cgsecurity.org

I want to use 'load backup' functionality of testdisk to recover my lost partitions.

I have two hard disks, 240 GB Solid state drive from which I boot, and 3TB Seagate drive for which I want to recover partitions:



This is the initial analyse screen:



This is the quick search screen:



Since all my partitions were not detected in quick search (or even deeper search), I opted to load backup:



It loads following backup, and even here all the partitions are not shown:



I think the backup shown here corresponds to following:

• #1658123175 Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
  1 : start= 91120743, size=143926272, Id=07, *
  2 : start=235047078, size= 94847697, Id=07, P
  3 : start=329894838, size= 93578562, Id=07, P
  4 : start=423473400, size=4294967295, Id=0F, E
  5 : start=423473463, size=152794152, Id=0C, L
  6 : start=576267615, size=264237120, Id=05, X
  6 : start=576267678, size=264237057, Id=07, L
  7 : start=840504735, size=338778720, Id=05, X
  7 : start=840504798, size=338778657, Id=07, L
  8 : start=1179283455, size=345365370, Id=05, X
  8 : start=1179283518, size=345365307, Id=07, L
  9 : start=1524648825, size= 2088450, Id=05, X
  9 : start=1524648888, size= 2088387, Id=82, L
  10 : start=1526738850, size= 38811742, Id=05, X
  10 : start=1526738944, size= 38811648, Id=83, L
  11 : start=4293830583, size= 1136713, Id=05, X
  11 : start=4293830656, size= 1136640, Id=07, L
  12 : start= 6044, size=1565554788, Id=05, X
  12 : start= 6144, size=1565554688, Id=07, L

I have the correct backup file where all my partitions are correctly shown, which is:

• #1658123175 Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
  1 : start= 63, size= 91120617, Id=0C, *
  2 : start= 91120680, size=1474429635, Id=0F, E
  5 : start= 91120743, size=143926272, Id=0C, L
  6 : start=235047015, size= 94847760, Id=05, X
  6 : start=235047078, size= 94847697, Id=07, L
  7 : start=329894775, size= 93578625, Id=05, X
  7 : start=329894838, size= 93578562, Id=07, L
  8 : start=423473400, size=152794215, Id=05, X
  8 : start=423473463, size=152794152, Id=0C, L
  9 : start=576267615, size=264237120, Id=05, X
  9 : start=576267678, size=264237057, Id=07, L
  10 : start=840504735, size=338778720, Id=05, X
  10 : start=840504798, size=338778657, Id=07, L
  11 : start=1179283455, size=345365370, Id=05, X
  11 : start=1179283518, size=345365307, Id=07, L
  12 : start=1524648825, size= 2088450, Id=05, X
  12 : start=1524648888, size= 2088387, Id=82, L
  13 : start=1526737275, size= 22025115, Id=05, X
  13 : start=1526737338, size= 22025052, Id=83, L
  14 : start=1548762390, size= 16787925, Id=05, X
  14 : start=1548762453, size= 16787862, Id=83, L
  3 : start=1565550315, size=2729411370, Id=07, P

However, even after changing the backup file content to above correct content, testdisk always loads the earlier backup file, and not this correct file.

I request guidance as to where the testdisk saves the backup file, and is it possible to replace this file with the above content. Also, will Testdisk then load the correct partitioning details so that I can recover the deleted partitions?

Any help will be greatly appreciated.

I am not sure if screenshot images above are visible, but I hope the issue will be clear from last two lists.

Please upload your pictures to this site. Use the attachments tab on left bottom of the page.

Hello recuperation,

Thanks for the guidance.

I am repeating my post, but somehow I am not able to more that 3 png files. Hence I will try to split the post.

I want to use 'load backup' functionality of testdisk to recover my lost partitions.

I have two hard disks, 240 GB Solid state drive from which I boot, and 3TB Seagate drive for which I want to recover partitions:
This is the initial analyse screen:
This is the quick search screen:

Since all my partitions were not detected in quick search (or even deeper search), I opted to load backup:
It loads following backup, and even here all the partitions are not shown:
I think this backup shown here corresponds to following file:

#1658123175 Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
1 : start= 91120743, size=143926272, Id=07, *
2 : start=235047078, size= 94847697, Id=07, P
3 : start=329894838, size= 93578562, Id=07, P
4 : start=423473400, size=4294967295, Id=0F, E
5 : start=423473463, size=152794152, Id=0C, L
6 : start=576267615, size=264237120, Id=05, X
6 : start=576267678, size=264237057, Id=07, L
7 : start=840504735, size=338778720, Id=05, X
7 : start=840504798, size=338778657, Id=07, L
8 : start=1179283455, size=345365370, Id=05, X
8 : start=1179283518, size=345365307, Id=07, L
9 : start=1524648825, size= 2088450, Id=05, X
9 : start=1524648888, size= 2088387, Id=82, L
10 : start=1526738850, size= 38811742, Id=05, X
10 : start=1526738944, size= 38811648, Id=83, L
11 : start=4293830583, size= 1136713, Id=05, X
11 : start=4293830656, size= 1136640, Id=07, L
12 : start= 6044, size=1565554788, Id=05, X
12 : start= 6144, size=1565554688, Id=07, L

I had previously created backup file for this disk where all my partitions are correctly shown, which is:

#1658123175 Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
1 : start= 63, size= 91120617, Id=0C, *
2 : start= 91120680, size=1474429635, Id=0F, E
5 : start= 91120743, size=143926272, Id=0C, L
6 : start=235047015, size= 94847760, Id=05, X
6 : start=235047078, size= 94847697, Id=07, L
7 : start=329894775, size= 93578625, Id=05, X
7 : start=329894838, size= 93578562, Id=07, L
8 : start=423473400, size=152794215, Id=05, X
8 : start=423473463, size=152794152, Id=0C, L
9 : start=576267615, size=264237120, Id=05, X
9 : start=576267678, size=264237057, Id=07, L
10 : start=840504735, size=338778720, Id=05, X
10 : start=840504798, size=338778657, Id=07, L
11 : start=1179283455, size=345365370, Id=05, X
11 : start=1179283518, size=345365307, Id=07, L
12 : start=1524648825, size= 2088450, Id=05, X
12 : start=1524648888, size= 2088387, Id=82, L
13 : start=1526737275, size= 22025115, Id=05, X
13 : start=1526737338, size= 22025052, Id=83, L
14 : start=1548762390, size= 16787925, Id=05, X
14 : start=1548762453, size= 16787862, Id=83, L
3 : start=1565550315, size=2729411370, Id=07, P


However, even after changing the backup file content to above correct content, testdisk always loads the earlier backup file, and not this correct file.

I request guidance as to where the testdisk saves the backup file for 'load backup' function, and is it possible to replace that file with the above content. Also, will Testdisk then load the correct partitioning details so that I can recover the deleted partitions? I tried adding the missing partitions, but I was not successful.

Any help will be greatly appreciated.

Did your 3 TB drive come with an enclosure?
Have you removed it from there?

No, it came without enclosure.

It is internal SATA drive, Seagate Barricoda

Please post your Testdisk log file.
I am always astounded how careless people are posting. I should answer that way!
Please post a data sheet for your "Seagate Barricoda".
Thank you.

Here is the log file please:



Thu Jul 21 07:40:34 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=86740303872
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=73690251264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=73186410496
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=78230605824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=600834048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=135289373184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=173454672384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=176827037184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=48562020864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=47912223744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=79423340544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=104857600
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Maxtor Z1 SSD 240GB, S/N:7PX04ARV, FW:STKSF010
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000VX000-9YW166, S/N:W1F0F09V, FW:CV12

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - ST3000VX000-9YW166
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 5672/1/1
NTFS at 14631/1/1
NTFS at 20535/1/1
BAD_RS LBA=423473462 62
BAD_RS LBA=423473463 1
FAT32 at 26360/1/1
Info: size boot_sector 152794128, partition 152794152
FAT1 : 32-18679
FAT2 : 18680-37327
start_rootdir : 37328 root cluster : 2
Data : 37328-152794127
sectors : 152794128
cluster_size : 64
no_of_cluster : 2386825 (2 - 2386826)
fat_length 18648 calculated 18648
BAD_RS LBA=576267678 1
NTFS at 35871/1/1
BAD_RS LBA=840504798 1
NTFS at 52319/1/1
BAD_RS LBA=1179283518 62
NTFS at 73407/1/1
Info: size boot_sector 345365305, partition 345365307
BAD_RS LBA=1524648888 1
BAD_RS LBA=1526738944 1
get_geometry_from_list_part_aux head=255 nbr=17
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=255 nbr=17
Current partition structure:
1 * HPFS - NTFS 5672 1 1 14630 254 63 143926272 [W10_64_3TB_D]
2 P HPFS - NTFS 14631 1 1 20534 254 63 94847697 [Win10_1511_32Bit_3TB_E]
3 P HPFS - NTFS 20535 1 1 26359 254 63 93578562 [3TB_F_W8_1_64]
4 E extended LBA 26360 0 1 293709 89 3 4294967295
X extended 26360 0 63 35870 254 63 152794153

Bad relative sector.
5 L FAT32 LBA 26360 1 1 35870 254 63 152794152 [3TB_G]

Bad relative sector.
X extended 35871 0 63 52318 254 63 264237058
6 L HPFS - NTFS 35871 1 1 52318 254 63 264237057 [3TB_H]

Bad relative sector.
X extended 52319 0 63 73406 254 63 338778658
7 L HPFS - NTFS 52319 1 1 73406 254 63 338778657 [3TB_I]

Bad relative sector.
X extended 73407 0 2 94904 254 63 345365369
8 L HPFS - NTFS 73407 1 1 94904 254 63 345365307 [3TB_J]

Bad relative sector.
X extended 94905 0 63 95034 254 63 2088388
9 L Linux Swap 94905 1 1 95034 254 63 2088387

Bad relative sector.
X extended 95035 26 31 97451 4 25 38811649
10 L Linux 95035 26 32 97451 4 25 38811648

Bad relative sector.
X extended 267349 154 6 293709 89 3 423469303

search_part()
Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=6144 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 97 34 26359 254 62 423467255
NTFS at 26359/254/63
filesystem size 93578562
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 20535 1 1 26359 254 63 93578562 [3TB_F_W8_1_64]
NTFS found using backup sector, blocksize=4096, 47 GB / 44 GiB
NTFS at 26359/254/63
filesystem size 93578562
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 26359 254 63 32184 253 62 93578562
NTFS, blocksize=4096, 47 GB / 44 GiB
NTFS at 35291/1/1
filesystem size 259947697
sectors_per_cluster 8
mft_lcn 802737
mftmirr_lcn 802736
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 35291 1 1 51471 254 58 259947697
NTFS, blocksize=4096, 133 GB / 123 GiB
BAD_RS LBA=840504798 1
NTFS at 52319/1/1
filesystem size 338778657
sectors_per_cluster 8
mft_lcn 769060
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 52319 1 1 73406 254 63 338778657 [3TB_I]
NTFS, blocksize=4096, 173 GB / 161 GiB
BAD_RS LBA=1179283518 62
NTFS at 73407/1/1
filesystem size 345365305
sectors_per_cluster 8
mft_lcn 769239
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 73407 1 1 94904 254 61 345365305 [3TB_J]
NTFS, blocksize=4096, 176 GB / 164 GiB
Linux Swap 94905 1 1 95034 254 44 2088368
SWAP2 version 1, pagesize=4096, 1069 MB / 1019 MiB

recover_EXT2: s_block_group_nr=0/84, s_mnt_count=11/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8112
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2753131
recover_EXT2: part_size 22025048
Filesystem created: Tue Oct 13 22:00:33 2015
Last mount time: Thu Oct 22 19:38:24 2015
Linux 95035 1 1 96405 254 59 22025048
ext4 blocksize=4096 Large_file Sparse_SB, 11 GB / 10 GiB

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/148, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4851421
recover_EXT2: part_size 38811368
Filesystem created: Mon Nov 11 15:21:50 2019
Linux 95035 26 32 97450 254 60 38811368
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 19 GB / 18 GiB
NTFS at 267278/152/11
filesystem size 1136640
sectors_per_cluster 8
mft_lcn 47360
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 267278 152 11 267349 89 4 1136640
NTFS, blocksize=4096, 581 MB / 555 MiB
NTFS at 267349/186/38
filesystem size 1565554688
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 267349 186 38 364801 0 63 1565554688 [New Volume]
NTFS, blocksize=4096, 801 GB / 746 GiB
get_geometry_from_list_part_aux head=255 nbr=12
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=255 nbr=12

Results
HPFS - NTFS 0 97 34 26360 28 36 423469056
HPFS - NTFS 20535 1 1 26359 254 63 93578562 [3TB_F_W8_1_64]
NTFS found using backup sector, blocksize=4096, 47 GB / 44 GiB
HPFS - NTFS 26359 254 63 32184 253 62 93578562
NTFS, blocksize=4096, 47 GB / 44 GiB
* HPFS - NTFS 35291 1 1 51471 254 63 259947702
NTFS, blocksize=4096, 133 GB / 123 GiB
P HPFS - NTFS 52319 1 1 73406 254 63 338778657 [3TB_I]
NTFS, blocksize=4096, 173 GB / 161 GiB
P HPFS - NTFS 73407 1 1 94904 254 63 345365307 [3TB_J]
NTFS, blocksize=4096, 176 GB / 164 GiB
L Linux Swap 94905 1 1 95034 254 63 2088387
SWAP2 version 1, pagesize=4096, 1069 MB / 1019 MiB
Linux 95035 1 1 96405 254 63 22025052
ext4 blocksize=4096 Large_file Sparse_SB, 11 GB / 10 GiB
Linux 95035 26 32 97451 4 25 38811648
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 19 GB / 18 GiB
L HPFS - NTFS 267278 152 11 267349 89 4 1136640
NTFS, blocksize=4096, 581 MB / 555 MiB
L HPFS - NTFS 267349 186 38 364801 0 63 1565554688 [New Volume]
NTFS, blocksize=4096, 801 GB / 746 GiB

This is the screenshot after quick search is completed:
I am running deep search and I will post the log after it is completed please.