cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Not able to recover logical partition (size boot_sector > partition)

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=11793

Page 1 of 1

Not able to recover logical partition (size boot_sector > partition)

Posted: 05 Dec 2021, 08:02
by Deleted User 16248
I had a dual-booted HDD (Win10 and Ubuntu) (MBR) where the Ubuntu was in an extended partition (that had 1 Win10 logical partition and 1 Ubuntu logical partition).

Few months ago, I deleted that Ubuntu logical partition and expanded Win10 logical partition to cover full extended partition space. But that space was not written with new files .

The disks now look like this
Image



Now I am needing some files that were on Ubuntu parition and I tried to recover them from TestDisk. Happily, TestDisk recovered that same previous partition table as shown.


Image

Image

Image


Now, I select that Linux partition and attempt to Write but there is a Write error. The only problematic thing I am seeing in log file is this

Code: Select all

Error: size boot_sector 291971072 > partition 188743680
check_part_i386 failed for partition type 07
     HPFS - NTFS          42626 178 49 54375 115 12  188743680

recover_EXT2: s_block_group_nr=0/393, s_mnt_count=34/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 12903424
recover_EXT2: part_size 103227392
Filesystem created: Sat Feb 20 12:28:58 2021
Last mount time:    Sun Aug 15 14:52:52 2021
     Linux                54375 147 45 60801  47 46  103227392
     ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB

Results
   * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
   P HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
   P HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
   L HPFS - NTFS          42626 178 49 54375 115 12  188743680
   L Linux                54375 147 45 60801  47 46  103227392
     ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 16497 247  6  264013824
 3 P HPFS - NTFS          16498  21 60 42626 143 38  419753985
 4 E extended LBA         42626 146 17 60801  80 15  291977216
 5 L HPFS - NTFS          42626 178 49 54375 115 12  188743680
 6 L Linux                54375 147 45 60801  47 46  103227392
I believe the problem is in first line

Code: Select all

Error: size boot_sector 291971072 > partition 188743680
Please suggest me how can I recover that partition. (without data loss)

Thanks in advance.

Re: Not able to recover logical partition (size boot_sector > partition)

Posted: 05 Dec 2021, 10:59
by recuperation
loop234 wrote: 05 Dec 2021, 08:02 I had a dual-booted HDD (Win10 and Ubuntu) (MBR) where the Ubuntu was in an extended partition (that had 1 Win10 logical partition and 1 Ubuntu logical partition).

Few months ago, I deleted that Ubuntu logical partition and expanded Win10 logical partition to cover full extended partition space. But that space was not written with new files .
How do you know? I assume you can't.


The disks now look like this
Image



Now I am needing some files that were on Ubuntu parition and I tried to recover them from TestDisk. Happily, TestDisk recovered that same previous partition table as shown.


Image

Image

Image


Now, I select that Linux partition and attempt to Write but there is a Write error.
I don't see a write error.

The only problematic thing I am seeing in log file is this
The problematic thing I see is that I only see parts cut out of a Testdisk log file.

Please suggest me how can I recover that partition. (without data loss)
There is no "can". Instead there is a "could" given the fact that you added that space to another partition and want it back now.

Re: Not able to recover logical partition (size boot_sector > partition)

Posted: 05 Dec 2021, 11:16
by Deleted User 16248
This is the screen after attempting to write
Image

Also, the full log file -

Code: Select all


Sun Dec  5 04:29:46 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=135175077888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=214914040320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=149489188864
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-9WS142, S/N:W0VBPEZ3, FW:0002SDM1

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - ST500LT012-9WS142
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 63/221/31
NTFS at 16498/21/60
BAD_RS LBA=684797952 2
NTFS at 42626/178/49
Current partition structure:
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 16497 247  6  264013824
 3 P HPFS - NTFS          16498  21 60 42626 143 38  419753985
 4 E extended LBA         42626 178 47 60801  47 46  291973122
 5 L HPFS - NTFS          42626 178 49 60801  15 14  291971072

Bad relative sector.

