How to convert from RAW to NTFS

How to use TestDisk to recover lost partition
Post Reply
Message
Author
AAEIV
Posts: 3
Joined: 26 Oct 2012, 13:39

How to convert from RAW to NTFS

#1 Post by AAEIV » 27 Oct 2012, 17:17

A few days ago my Seagate 2TB went to raw all of a sudden. At that point I was running Vista. I typed at a cmd

Code: Select all

chkdsk F: /i
and I got the information that my files are not NTFS but raw.
I tried to mount the HDD on my Ubuntu 10.04 system in case it works. However I got the following message

http://i.imgur.com/GNzA9.png

I then tried to fix this issue using testdisk.
The log from my first attempt is the following

Code: Select all


Fri Oct 26 14:10:57 2012
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-43-generic (#97-Ubuntu SMP Wed Sep 5 16:42:26 UTC 2012)
Compiler: GCC 4.4 - Jun 23 2009 17:48:38
ext2fs lib: 1.41.11, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       488281250 sectors
/dev/sda: user_max   488281250 sectors
/dev/sda: native_max 488281250 sectors
/dev/sda: dco        488281250 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       488281250 sectors
/dev/sdb: user_max   488281250 sectors
/dev/sdb: native_max 488281250 sectors
/dev/sdb: dco        488281250 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - ATA WDC WD2500AAJS-7
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30394 255 63, sector size=512 - ATA WDC WD2500AAJS-7


TestDisk exited normally.
I unmounted it and mounted again while initialising testdisk. At that point I was able to see my HDD on the list.
I pressed enter and then selected "Intel" in the "Partition Table Type". Next I pressed "Advanced" but there was a statement "No partition available". So I got back and selected "Analyse". A message was there stating that "Partition Read Error". Despite that I selected "Quick search". So something started to happening.

I should mention that my HDD is 2000Gb while the total cylinders that testdisk could access were ~250Gb...

When this ended there was a message saying "Strucrure OK" so I selected for a "Deeper search". When this came to an end another message was stating that "No partition found or selected for recovery".

The log from this procedure is bery big ~3GB and I cannot copy it because while loading it kills itself.

I tried another time with "Advanced". At that point I saw one partition. I entered using "list" and I saw only one folder of all. The log from the previous procedure is

Code: Select all

Sat Oct 27 10:51:01 2012
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-42-generic (#95-Ubuntu SMP Wed Jul 25 15:56:09 UTC 2012)
Compiler: GCC 4.4 - Jun 23 2009 17:48:38
ext2fs lib: 1.41.11, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       488397168 sectors
/dev/sda: user_max   488397168 sectors
/dev/sda: native_max 488397168 sectors
/dev/sda: dco        488397168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ATA WDC WD2500BEVS-2
Disk /dev/sdd - 4009 MB / 3824 MiB - CHS 1018 124 62, sector size=512 - FLASH Drive SM_USB20
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Desktop

Partition table type (auto): Intel
Disk /dev/sde - 2000 GB / 1863 GiB - Seagate Desktop
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS              0   1  1 243200 254 63 3907024002 [Expansion Drive]
     NTFS, 2000 GB / 1863 GiB

ntfs_boot_sector
1 P HPFS - NTFS              0   1  1 243200 254 63 3907024002 [Expansion Drive]
     NTFS, 2000 GB / 1863 GiB
NTFS at 0/1/1
file_pread(6,16,buffer,3907024064(243200/254/63)) read err: Input/output error
filesystem size           3907024002 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               244189000 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to read $MFTMirr: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
Failed to read index block: Input/output error.
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(6,8,buffer,1953512063(121600/127/63)) read err: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.

file_pread(6,8,buffer,1953512143(121600/129/17)) read err: Input/output error
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism
file_pread(6,8,buffer,660335(41/26/33)) read err: Input/output error
ntfs_readdir failed
Directory /ElectroMagnetism
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism
ntfs_readdir failed
Directory /ElectroMagnetism
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism
ntfs_readdir failed
Directory /ElectroMagnetism
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism
ntfs_readdir failed
Directory /ElectroMagnetism
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism
ntfs_readdir failed
Directory /ElectroMagnetism
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism
ntfs_readdir failed
Directory /ElectroMagnetism
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 .
       5 dr-xr-xr-x     0      0         0 25-May-2011 23:32 ..
      62 dr-xr-xr-x     0      0         0  5-Aug-2011 22:16 ElectroMagnetism

ntfs_boot_sector
1 P HPFS - NTFS              0   1  1 243200 254 63 3907024002 [Expansion Drive]
     NTFS, 2000 GB / 1863 GiB
NTFS at 0/1/1
filesystem size           3907024002 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               244189000 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to read $MFTMirr: Input/output error.
Is it possible to access my data again?

Thank you in advance!

Sponsored links

AAEIV
Posts: 3
Joined: 26 Oct 2012, 13:39

Re: How to convert from RAW to NTFS

#2 Post by AAEIV » 26 Dec 2012, 09:59

I also tried with photorec. The log is

Code: Select all

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
  <metadata 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' 
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
  xmlns:dc='http://purl.org/dc/elements/1.1/'>
    <dc:type>Carve Report</dc:type>
  </metadata>
  <creator>
    <package>PhotoRec</package>
    <version>6.13</version>
    <build_environment>
      <compiler>GCC 4.6</compiler>
      <compilation_date>2012-02-05T07:15:52</compilation_date>
      <library name='libext2fs' version='1.42'/>
      <library name='libewf' version='none'/>
      <library name='libjpeg' version='80'/>
      <library name='libntfs' version='10:0:0'/>
    </build_environment>
    <execution_environment>
      <os_sysname>Linux</os_sysname>
      <os_release>3.2.0-33-generic</os_release>
      <os_version>#52-Ubuntu SMP Thu Oct 18 16:29:15 UTC 2012</os_version>
      <host>MITsMag</host>
      <arch>x86_64</arch>
      <uid>0</uid>
      <start_time>2012-11-19T22:08:49+0200</start_time>
    </execution_environment>
  </creator>
  <source>
    <image_filename>/dev/sdb</image_filename>
    <sectorsize>512</sectorsize>
    <device_model>Seagate Desktop</device_model>
    <image_size>2000398934016</image_size>
    <volume>
      <byte_runs>
        <byte_run offset='0' img_offset='0' len='2000398934016'/>
      </byte_runs>
    </volume>
  </source>
  <configuration>
  </configuration>
</dfxml>
Any suggestions-opinions-advice are more than welcome...

AAEIV
Posts: 3
Joined: 26 Oct 2012, 13:39

Re: How to convert from RAW to NTFS

#3 Post by AAEIV » 27 Dec 2012, 12:24

Yesterday I tried with Parted Magic Bootable CD, in case test disk runs better in there but I couldn't get my drive mounted. I got some errors there...

The first time I tried I got an error

Code: Select all

Run: Mount /dev/sdb
Status: Finished with error(exit status 1)
udevil: error 64: unable to determine device fstype specify with -t
After that there was a list of all my drives. When I selected the external one I got the error message

Code: Select all

Run: Mount /dev/sdb1
Status: Finished with error(exit status 18)
Failed to write lock '/dev/sdb1' : Resource temporalily unavailable
Error opening '/dev/sdb1':Resource temporalily unavailable
Failed to mount :Resource temporalily unavailable
The second time I tried to mount it I got a new error message

Code: Select all

Run: Mount /dev/sdb
Status: Finished with error(exit status 1)
udevil: error 57: Cannot stat /dev/sdb: No such file or directory
Any ideas on what's going on?

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests