Cant get partition to original working condititon

How to use TestDisk to recover lost partition
Post Reply
Message
Author
skyhy2007
Posts: 1
Joined: 09 Sep 2012, 01:43

Cant get partition to original working condititon

#1 Post by skyhy2007 » 09 Sep 2012, 12:32

Well I've spent the last 6-7 hours reading through the forum Trying to find something resembling my situation, and although a few came close, I'm still at a loss on how to go about trying to restore the partition on my HD.
First I'll give a brief recap of what happen to bring me here. I was installing a Truecrypt Hidden OS on one of my three HD,s in my PC. I have 2 1tb HD's and a 500g HD. I had already partitioned a 1tb HD as required by truecrypt, and just finished cloning the os into the hidden Volume. All that was left was to erase my OS in the first partition, re-install it again, and encrypt it. I was ready to restart comp and reboot from my recovery cd's and install OS again (btw my OS is Win 7 64bit) so I shut down my comp. After waiting a minute or so I powered up comp, inserted recovery cd #1, and followed instructions for a factory install.
Then Truecrypt popped up with its instructions for encrypting the installation and all was fine untill about 60 seconds into the install I noticed the progress bar was going abit to slow for a normal full format and install on a 450g partition, (half the 1tb HD as the hidden OS is on the other half). Actually it was going about half as fast and thats when it hit me that I forgot to disconnect the other two HD's and that it was installing to my other 1tb HD instead, so I quickly pulled the plug on the comp after about 90 seconds after the install began. Well as you know thats enough time to wipe out the boot record and some other stuff as well.
OK, here's where I'm at. I restarted comp and boot up from my 3rd 500g HD, as it had Win 7 already on it. I went to disk management and checked the status of my 2nd HD (1st HD is the 1tb with two parts for TrueCrypt, 2nd HD is 1tb with 1 930g part and a 1 14g part with a copy of my factory install, and 3rd HD is my 500g That I use as my system,(boot) drive). And as for the condition of my 2nd HD........UNALLOCATED ! So after surfing the net I found Testdisk and read every page on the website and half of the forum so I would go about this without screwing things up more.
So using Testdisk and a couple other recovery programs i've managed to erase the two partitions the install created (a 100mb at start of HD and a 90g for "C" drive. The last 900g it left unallocated.). Also was able to figure out the exact CHS parameters for my original 930g partition and re-created it usinf Testdisk. I ran Photorec and it's finding I'd say about 90% of the 75,000 pics, 15,000 docs and 2,500 vids. 800g's of data. It's even finding the names of some of the docs and pics. So I'm in the LONG proccess of having Photorec find and copy it all to my 1st HD (Truecrypt was expendable as I need the whole HD for storage.
My dilema is that allthough the data is being recovered, it'll take me a year to go through and try to rename close to 100,000 files, and even then I'd never get them to their original. I'm so close to having the partition back up with all the info back, but I cant figure out where to go from here or if there;s even anywhere I could go to bring my original partition back up. So far I've got Testdisk showing my I have one partition at 917g's and 14.6g's unallocated at the end (the space my recovery partition used. The first partition shows as RAW and after deepsearch I get the usual "Boot sector and backup boot sector are bad.....yada yada" I know that the first boot sector got wiped by the creation of the two partition during the install, but dont know why backup boot sector shows as bad. So is it possible to create a boot sector from scratch? heres the log from my last Testdisk session.


Sorry, But wouldn't let me attach anything and I don't know how to create a window or include a link so here's
a copy of the log.
_________________________________________________________________________________________________

Sun Sep 09 03:40:22 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Sep 1 2012 21:55:28
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=238222508544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=11728322560
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=458227712000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=984886769664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=13735297024
filewin32_getfilesize(\\.\I:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\I:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=528236937216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=0
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=0
Warning: can't get size for \\.\N:
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Drive C: - 238 GB / 221 GiB - CHS 28962 255 63, sector size=512
Drive D: - 11 GB / 10 GiB - CHS 1425 255 63, sector size=512
Drive F: - 458 GB / 426 GiB - CHS 55709 255 63, sector size=512
Drive G: - 984 GB / 917 GiB - CHS 119738 255 63, sector size=512
Drive H: - 13 GB / 12 GiB - CHS 1669 255 63, sector size=512
Drive J: - 528 GB / 491 GiB - CHS 64221 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972

search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 204800000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 12761 21 60 204800000
NTFS, blocksize=4096, 104 GB / 97 GiB
Search for partition aborted

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 12761 21 60 204800000
NTFS, blocksize=4096, 104 GB / 97 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12761 21 60 204800000

search_part()
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 204800000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 12761 21 60 204800000
NTFS, blocksize=4096, 104 GB / 97 GiB
Search for partition aborted

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 12761 21 60 204800000
NTFS, blocksize=4096, 104 GB / 97 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12761 21 60 204800000
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
filesystem size 1 17570647280098216873
sectors_per_cluster 0 174
mft_lcn 0 4015269165
mftmirr_lcn 0 1529750907
clusters_per_mft_record 0 8
clusters_per_index_record 0 37
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 2001, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 8533
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024

mft at 70249, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 8533
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024

mft at 206801, seq=1, main=0 res=1
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024

Search mft stopped: 917504/1923606972
Potential partition:
1 * HPFS - NTFS 0 32 33 119739 31 32 1923606972
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
filesystem size 1 17570647280098216873
sectors_per_cluster 0 174
mft_lcn 0 4015269165
mftmirr_lcn 0 1529750907
clusters_per_mft_record 0 8
clusters_per_index_record 0 37
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Change partition type:
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
Not an exFAT boot sector.
Not an exFAT boot sector.

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
filesystem size 1 17570647280098216873
sectors_per_cluster 0 174
mft_lcn 0 4015269165
mftmirr_lcn 0 1529750907
clusters_per_mft_record 0 8
clusters_per_index_record 0 37
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Boot sector Backup boot sector
0000 00000000 00000000 ........ f6dfe052 18745d61 ...R.t]a
0008 00000000 00000000 ........ c0fdc90e a4aee22c .......,
0010 00000000 00000000 ........ 9851d985 264a8901 .Q..&J..
0018 00000000 00000000 ........ d37dc5ae d4731a43 .}...s.C
0020 00000000 00000000 ........ 885f01b0 634f6906 ._..cOi.
0028 00000000 00000000 ........ a80bf0a3 9b7ad7f3 .....z..
0030 00000000 00000000 ........ 2d2554ef 3ab67c61 -%T.:.|a
0038 00000000 00000000 ........ 7b252e5b 3541cdbf {%.[5A..
0040 00000000 00000000 ........ 08b928f5 2545500b ..(.%EP.
0048 00000000 00000000 ........ 034a4158 e822ecbf .JAX."..
0050 00000000 00000000 ........ 1c1960a8 c1f4d6f8 ..`.....
0058 00000000 00000000 ........ c2db6ce1 4f40b440 ..l.O@.@
0060 00000000 00000000 ........ 3180ed1e c357e4df 1....W..
0068 00000000 00000000 ........ 103c49a3 67673c7e .<I.gg<~
0070 00000000 00000000 ........ f3a35b1e 6d0f440d ..[.m.D.
0078 00000000 00000000 ........ 937b44f8 9d0b9495 .{D.....
0080 00000000 00000000 ........ a518f991 8bce886c .......l
0088 00000000 00000000 ........ 1795782f 6e583a6b ..x/nX:k
0090 00000000 00000000 ........ 1d431942 e9bd08ac .C.B....
0098 00000000 00000000 ........ 9247d88d 8b1bcb9f .G......
00A0 00000000 00000000 ........ 69401424 8b2ad7d9 i@.$.*..
00A8 00000000 00000000 ........ 2d6cb842 8f8652c9 -l.B..R.
00B0 00000000 00000000 ........ 08ef5496 8c17e021 ..T....!
00B8 00000000 00000000 ........ 307e572c 937b19f5 0~W,.{..
00C0 00000000 00000000 ........ 1db93f4b e8bb0e31 ..?K...1
00C8 00000000 00000000 ........ b27e7358 cfde9d34 .~sX...4
00D0 00000000 00000000 ........ 4f519134 cf9d0138 OQ.4...8
00D8 00000000 00000000 ........ efa3fb3b b502a7f3 ...;....
00E0 00000000 00000000 ........ 6c3ecd67 804062fc l>.g.@b.
00E8 00000000 00000000 ........ dfa34718 745b61a0 ..G.t[a.
00F0 00000000 00000000 ........ b5ee275f 64a317d1 ..'_d...
00F8 00000000 00000000 ........ 67893923 482c0942 g.9#H,.B
0100 00000000 00000000 ........ b8386b97 b487b4de .8k.....
0108 00000000 00000000 ........ 420dc57a 2f4ffae6 B..z/O..
0110 00000000 00000000 ........ 6e2a3d87 1fe72edf n*=.....
0118 00000000 00000000 ........ 893e706f a622f99c .>po."..
0120 00000000 00000000 ........ 405948fa 2edf59f9 @YH...Y.
0128 00000000 00000000 ........ 14c39931 9684d78f ...1....
0130 00000000 00000000 ........ d7e5dadc 50884dc4 ....P.M.
0138 00000000 00000000 ........ fa1ca29f 544232f4 ....TB2.
0140 00000000 00000000 ........ 184077ee 700777a9 .@w.p.w.
0148 00000000 00000000 ........ a02490da 53c0e88a .$..S...
0150 00000000 00000000 ........ 5666a82b 81cb0d87 Vf.+....
0158 00000000 00000000 ........ ae9c8575 2e98c759 ...u...Y
0160 00000000 00000000 ........ 39911372 710146ba 9..rq.F.
0168 00000000 00000000 ........ 1373d785 36a65e50 .s..6.^P
0170 00000000 00000000 ........ 6fdc36b8 abec15f6 o.6.....
0178 00000000 00000000 ........ f1b3a216 5d70eb02 ....]p..
0180 00000000 00000000 ........ 38b05e96 8e6e5346 8.^..nSF
0188 00000000 00000000 ........ a3290c1c 04d66ef1 .)....n.
0190 00000000 00000000 ........ 6a079c33 2933cf68 j..3)3.h
0198 00000000 00000000 ........ 56486e72 84e19dd9 VHnr....
01A0 00000000 00000000 ........ cbe1cdf8 b315faf1 ........
01A8 00000000 00000000 ........ e1c2d945 0481aabd ...E....
01B0 00000000 00000000 ........ 56ff80dc 18dcb3c2 V.......
01B8 00000000 00000000 ........ c07bdd4f bea8eae0 .{.O....
01C0 00000000 00000000 ........ 1edb2b54 6dd7c45f ..+Tm.._
01C8 00000000 00000000 ........ 2a76af23 a38d516d *v.#..Qm
01D0 00000000 00000000 ........ 00fef27d 40281a75 ...}@(.u
01D8 00000000 00000000 ........ 13908e7d 6295155a ...}b..Z
01E0 00000000 00000000 ........ 43018d20 befae152 C.. ...R
01E8 00000000 00000000 ........ abe4abd6 d394047b .......{
01F0 00000000 00000000 ........ aacbbc92 c2f621c4 ......!.
01F8 00000000 00000000 ........ 11003b5e fb35c552 ..;^.5.R

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 119738 254 63 1923606972
filesystem size 1 17570647280098216873
sectors_per_cluster 0 174
mft_lcn 0 4015269165
mftmirr_lcn 0 1529750907
clusters_per_mft_record 0 8
clusters_per_index_record 0 37
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
A new copy of MBR code has been written.
You have to reboot for the change to take effect.

TestDisk exited normally.


___________________________________________________________________________

The above log is what i get after rebooting and going through the above process again

The partition does show up in windows as drive G and is a simple healthy active
primary partition with a RAW filesystem.




The log is what i get after rebooting and going through the process again
The partition does show up in windows as drive G and is a simple healthy active
primary partition with a RAW filesystem. Is there anything else I can do to bring back the partition
completely?

Thank you for your time reading all of this :)

Sponsored links

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests