXT2: part_size 31551488
Filesystem created: Fri Oct 15 20:30:45 2021
Last mount time: Thu Oct 21 03:33:05 2021
Linux 17731 221 27 19695 218 43 31551488
ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
recover_EXT2: s_block_group_nr=0/120, s_mnt_count=7/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3943936
recover_EXT2: part_size 31551488
Filesystem created: Fri Oct 15 20:30:45 2021
Last mount time: Thu Oct 21 03:33:05 2021
Linux 17732 96 29 19696 93 45 31551488
ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
NTFS at 25312/215/56
filesystem size 1130496
sectors_per_cluster 8
mft_lcn 47104
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/55/16
filesystem size 1130496
sectors_per_cluster 8
mft_lcn 47104
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS found using backup sector, blocksize=4096, 578 MB / 552 MiB
NTFS at 25383/87/49
filesystem size 1814528
sectors_per_cluster 8
mft_lcn 75605
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS, blocksize=4096, 929 MB / 886 MiB
NTFS at 25496/74/50
filesystem size 1814528
sectors_per_cluster 8
mft_lcn 75605
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS found using backup sector, blocksize=4096, 929 MB / 886 MiB
NTFS at 25496/107/19
filesystem size 408518656
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 67 79 13 25496 107 19 408518656
NTFS found using backup sector, blocksize=4096, 209 GB / 194 GiB
NTFS at 96104/205/37
filesystem size 1134323712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25496 107 20 96104 205 37 1134323712
NTFS found using backup sector, blocksize=4096, 580 GB / 540 GiB
NTFS at 96104/205/38
filesystem size 409597952
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 96104 205 38 121601 25 24 409597952 [Linux]
NTFS, blocksize=4096, 209 GB / 195 GiB
NTFS at 121601/57/56
filesystem size 1543923712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
NTFS at 121601/57/56
filesystem size 1543923712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
This partition ends after the disk limits. (start=1953523711, size=1543923712, end=3497447422, disk end=1953525168)
NTFS at 25496/107/19
filesystem size 408518656
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 25496/107/19
filesystem size 408518656
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1790 GB / 1667 GiB)
The following partitions can't be recovered:
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
FAT12 171319 16 59 187755 39 24 264045755
Results
* HPFS - NTFS 0 32 33 38 94 56 614400 [Recovery]
NTFS, blocksize=4096, 314 MB / 300 MiB
P HPFS - NTFS 38 94 57 50 253 11 202752
NTFS, blocksize=4096, 103 MB / 99 MiB
HPFS - NTFS 67 79 13 25312 215 55 405569536
NTFS, blocksize=4096, 207 GB / 193 GiB
HPFS - NTFS 67 79 13 25496 107 19 408518656
NTFS found using backup sector, blocksize=4096, 209 GB / 194 GiB
Linux 17731 91 25 19695 88 41 31551488
ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
Linux 17731 221 27 19695 218 43 31551488
ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
Linux 17732 96 29 19696 93 45 31551488
ext4 blocksize=4096 Large_file Sparse_SB Recover, 16 GB / 15 GiB
HPFS - NTFS 25312 215 56 25383 55 16 1130496
NTFS, blocksize=4096, 578 MB / 552 MiB
HPFS - NTFS 25383 87 49 25496 74 50 1814528
NTFS, blocksize=4096, 929 MB / 886 MiB
HPFS - NTFS 25496 107 19 50925 135 25 408518656
NTFS, blocksize=4096, 209 GB / 194 GiB
HPFS - NTFS 25496 107 20 96104 205 37 1134323712
NTFS found using backup sector, blocksize=4096, 580 GB / 540 GiB
HPFS - NTFS 25496 107 20 121601 57 56 1543923712
NTFS found using backup sector, blocksize=4096, 790 GB / 736 GiB
HPFS - NTFS 96104 205 38 121601 25 24 409597952 [Linux]
NTFS, blocksize=4096, 209 GB / 195 GiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 614400 linear /dev/sda 2048" | dmsetup create test0
echo "0 202752 linear /dev/sda 616448" | dmsetup create test1
echo "0 405569536 linear /dev/sda 1081344" | dmsetup create test2
echo "0 408518656 linear /dev/sda 1081344" | dmsetup create test3
echo "0 31551488 linear /dev/sda 284854272" | dmsetup create test4
echo "0 31551488 linear /dev/sda 284862464" | dmsetup create test5
echo "0 31551488 linear /dev/sda 284870656" | dmsetup create test6
echo "0 1130496 linear /dev/sda 406650880" | dmsetup create test7
echo "0 1814528 linear /dev/sda 407783424" | dmsetup create test8
echo "0 408518656 linear /dev/sda 409599999" | dmsetup create test9
echo "0 1134323712 linear /dev/sda 409600000" | dmsetup create test10
echo "0 1543923712 linear /dev/sda 409600000" | dmsetup create test11
echo "0 409597952 linear /dev/sda 1543923712" | dmsetup create test12
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xf6f8fe47 size: 1024 usa_ofs: 2167 usa_count: 52344: Invalid argument
Record 0 has no FILE magic (0xf6f8fe47)
Failed to load $MFT: Input/output error
Re: Real mess, please help
one thing I might add is that the D: partition that got deleted was encrypted by Bitlocker.
I say this now because testdisk shows this message:
So is there any relationship between the encryption of the partition and testdisk inability to show the contents of it?
I say this now because testdisk shows this message:
So is there any relationship between the encryption of the partition and testdisk inability to show the contents of it?
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Real mess, please help
Yes. You can't read out encrypted content.
It looks like Testdisk does not recognize a partition encrypted by bitlocker
https://www.cgsecurity.org/wiki/TestDisk
but on the other hand it found this one
Code: Select all
The following partitions can't be recovered:
HPFS - NTFS 121601 57 56 217706 8 29 1543923712
NTFS, blocksize=4096, 790 GB / 736 GiB
I don't know if Bitlocker partitions have a special reserved partition type and I don't know the on-disk Bitlocker setup for encrypted partitions.
It may be possible to write a partition table including this partition and trying to open it with a Windows machine understanding Bitlocker.
MHN15, you should not be proud.
1. Private messages do not reduce the answering time. I have a job and immediate service is something you can buy at high mark-ups from professional recovery labs.
2. You should not be proud but rather be careful as a rookie. When doing risky operations at the open heart (deleting partitioning, operating system installation) you should have backed up your data partition.
3. If I really don't answer it's typically because the posting is annoying - not in your case. I used to tell people why and they tell me that I am unfriendly. So I simply ignore such posts. To understand my attitude you can read this post that I sometimes modifies:
viewtopic.php?p=34916
If on the other hand, I miss some information that you already gave or if I ask for it again, feel free to point out to the posting where you provided that information.
Re: Real mess, please help
Many thanks for you reply
so should I just go ahead and write with these partition letters?
so should I just go ahead and write with these partition letters?
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Real mess, please help
Yes, the selected green one.
Re: Real mess, please help
Sorry, I just saw this,MHN15, you should not be proud.
1. Private messages do not reduce the answering time. I have a job and immediate service is something you can buy at high mark-ups from professional recovery labs.
2. You should not be proud but rather be careful as a rookie. When doing risky operations at the open heart (deleting partitioning, operating system installation) you should have backed up your data partition.
3. If I really don't answer it's typically because the posting is annoying - not in your case. I used to tell people why and they tell me that I am unfriendly. So I simply ignore such posts. To understand my attitude you can read this post that I sometimes modifies:
viewtopic.php?p=34916
If on the other hand, I miss some information that you already gave or if I ask for it again, feel free to point out to the posting where you provided that information.
I totally appreciate your help, and always value the help I get.
I always assume that the people who help others could spend their time doing better things of their own.
I provided help for other in areas that I know over the years, so I say you have the right to be annoyed when others don't realize how easy you made it to them considering the alternative.
Many thanks to you again,,
Last edited by Mhn15 on 04 Dec 2021, 02:21, edited 2 times in total.
Re: Real mess, please help
Sorry to bother you again, but I was prompted with this,,
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Real mess, please help
As I can't tell you which differences exist between a Bitlocker partition and an unencrypted one I can't tell you if the backup boot sector may be different from the boot sector due to encryption.
You can try this option after backing up your boot sector to see if that gives you acces to your partition.
You can try this option after backing up your boot sector to see if that gives you acces to your partition.
Re: Real mess, please help
Hello Recuperation,recuperation wrote: ↑04 Dec 2021, 11:09 As I can't tell you which differences exist between a Bitlocker partition and an unencrypted one I can't tell you if the backup boot sector may be different from the boot sector due to encryption.
You can try this option after backing up your boot sector to see if that gives you acces to your partition.
I'm still working on this issue,
I did write the disk image to an external hard drive, but it won't mount.
When I try to mount the image through Disk Management, it used to say this image is corrupt.
Now it says wrong parameter, I checked the image parameters using DMDE and I got this
Anyway I was searching the forums and I found you suggesting using a hex editor for someone.
I noticed two things on the decoded text column:
1 - "A disk read error occurred...BOOTMGRis compressed..Press Ctrl+Alt+Del to restart."
2- "An operating system wasn't found. Try disconnecting any drives that don't..contain an operating system."
Code: Select all
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0000000000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 ëR.NTFS .....
0000000010 00 00 00 00 00 F8 00 00 3F 00 FF 00 01 00 00 00 .....ø..?.ÿ.....
0000000020 00 00 00 00 80 00 80 00 FF E7 F5 5B 00 00 00 00 ....€.€.ÿçõ[....
0000000030 00 00 0C 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
0000000040 F6 00 00 00 01 00 00 00 BD 19 DC 52 3F DC 52 A2 ö.......½.ÜR?ÜR¢
0000000050 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07 ....ú3ÀŽÐ¼.|ûhÀ.
0000000060 1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00 4E ..hf.ˈ...f.>..N
0000000070 54 46 53 75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB TFSu.´A»ªUÍ.r..û
0000000080 55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC Uªu.÷Á..u.éÝ..ƒì
0000000090 18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13 .h..´HŠ...‹ô..Í.
00000000A0 9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3 ŸƒÄ.žX.rá;...uÛ£
00000000B0 0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8 ..Á.....Z3Û¹. +È
00000000C0 66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8 fÿ.......ŽÂÿ...è
00000000D0 4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D K.+Èwï¸.»Í.f#Àu-
00000000E0 66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16 f.ûTCPAu$.ù..r..
00000000F0 68 07 BB 16 68 52 11 16 68 09 00 66 53 66 53 66 h.».hR..h..fSfSf
0000000100 55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF U...h¸.fa..Í.3À¿
0000000110 0A 13 B9 F6 0C FC F3 AA E9 FE 01 90 90 66 60 1E ..¹ö.üóªéþ...f`.
0000000120 06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00 .f¡..f.....fh...
0000000130 00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E .fP.Sh..h..´BŠ..
0000000140 00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F ...‹ôÍ.fY[ZfYfY.
0000000150 0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF .‚..fÿ.......ŽÂÿ
0000000160 0E 16 00 75 BC 07 1F 66 61 C3 A1 F6 01 E8 09 00 ...u¼..faáö.è..
0000000170 A1 FA 01 E8 03 00 F4 EB FD 8B F0 AC 3C 00 74 09 ¡ú.è..ôëý‹ð¬<.t.
0000000180 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20 64 69 ´.»..Í.ëòÃ..A di
0000000190 73 6B 20 72 65 61 64 20 65 72 72 6F 72 20 6F 63 sk read error oc
00000001A0 63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D 47 52 curred...BOOTMGR
00000001B0 20 69 73 20 63 6F 6D 70 72 65 73 73 65 64 00 0D is compressed..
00000001C0 0A 50 72 65 73 73 20 43 74 72 6C 2B 41 6C 74 2B .Press Ctrl+Alt+
00000001D0 44 65 6C 20 74 6F 20 72 65 73 74 61 72 74 0D 0A Del to restart..
00000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000001F0 00 00 00 00 00 00 8A 01 A7 01 BF 01 00 00 55 AA ......Š.§.¿...Uª
0000000200 07 00 42 00 4F 00 4F 00 54 00 4D 00 47 00 52 00 ..B.O.O.T.M.G.R.