search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size           264013824
sectors_per_cluster       8
mft_lcn                   6180
mftmirr_lcn               883
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
NTFS at 16498/21/60
filesystem size           419753985
sectors_per_cluster       8
mft_lcn                   26600484
mftmirr_lcn               5012748
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
Error: size boot_sector 291971072 > partition 188743680
check_part_i386 failed for partition type 07
     HPFS - NTFS          42626 178 49 54375 115 12  188743680

recover_EXT2: s_block_group_nr=0/393, s_mnt_count=34/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 12903424
recover_EXT2: part_size 103227392
Filesystem created: Sat Feb 20 12:28:58 2021
Last mount time:    Sun Aug 15 14:52:52 2021
     Linux                54375 147 45 60801  47 46  103227392
     ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB

Results
   * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
   P HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
   P HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
   L HPFS - NTFS          42626 178 49 54375 115 12  188743680
   L Linux                54375 147 45 60801  47 46  103227392
     ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 16497 247  6  264013824
 3 P HPFS - NTFS          16498  21 60 42626 143 38  419753985
 4 E extended LBA         42626 146 17 60801  80 15  291977216
 5 L HPFS - NTFS          42626 178 49 54375 115 12  188743680
 6 L Linux                54375 147 45 60801  47 46  103227392

search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 12/223/19
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           136212480
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20  8491 181 10  136212480
     NTFS, blocksize=4096, 69 GB / 64 GiB
NTFS at 63/221/30
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size           264013824
sectors_per_cluster       8
mft_lcn                   6180
mftmirr_lcn               883
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
NTFS at 16498/21/60
filesystem size           419753985
sectors_per_cluster       8
mft_lcn                   26600484
mftmirr_lcn               5012748
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
BAD_RS LBA=684797952 2
NTFS at 42626/178/49
filesystem size           291971072
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          42626 178 49 60801  15 14  291971072
     NTFS, blocksize=4096, 149 GB / 139 GiB
Search for partition aborted

Results
     HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
     HPFS - NTFS             12 223 20  8491 181 10  136212480
     NTFS, blocksize=4096, 69 GB / 64 GiB
     HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
   * HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
   P HPFS - NTFS          42626 178 49 60801  15 14  291971072
     NTFS, blocksize=4096, 149 GB / 139 GiB



Sun Dec  5 10:12:33 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=135175077888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=214914040320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=149489188864
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-9WS142, S/N:W0VBPEZ3, FW:0002SDM1

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - ST500LT012-9WS142
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 63/221/31
NTFS at 16498/21/60
BAD_RS LBA=684797952 2
NTFS at 42626/178/49
Current partition structure:
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 16497 247  6  264013824
 3 P HPFS - NTFS          16498  21 60 42626 143 38  419753985
 4 E extended LBA         42626 178 47 60801  47 46  291973122
 5 L HPFS - NTFS          42626 178 49 60801  15 14  291971072

Bad relative sector.

search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size           264013824
sectors_per_cluster       8
mft_lcn                   6180
mftmirr_lcn               883
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
NTFS at 16498/21/60
filesystem size           419753985
sectors_per_cluster       8
mft_lcn                   26600484
mftmirr_lcn               5012748
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
Error: size boot_sector 291971072 > partition 188743680
check_part_i386 failed for partition type 07
     HPFS - NTFS          42626 178 49 54375 115 12  188743680

recover_EXT2: s_block_group_nr=0/393, s_mnt_count=34/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 12903424
recover_EXT2: part_size 103227392
Filesystem created: Sat Feb 20 12:28:58 2021
Last mount time:    Sun Aug 15 14:52:52 2021
     Linux                54375 147 45 60801  47 46  103227392
     ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB

Results
   * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
     NTFS, blocksize=4096, 524 MB / 500 MiB
   P HPFS - NTFS             63 221 31 16497 247  6  264013824
     NTFS, blocksize=4096, 135 GB / 125 GiB
   P HPFS - NTFS          16498  21 60 42626 143 38  419753985
     NTFS, blocksize=4096, 214 GB / 200 GiB
   L HPFS - NTFS          42626 178 49 54375 115 12  188743680
   L Linux                54375 147 45 60801  47 46  103227392
     ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31 16497 247  6  264013824
 3 P HPFS - NTFS          16498  21 60 42626 143 38  419753985
 4 E extended LBA         42626 146 17 60801  80 15  291977216
 5 L HPFS - NTFS          42626 178 49 54375 115 12  188743680
 6 L Linux                54375 147 45 60801  47 46  103227392
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited