TestDisk doesn't seem to write partition structure

How to use TestDisk to recover lost partition
Post Reply
Message
Author
Deltaflyer
Posts: 2
Joined: 09 Sep 2012, 21:09

TestDisk doesn't seem to write partition structure

#1 Post by Deltaflyer » 09 Sep 2012, 21:49

Hi every one,

my daughters Vista machine a week ago didn't boot anymore after a defrag run was interrupted by some kind of power failure. Trying to boot, it always says something like "Insert your Windows Vista CD".

After some days, I discovered this great tool TestDisk by Christophe Grenier and tried it out with some kind of success. Here's what I did:

- the disc in question is a 1TB disc and had 3 partitions: Boot, Daten-Partition and Recover.
- I removed the disc from the original machine and inserted it in my one
- in my computer I could see all my drives including the 3 from the new disc (see screen-1.jpg )
screen-1.jpg
My Computer, drives J:, X: and S: are from the disc in question
screen-1.jpg (76.22 KiB) Viewed 2165 times
- the partitions Daten-Partition and Recover are visible and accessible, but not drive S: which should be Boot
- I ran TestDisk, selected the drive, selected partition tabel ty Intel and finally selected Analyse
- TestDisk was able to see all three partitions
- I selected Quick Search and Boot was detected as Primary bootable (see Screen-2
.jpg)
screen-2.jpg
Partition structure
screen-2.jpg (58.44 KiB) Viewed 2165 times
- at this point I was able to list the files on Boot by pressing P
- I pressed Enter and in the next screen I pressed Write
- all seemed to be ok and TestDisk said I have to reboot for the changes to take effect
- After reboot teh situation was the same as in screen-1
I attached the log, that TestDisk has written (see testdisk.log)

How can I get Boot bootable again ?

Thanks in advance !
Last edited by Deltaflyer on 10 Sep 2012, 19:00, edited 1 time in total.

Sponsored links

Deltaflyer
Posts: 2
Joined: 09 Sep 2012, 21:09

Re: TestDisk doesn't seem to write partition structure

#2 Post by Deltaflyer » 10 Sep 2012, 19:00

Here's the log, I forgot yesterday (I repeated the procedure today because the results is always the same):

Mon Sep 10 19:55:11 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdi)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdj)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdk)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdl)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive7) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive7) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive7
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive8)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive9)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive10)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive11)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=490920214528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=245529516032
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=499597180928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=290887565312
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=484701110272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=0
Warning: can't get size for \\.\N:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=500096991744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=0
Warning: can't get size for \\.\P:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=0
Warning: can't get size for \\.\Q:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=1000202241024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=494019801088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=61892198400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=66059239424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=59768832000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=57671680000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=21479228416
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=1000202241024
file_pread(4,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(7,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(8,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(9,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(10,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(11,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EADX-22TDHB0, S/N:W -DCWVAR5251875, FW:77.0
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EADS-42P6B0, S/N:W -DCWVAR5975712, FW:02.0
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EACS-22D6B0, S/N:152D20337A0C
Disk /dev/sdg - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST350083 0AS
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST310005 28AS, S/N:801130168383
Disk /dev/sdj - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WD 5000AAV External, S/N:WD-WCAUH0198582, FW:1.75
Disk /dev/sdk - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDS721010CLA332
Disk /dev/sdl - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WD 10EACS External, FW:1.65
Drive C: - 490 GB / 457 GiB - CHS 59684 255 63, sector size=512
Drive D: - 245 GB / 228 GiB - CHS 29850 255 63, sector size=512
Drive T: - 61 GB / 57 GiB - CHS 7524 255 63, sector size=512
Drive U: - 66 GB / 61 GiB - CHS 8031 255 63, sector size=512
Drive V: - 59 GB / 55 GiB - CHS 7266 255 63, sector size=512
Drive W: - 57 GB / 53 GiB - CHS 7011 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WDC WD10 EACS-22D6B0
Partition table type: Intel
file_pread(6,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 60061/71/43
FAT32 at 118989/161/20
Info: size boot_sector 41951618, partition 41951618
FAT1 : 36-10273
FAT2 : 10274-20511
start_rootdir : 20512 root cluster : 2
Data : 20512-41951615
sectors : 41951618
cluster_size : 32
no_of_cluster : 1310347 (2 - 1310348)
fat_length 10238 calculated 10238
Current partition structure:
1 * HPFS - NTFS 0 32 33 60061 71 34 964882424 [BOOT]
2 P HPFS - NTFS 60061 71 43 118989 127 50 946681856 [Daten-Partition]
3 P FAT32 LBA 118989 161 20 121600 254 63 41951618 [RECOVER]
Computes LBA from CHS for Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size 964882424
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 119472895
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 60061 71 34 964882424 [BOOT]
NTFS, 494 GB / 460 GiB
NTFS at 60061/71/43
filesystem size 946681856
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 59167615
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60061 71 43 118989 127 50 946681856 [Daten-Partition]
NTFS, 484 GB / 451 GiB
FAT32 at 118989/161/20
FAT1 : 36-10273
FAT2 : 10274-20511
start_rootdir : 20512 root cluster : 2
Data : 20512-41951615
sectors : 41951618
cluster_size : 32
no_of_cluster : 1310347 (2 - 1310348)
fat_length 10238 calculated 10238

FAT32 at 118989/161/20
FAT32 LBA 118989 161 20 121600 254 63 41951618 [RECOVER]
FAT32, 21 GB / 20 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525183(121601/81/16)) lseek err Invalid argument
file_pread(6,1,buffer,1953525183(121601/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,1953525311(121601/83/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525439(121601/85/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525567(121601/87/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525695(121601/89/24)) lseek err Invalid argument
file_pread(6,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(6,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(6,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(6,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 60061 71 34 964882424 [BOOT]
NTFS, 494 GB / 460 GiB
P HPFS - NTFS 60061 71 43 118989 127 50 946681856 [Daten-Partition]
NTFS, 484 GB / 451 GiB
P FAT32 LBA 118989 161 20 121600 254 63 41951618 [RECOVER]
FAT32, 21 GB / 20 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 60061 71 34 964882424 [BOOT]
2 P HPFS - NTFS 60061 71 43 118989 127 50 946681856 [Daten-Partition]
3 P FAT32 LBA 118989 161 20 121600 254 63 41951618 [RECOVER]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

davexnet
Posts: 3
Joined: 08 Sep 2012, 04:18

Re: TestDisk doesn't seem to write partition structure

#3 Post by davexnet » 11 Sep 2012, 05:38

I don't know the answer, but I have posted a similar question to yours, with out
receiving any reply. In my case, the events leading up to the problem are hazy,
the owner thyought that there may have been a virus, but had no real details
except it suddenly wouldn't boot.

Since the partition is RAW, I cannot assign a drive letter, and I cannot run Chkdsk or a virus scan.

Is your situation similar?

I booted XP's recovery console from CD and typed in FIXMBR. XP immediately warned me that the
MBR is non standard and re-writing it may overlay the partition table (even if that's true,
I assume Testdisk could recreate it)

Why would an Acer Aspire laptop with XP and a recovery partition have a non-standard MBR?
Infected by a virus?

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest