cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Partition still not recognized after repair

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=12290

Page 1 of 2

Partition still not recognized after repair

Posted: 09 Mar 2023, 05:51
by Rushkie
So I have a USB external drive I accidentally deleted the only/primary (I think it was GPT) partition on. I successfully found it using Testdisk under [Intel], verified the found partition has the files I lost inside it, and re-wrote it following the partition recovery instructions. It shows up as this:

Untitled0.png
Untitled0.png (13.74 KiB) Viewed 7126 times

However after rebooting windows is shows the drive as strangely partitioned:

Untitled.png
Untitled.png (6.04 KiB) Viewed 7126 times

I went back and searched for partitions under [EFI GPT] and it finds two like this:

Untitled2.png
Untitled2.png (39.44 KiB) Viewed 7125 times

Their sizes seem to match what shows in Windows disk management in the first screenshot ("EFI System" I'm assuming is the 2TB partition and "MS Data" is the rest of the drive). I'm not sure how all this happened, but am wondering if the existence of those is preventing Windows from seeing the proper Intel partition? If so I'm not sure how to delete them? Testdisk only gives me a delete option under the [Intel] menu, not when I'm in [EFI GPT] and I'm hesitant to use any delete function for obvious reasons! Is this something I need to go outside of testdisk to fix?

Thanks for your help!

Re: Partition still not recognized after repair

Posted: 09 Mar 2023, 08:38
by recuperation
Please upload your pictures to this site.

Re: Partition still not recognized after repair

Posted: 09 Mar 2023, 22:00
by Rushkie
recuperation wrote: 09 Mar 2023, 08:38 Please upload your pictures to this site.
Apologies I did not see the attachments tab at first! I have updated the images and thanks again.

Re: Partition still not recognized after repair

Posted: 09 Mar 2023, 22:36
by recuperation
Please post your Testdisk log file.

Re: Partition still not recognized after repair

Posted: 09 Mar 2023, 22:47
by Rushkie
Here is my log file:

Code: Select all


Thu Mar  9 13:45:29 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2048408248320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2048408248320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=16003048144896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=16003115254272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2048408248320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2048408248320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=16003048144896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=16003115254272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=2048390353408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=131432448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2048405798912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=16002903441408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=510616284672
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=480101007360
Hard disk list
Disk /dev/sda - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - INTEL SSDSC2BP480G4, S/N:BTJR519303US480BGN, FW:L2010420
Disk /dev/sdb - 2048 GB / 1907 GiB - CHS 249038 255 63, sector size=512 - T-FORCE 2TB, S/N:TPBF2301030030200907, FW:V1128A0
Disk /dev/sdc - 2048 GB / 1907 GiB - CHS 249038 255 63, sector size=512 - Samsung SSD 850 PRO 2TB, S/N:S2KMNX0H705827H, FW:EXM03B6Q
Disk /dev/sdd - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 850 PRO 512GB, S/N:S39FNWAH991656R, FW:EXM03B6Q
Disk /dev/sde - 16 TB / 14 TiB - CHS 1945593 255 63, sector size=512 - Elite Pro Dual-R0, S/N:RANDOM__28A1A9457808, FW:0105
Disk /dev/sdf - 16 TB / 14 TiB - CHS 1945601 255 63, sector size=512 - OWC MEPD-C RAID0, S/N:D71088327002
Drive D: - 131 MB / 125 MiB - CHS 31 64 32, sector size=2048 - ASUS DRW-24F1ST   c, FW:1.01

Partition table type (auto): Intel
Disk /dev/sde - 16 TB / 14 TiB - Elite Pro Dual-R0
Partition table type: Intel

Analyse Disk /dev/sde - 16 TB / 14 TiB - CHS 1945593 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 * HPFS - NTFS             25 159  7 267374 248  9 4294967295

search_part()
Disk /dev/sde - 16 TB / 14 TiB - CHS 1945593 255 63
     HPFS - NTFS             25 159  7 1945592 252  4 31255539712
     exFAT, blocksize=262144, 16 TB / 14 TiB
file_pread(8,2,buffer,31255953408(1945593/29/37)) ReadFile The drive cannot find the sector requested.

file_pread(8,1,buffer,31255953408(1945593/29/37)) ReadFile The drive cannot find the sector requested.

file_pread(8,2,buffer,31255953467(1945593/30/33)) lseek err Invalid argument
file_pread(8,1,buffer,31255953467(1945593/30/33)) lseek err Invalid argument
file_pread(8,2,buffer,31255953471(1945593/30/37)) lseek err Invalid argument
file_pread(8,2,buffer,31255953530(1945593/31/33)) lseek err Invalid argument
file_pread(8,1,buffer,31255953530(1945593/31/33)) lseek err Invalid argument
file_pread(8,2,buffer,31255953592(1945593/32/32)) lseek err Invalid argument
file_pread(8,1,buffer,31255953592(1945593/32/32)) lseek err Invalid argument
file_pread(8,2,buffer,31255953593(1945593/32/33)) lseek err Invalid argument
file_pread(8,2,buffer,31255953656(1945593/33/33)) lseek err Invalid argument
file_pread(8,1,buffer,31255953656(1945593/33/33)) lseek err Invalid argument
file_pread(8,8,buffer,31255953408(1945593/29/37)) ReadFile The drive cannot find the sector requested.

file_pread(8,1,buffer,31255953408(1945593/29/37)) ReadFile The drive cannot find the sector requested.

file_pread(8,1,buffer,31255953409(1945593/29/38)) lseek err Invalid argument
file_pread(8,14,buffer,31255953410(1945593/29/39)) lseek err Invalid argument
file_pread(8,3,buffer,31255953424(1945593/29/53)) lseek err Invalid argument
file_pread(8,3,buffer,31255953471(1945593/30/37)) lseek err Invalid argument
file_pread(8,8,buffer,31255953487(1945593/30/53)) lseek err Invalid argument
file_pread(8,11,buffer,31255953534(1945593/31/37)) lseek err Invalid argument
file_pread(8,2,buffer,31255955456(1945593/62/6)) lseek err Invalid argument

Results
   * HPFS - NTFS             25 159  7 1945592 252  4 31255539712
     exFAT, blocksize=262144, 16 TB / 14 TiB

interface_write()
 1 * HPFS - NTFS             25 159  7 1945592 252  4 31255539712
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

Re: Partition still not recognized after repair

Posted: 09 Mar 2023, 23:51
by recuperation
Rushkie wrote: 09 Mar 2023, 05:51 So I have a USB external drive I accidentally deleted the only/primary (I think it was GPT) partition on.
Could you describe what you exactly did what caused your loss of partition(s)?
Has the drive inside been used before to boot an operating system?

Re: Partition still not recognized after repair

Posted: 10 Mar 2023, 00:25
by Rushkie
So it's a stupid story but I was using Clonezilla to copy my system drive, which has always had some weird boot problem and Clonezilla said there was both a GPT and MBR sector and so I tried using it to delete the GPT one from my system drive, but got the drive list mixed up and wound up deleting the partition from my external drive instead that I am now trying to recover (I did the process again with the correct drive and worked as intended, I didn't accidentally start overwriting this lost drive or anything besides delete the partition table). I don't know what exactly Clonezilla did in the process of deleting it, if it also wrote something to the boot sector or what. Perhaps it also caused it to be seen now as a bootable drive? I don't know, but the answer is no, I've never used the drive I'm trying to recover as a system or boot drive, only for storage.

Re: Partition still not recognized after repair

Posted: 10 Mar 2023, 14:49
by recuperation
MBR is not the right partition table, you should have selected GPT instead.

The Testdisk log file states that your drive shows a logical sector size of 512 bytes.
A MBR-type partion table only has 4 byte fields to save sector numbers.
4 byte equals 4 byte *8 bit/byte =32 bit and allows to address 2^32 different sector numbers.

The total space that can be addressed is 2^32 sectors x 512 byte/sector = 2 199 023 255 552 bytes.
Only a GPT partition table can address the whole space of 16 TB as it has wider fields for sector numbers so that the whole space can be addressed.

You would need to rerun Testdisk and use GPT.

Re: Partition still not recognized after repair

Posted: 10 Mar 2023, 16:42
by Rushkie
recuperation wrote: 10 Mar 2023, 14:49 MBR is not the right partition table, you should have selected GPT instead.

The Testdisk log file states that your drive shows a logical sector size of 512 bytes.
A MBR-type partion table only has 4 byte fields to save sector numbers.
4 byte equals 4 byte *8 bit/byte =32 bit and allows to address 2^32 different sector numbers.

The total space that can be addressed is 2^32 sectors x 512 byte/sector = 2 199 023 255 552 bytes.
Only a GPT partition table can address the whole space of 16 TB as it has wider fields for sector numbers so that the whole space can be addressed.

You would need to rerun Testdisk and use GPT.
Thank you, so I'm understanding correctly I should be selecting [EFI GPT]? That's what I originally did and found a partition with my files in it, which is what's shown in the first screenshot. However completing the partition recovery process still isn't making the drive recognized by windows. Which is what led me to look under [Intel] and see those other entries. Otherwise, please let me know if I'm misunderstanding!

Re: Partition still not recognized after repair

Posted: 10 Mar 2023, 18:28
by recuperation
Rushkie wrote: 10 Mar 2023, 16:42 Thank you, so I'm understanding correctly I should be selecting [EFI GPT]? That's what I originally did and found a partition with my files in it, which is what's shown in the first screenshot. However completing the partition recovery process still isn't making the drive recognized by windows. Which is what led me to look under [Intel] and see those other entries.
So nothing changed after writing the partition table?
All times are UTC+01:00
Page 1 of 2

Powered by phpBB® Forum Software © phpBB Limited