0000000210 04 00 24 00 49 00 33 00 30 00 00 D4 00 00 00 24 ..$.I.3.0..Ô...$
0000000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000000250 00 00 00 00 00 00 E9 C0 00 90 05 00 4E 00 54 00 ......éÀ....N.T.
0000000260 4C 00 44 00 52 00 07 00 42 00 4F 00 4F 00 54 00 L.D.R...B.O.O.T.
0000000270 54 00 47 00 54 00 07 00 42 00 4F 00 4F 00 54 00 T.G.T...B.O.O.T.
0000000280 4E 00 58 00 54 00 00 00 00 00 00 00 00 00 00 00 N.X.T...........
0000000290 00 00 00 00 00 00 00 00 00 00 0D 0A 41 6E 20 6F ............An o
00000002A0 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 20 perating system
00000002B0 77 61 73 6E 27 74 20 66 6F 75 6E 64 2E 20 54 72 wasn't found. Tr
00000002C0 79 20 64 69 73 63 6F 6E 6E 65 63 74 69 6E 67 20 y disconnecting
00000002D0 61 6E 79 20 64 72 69 76 65 73 20 74 68 61 74 20 any drives that
00000002E0 64 6F 6E 27 74 0D 0A 63 6F 6E 74 61 69 6E 20 61 don't..contain a
00000002F0 6E 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 n operating syst
0000000300 65 6D 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 em..............
0000000310 00 00 00 00 00 00 00 9A 02 66 0F B7 06 0B 00 66 .......š.f.·...f
0000000320 0F B6 1E 0D 00 66 F7 E3 66 A3 52 02 66 8B 0E 40 .¶...f÷ãf£R.f‹.@
0000000330 00 80 F9 00 0F 8F 0E 00 F6 D9 66 B8 01 00 00 00 .€ù.....öÙf¸....
0000000340 66 D3 E0 EB 08 90 66 A1 52 02 66 F7 E1 66 A3 86 fÓàë..f¡R.f÷áf£†
0000000350 02 66 0F B7 1E 0B 00 66 33 D2 66 F7 F3 66 A3 56 .f.·...f3Òf÷óf£V
0000000360 02 E8 A2 04 66 8B 0E 4E 02 66 89 0E 26 02 66 03 .è¢.f‹.N.f‰.&.f.
0000000370 0E 86 02 66 89 0E 2A 02 66 03 0E 86 02 66 89 0E .†.f‰.*.f..†.f‰.
0000000380 2E 02 66 03 0E 86 02 66 89 0E 3E 02 66 03 0E 86 ..f..†.f‰.>.f..†
0000000390 02 66 89 0E 46 02 66 B8 90 00 00 00 66 8B 0E 26 .f‰.F.f¸....f‹.&
00000003A0 02 E8 90 09 66 0B C0 0F 84 BF FD 66 A3 32 02 66 .è..f.À.„¿ýf£2.f
00000003B0 B8 A0 00 00 00 66 8B 0E 2A 02 E8 77 09 66 A3 36 ¸ ...f‹.*.èw.f£6
00000003C0 02 66 B8 B0 00 00 00 66 8B 0E 2E 02 E8 65 09 66 .f¸°...f‹...èe.f
00000003D0 A3 3A 02 66 A1 32 02 66 0B C0 0F 84 8C FD 67 80 £:.f¡2.f.À.„Œýg€
00000003E0 78 08 00 0F 85 83 FD 67 66 8D 50 10 67 03 42 04 x...…ƒýgf.P.g.B.
00000003F0 67 66 0F B6 48 0C 66 89 0E 92 02 67 66 8B 48 08 gf.¶H.f‰.’.gf‹H.
0000000400 66 89 0E 8E 02 66 A1 8E 02 66 0F B7 0E 0B 00 66 f‰.Ž.f¡Ž.f.·...f
0000000410 33 D2 66 F7 F1 66 A3 96 02 66 A1 46 02 66 03 06 3Òf÷ñf£–.f¡F.f..
0000000420 8E 02 66 A3 4A 02 66 83 3E 36 02 00 0F 84 1D 00 Ž.f£J.fƒ>6...„..