Recovering deleted partition. Two identical tables?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
user84
Posts: 1
Joined: 08 Feb 2022, 21:03

Recovering deleted partition. Two identical tables?

#1 Post by user84 »

Greeting. This is my story
1) Desided to use my old long-working but now idle HDD Seagate 250 GB ST3250410AS with Win7 installed on it and checked it with Victoria ( with no errors )
2) Format it using gpart from FDD ( because default win7 format didnt work due to old win7 installed active volume, i suppose )
3) Checked it with Victoria again ( still with no errors )
4) transfer my work archive ( since 2007 T_T ) from another HDD
5) work happily for two days with rebooting
6) today reboot my PC and get midding HDD and RAW file system T_T

TestDisk shows following:

Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63

The hard disk (250 GB / 232 GiB) seems too small! (< 500 GB / 465 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 30401 42 41 60802 52 49 488392704

[ Continue ]
NTFS, blocksize=4096, 250 GB / 232 GiB


And then

Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
Partition Start End Size in sectors
>D HPFS - NTFS 0 32 33 30401 10 9 488390656 [Work] NTFS, blocksize=4096, 250 GB / 232 GiB
D HPFS - NTFS 0 32 33 30401 42 41 488392704 [Work] NTFS found using backup sector, blocksize=4096, 250 GB / 232 GiB


While checking with "P list files" get identical file tree.

Need help with further action =(

SMART:
----------------------------------------------------------------------------
CrystalDiskInfo 8.15.0 (C) 2008-2022 hiyohiyo
Crystal Dew World: https://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 7 Professional SP1 [6.1 Build 7601] (x64)
Date : 2022/02/09 8:04:42

----------------------------------------------------------------------------
(02) ST3250410AS
----------------------------------------------------------------------------
Model : ST3250410AS
Firmware : 3.AAF
Serial Number : 6RY7VA19
Disk Size : 250,0 GB (8,4/137,4/250,0/250,0)
Buffer Size : 16384 KB
Queue Depth : 32
# of Sectors : 488395055
Rotation Rate : Unknown
Interface : Serial ATA
Major Version : ATA/ATAPI-7
Minor Version : ----
Transfer Mode : ---- | SATA/300
Power On Hours : 45041 hours
Power On Count : 7396 count
Temperature : 35 C (95 F)
Health Status : Caution
Features : S.M.A.R.T., NCQ
APM Level : ----
AAM Level : ----
Drive Letter :

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 100 253 __6 000000000000 Read Error Rate
03 _97 _97 __0 000000000000 Spin-Up Time
04 _93 _93 _20 000000001DAA Start/Stop Count
05 100 100 _36 000000000001 Reallocated Sectors Count
07 _85 _60 _30 0000169010E2 Seek Error Rate
09 _49 _49 __0 00000000AFF1 Power-On Hours
0A 100 100 _97 000000000000 Spin Retry Count
0C _93 _93 _20 000000001CE4 Power Cycle Count
BB 100 100 __0 000000000000 Reported Uncorrectable Errors
BD 100 100 __0 000000000000 High Fly Writes
BE _65 _48 _45 0000340C0023 Airflow Temperature
C2 _35 _52 __0 000C00000023 Temperature
C3 _60 _54 __0 00000E021AB7 Hardware ECC recovered
C5 100 100 __0 000000000000 Current Pending Sector Count
C6 100 100 __0 000000000000 Uncorrectable Sector Count
C7 200 200 __0 000000000000 UltraDMA CRC Error Count
C8 100 253 __0 000000000000 Write Error Rate
CA 100 253 __0 000000000000 Data Address Mark Error
TestDisk log

Wed Feb 9 08:09:22 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=450096005120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202241024
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-00BN5A0, S/N:2020202057202d44435733433546313235333131, FW:01.01A01
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ST3250410AS, S/N:2020202020202020202020205236375941563931, FW:3.AAF
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - NVMe Samsung SSD 970, S/N:0025_3859_0142_DD41., FW:2B2Q

Partition table type defaults to Intel
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - ST3250410AS
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
Current partition structure:
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/32/33
filesystem size 488390656
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 30401 10 9 488390656 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
NTFS at 30401/42/41
filesystem size 488392704
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 30401 42 41 488392704 [Work]
NTFS found using backup sector, blocksize=4096, 250 GB / 232 GiB
NTFS at 30401/42/41
filesystem size 488392704
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 30401 42 41 60802 52 49 488392704
NTFS, blocksize=4096, 250 GB / 232 GiB
This partition ends after the disk limits. (start=488394751, size=488392704, end=976787454, disk end=488395055)
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (250 GB / 232 GiB) seems too small! (< 500 GB / 465 GiB)
The following partition can't be recovered:
HPFS - NTFS 30401 42 41 60802 52 49 488392704
NTFS, blocksize=4096, 250 GB / 232 GiB

Results
HPFS - NTFS 0 32 33 30401 10 9 488390656 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
HPFS - NTFS 0 32 33 30401 42 41 488392704 [Work]
NTFS found using backup sector, blocksize=4096, 250 GB / 232 GiB
recuperation
Posts: 3036
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering deleted partition. Two identical tables?

#2 Post by recuperation »

user84 wrote: 08 Feb 2022, 21:28

Results
HPFS - NTFS 0 32 33 30401 10 9 488390656 [Work]
NTFS, blocksize=4096, 250 GB / 232 GiB
HPFS - NTFS 0 32 33 30401 42 41 488392704 [Work]
NTFS found using backup sector, blocksize=4096, 250 GB / 232 GiB
If you are just missing one partition, select the bigger one (the second one above with the backup boot sector found) and have it written.
Based on your SMART information that is showing some weird values I would either duplicate the drive or extract all necessary files and folders to another disk using Testdisk.
Locked