Repairing an NTFS

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#11 Post by veleiro »

I went ahead with the instructions.


Change partition type:
1 P FAT16 >32M 0 32 33 121601 25 24 1953519616
Change partition type:
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(5,16,buffer,1927445824(119977/243/11)) read err: Invalid argument
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#12 Post by Fiona »

It's only a diagnose.
Until you don't confirm at Write, you'll change nothing.
So you shouldn't write anything and it's intended only for diagnosis purposes.
Currently your partition is aligned on megabyte boundary.
I selected the default MBR option. On top of that, I assigned the drive a letter.
Might be your accidentally created one?
Please check it first.

Fiona
Top
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#13 Post by veleiro »

Fiona wrote:It's only a diagnose.
Until you don't confirm at Write, you'll change nothing.
So you shouldn't write anything and it's intended only for diagnosis purposes.
Currently your partition is aligned on megabyte boundary.
I selected the default MBR option. On top of that, I assigned the drive a letter.
Might be your accidentally created one?
Please check it first.

Fiona
Yes, Windows 7 created a MBR on the drive, and I gave it a letter, thats the original problem
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#14 Post by Fiona »

Could you do that diagnose first?
If it doesn't help, please create a backup as you suggested.
Then we'll go further to delete your accidentally created partition and adding an intel partition manually to have a boot sector diagnose.

I still struggle about your issue, that GetDataBACK didn't find anything in your sectors?
It's a strange behavior.
Top
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#15 Post by veleiro »

i posted the log of the diagnosis above, from the RebuildFS, as it didnt work
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#16 Post by Fiona »

Start Testdisk.
Confirm through testdisk until you see Analyse.
Your affected disk must be selected.
Confirm at Analyse and highlight Backup.
Press Enter.
If there appears a message like "do you want to search for partitions created under vista, conform with y (yes).
If Quick Search is starting any search, finish it pressing Enter for stop!
Afterwards your screen should look like this;

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63

Press a to add another partition
The menu should look like this;

[ Cylinders ] [ Heads ] [ Sectors ] [ Cylinders ] [ Heads ] [ Sectors ] [ Type ] [ Done ]
......0....... .....1..........1..........121601.......254........63.........07.....[Enter]
the Type 07 is for NTFS
Please enter exactly these values!

After confirm at [Done], you will get back to the previous screen.

In case, check your added partition, it must be primary (P).
You can check it at the left side must be a P for primary.
If not, use your arrow keys.

Press enter to proceed.

Write your partition table at Write.

Now you have an empty unformatted partition.
Don't format it, you would override your underlying file system.

Confirm in TestDisk through until you see the menu Analyse.
Don't confirm at Analyse but Advanced.
Highlight your affected partition and confirm at Boot.
Highlight Rebuild BS and hit Enter.
Rebuild BS will be in progress.
Normally, it takes some minutes.
If it's finished, please post the infos or upload a screen.
If you see a menu List, please highlight it and press enter.
Please let me know, do you see your data or an error message.
To get back to the previous screen, easily press q for Quit.
Top
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#17 Post by veleiro »

I had to go through the whole thing on RebuildFS, so it took 4 hours, and it still had the same result.

This time I attached the log because it was longer
http://www.mediafire.com/?x7403dwge47qlx8
Attachments
screen2.jpg
screen2.jpg (57.72 KiB) Viewed 36930 times
screen1.jpg
screen1.jpg (41.31 KiB) Viewed 36930 times
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Repairing an NTFS

#18 Post by Fiona »

Sry I've seen something wrong.
I've used your screen from here, if you watch your disk;
http://forum.cgsecurity.org/phpBB3/down ... php?id=144
The amount of cylinders is 121602 but it's 121601.
See your last screen.
So it might be necessary to add your partition again using the following values;
[ Cylinders ] [ Heads ] [ Sectors ] [ Cylinders ] [ Heads ] [ Sectors ] [ Type ] [ Done ]
......0....... .....1..........1..........121600.......254........63.........07.....[Enter]

The value is 121600 now!

Sry for the inconvenience!

Fiona
Top
veleiro
Posts: 17
Joined: 12 Mar 2012, 07:09

Re: Repairing an NTFS

#19 Post by veleiro »

Ok, then here is the latest log/screenshots



Fri Mar 16 07:05:16 2012
Command line: TestDisk

Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=159934054400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=8066271232
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000210466304
file_pread(4,1,buffer,312581919(73444/223/19)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 73444 224 19, sector size=512 - WDC WD1600JB-00EVA0, S/N:4457572d414d4b45303332343534 034 0 0 0 0, FW:15.05R15
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EADS-11M2B2, S/N:2020202057202d44435756414335313134383337, FW:80.00A80
Disk /dev/sdc - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500KS-00MJB0, S/N:2020202057202d4443574e41334b313539353935, FW:02.01C03
Drive E: - 8066 MB / 7692 MiB - CHS 1923 64 32, sector size=2048 - ASUS DRW-1608P3S, FW:1.06

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD10EADS-11M2B2
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
Change partition type:
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
Not an exFAT boot sector.
Not an exFAT boot sector.

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
1 * HPFS - NTFS 0 1 1 121601 254 63 1953536067
Backup partition structure
partition_save
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Search for partition aborted

Results
Change partition type:
HPFS - NTFS 0 1 1 121600 254 63 1953520002

interface_write()
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(5,16,buffer,1927445823(119977/243/10)) read err: Invalid request code
file_pread(5,16,buffer,1927446976(119978/6/29)) read err: Invalid request code
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 121600 254 63 1953520002
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.
Attachments
screen3.jpg
screen3.jpg (67.69 KiB) Viewed 36924 times
Top
User avatar
cgrenier
Site Admin
Posts: 5438
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Repairing an NTFS

#20 Post by cgrenier »

An NTFS filesystem contains an MFT and an MFT Mirror. When using RebuildBS, TestDisk searches for both copies but in your case, it has found none, the same result you get with GetDataBack.
Are you sure the partition was an NTFS and not a FAT32 or exFAT ?
In the Advanced menu, force the type to FAT32 LBA and try again Boot, RebuildBS, List. Choose Write if it works.
Top
Locked

Return to “Filesystem repair”