Bad GPT partition - how to replace it with alternate?

[ermac]

I've tried to repair some chinese pendrive with some weird chinese firmware tool but instead writing new sectors only on pendrive they were written on every removable media connected to pc. I've managed to recover most of my important files from smaller MBR drives without visible partitions. On 4TB GPT drive windows drive management shows weird unmountable set of partitions while testdisk reports bad GPT but shows all partitions correctly (allowing listing and copying files and directories without problem). So my question is: Is there a way to replace bad GPT with alternate version reported by testdisk at this point? Or should I do very time consuming quick search or simply copy everything and reformat whole drive?







part of log shows proper partition structure:

Code: Select all

Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 453024 138 4, sector size=512 - TS128GSS D370, S/N:4C91914039, FW:N112
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60797 255 63, sector size=512 - WD Elements 25A2, S/N:WXN1A57JCNPT, FW:1019
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Seagate Expansion, S/N:NA8HTT67, FW:0708
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST350041 8AS, S/N:00000000000000000000, FW:0105
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00AAKX-003CA0, S/N:00000000000000000000, FW:0105

Partition table type (auto): EFI GPT
Disk /dev/sdc - 4000 GB / 3726 GiB - Seagate Expansion
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=7814037166
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=7814037133
hdr_lba_table=7814037134
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144
 2 P MS Data                   264192 2147747839 2147483648 [Download]
 3 P MS Data               2147747840 3615754239 1468006400 [Filmy]
 4 P MS Data               3615754240 5083760639 1468006400 [Muzyka]
 5 P MS Data               5083760640 7231244287 2147483648 [Gry]
 6 P MS Data               7231244288 7650674687  419430400 [Programy]
 7 P MS Data               7650674688 7692617727   41943040 [Dokumenty]
 8 P MS Data               7692617728 7793063935  100446208 [Backup]
 9 P MS Data               7793063936 7814035455   20971520 [Encrypted]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144
 2 P MS Data                   264192 2147747839 2147483648 [Download]
 3 P MS Data               2147747840 3615754239 1468006400 [Filmy]
 4 P MS Data               3615754240 5083760639 1468006400 [Muzyka]
 5 P MS Data               5083760640 7231244287 2147483648 [Gry]
 6 P MS Data               7231244288 7650674687  419430400 [Programy]
 7 P MS Data               7650674688 7692617727   41943040 [Dokumenty]
 8 P MS Data               7692617728 7793063935  100446208 [Backup]
 9 P MS Data               7793063936 7814035455   20971520 [Encrypted]

[recuperation]

Why is it weird, what windows drive management shows?
If you do not tell how your drive was partitioned before, your statement is incomprehensible. Furthermore, when looking into the logfile it becomes obvious that the structure shown on you screenshot was derived by the alternate GPT.

Obviously you have put into separate partitions what others would have put into separate folders. If this corresponds to the healthy state of your drive before using your Chinese software you should write that partition table structure.
Maybe you should delete one of the double entries numbere "1" and "2" in the Testdisk partition list.

[ermac]

Why is it weird, what windows drive management shows?

because all partitions have incorrect sizes and file system, some of them are "unassigned" (free space) and I can't assign letters to healthy ones

Drive was partitioned almost exactly as testdisk shows - except the two reserved ones:
those ones were visible in windows drive management:

Code: Select all

 2 P MS Data                   264192 2147747839 2147483648 [Download]
 3 P MS Data               2147747840 3615754239 1468006400 [Filmy]
 4 P MS Data               3615754240 5083760639 1468006400 [Muzyka]
 5 P MS Data               5083760640 7231244287 2147483648 [Gry]
 6 P MS Data               7231244288 7650674687  419430400 [Programy]
 7 P MS Data               7650674688 7692617727   41943040 [Dokumenty]
 8 P MS Data               7692617728 7793063935  100446208 [Backup]
 9 P MS Data               7793063936 7814035455   20971520 [Encrypted]

all ntfs except 8 [Backup] which was fat32, none bootable/system - as far I remember all were logical


I never seen those those two before

Code: Select all

1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144

Furthermore, when looking into the logfile it becomes obvious that the structure shown on you screenshot was derived by the alternate GPT.

I understand that but how can I replace bad GPT with alternate one so structure showed in testdisk was also visible in windows?

[recuperation]

Why is it weird, what windows drive management shows?

because all partitions have incorrect sizes and file system, some of them are "unassigned" (free space) and I can't assign letters to healthy ones

Drive was partitioned almost exactly as testdisk shows - except the two reserved ones:
those ones were visible in windows drive management:

Code: Select all

 2 P MS Data                   264192 2147747839 2147483648 [Download]
 3 P MS Data               2147747840 3615754239 1468006400 [Filmy]
 4 P MS Data               3615754240 5083760639 1468006400 [Muzyka]
 5 P MS Data               5083760640 7231244287 2147483648 [Gry]
 6 P MS Data               7231244288 7650674687  419430400 [Programy]
 7 P MS Data               7650674688 7692617727   41943040 [Dokumenty]
 8 P MS Data               7692617728 7793063935  100446208 [Backup]
 9 P MS Data               7793063936 7814035455   20971520 [Encrypted]

all ntfs except 8 [Backup] which was fat32, none bootable/system - as far I remember all were logical


I never seen those those two before

Code: Select all

1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144

Furthermore, when looking into the logfile it becomes obvious that the structure shown on you screenshot was derived by the alternate GPT.

I understand that but how can I replace bad GPT with alternate one so structure showed in testdisk was also visible in windows?

As there is no menu item to replace a bad GPT structure with the duplicate you have to go through the normal recovery process as described here:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

At some point your partitions will show up and you should use the p-key ("list files") to verify that the partitions contain the readable content that you expect.
If the partition status of a partition is still in a deleted state, set it to "primary". "Logical" should not be visible when dealing with a GPT structure.
Finally you would need to confirm that the partition table will be written.

The old MBR partitioning scheme that includes a so-called "extended partition" and "logical partitions" can only handle the first 2 TB of a drive when the sector size is 512 byte.
If you removed your drive from a housing the drive behaviour may change as the housing may contain converting electronics that emulates a sector size of 4096.
With a emulated sector size of 4096 bytes a MBR scheme can access 4 TB as well.

The Microsoft reserved partition that you found is not being shown in disk management but can be seen when running the diskpart command.

As i have never heard of Microsoft using it I guess this is a nice free space where viruses and governmental agencies can hide and/or store data.

[ermac]

Actually in my case linux GPT fdisk by Rod Smith was quicker way to restore partitions - "c" and then "w" from recovery/transformation command
more info: http://www.rodsbooks.com/gdisk/repairing.html

As i have never heard of Microsoft using it I guess this is a nice free space where viruses and governmental agencies can hide and/or store data.

Now it is only one and it has 128MB - is it safe to delete it?

[recuperation]

I don't know.