Not sure which options to use

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
PhotoBoy
Posts: 6
Joined: 22 Mar 2012, 06:37

Not sure which options to use

#1 Post by PhotoBoy »

Hello!

I backed up my 500GB laptop drive last weekend and reformatted it and started to repartition it so I could dual-boot. Somewhere in there, I also did the same to the 2TB external drive containing the backup of the laptop drive.

I used testdisk to grab the laptop drive files back, but didn't get many of them in what would have been my Windows profile folders, such as Desktop, My Documents, etc. These folders are empty, while others in the profile seem fine. My goal at this point is to try to get those files.

At this point, I'm not sure what else is possible. Is there a way to chase after the specific files I am looking for, or can I fix the original partitions? Since the drives are huge, everything takes a while to analyze. I'd like to get right to whatever has the best chance for success.

I'm not sure of everything I did, but here's where I started in case someone can give advice.

Laptop drive:
500GB Dell factory partitions (which I think were DELLUTILTY, RECOVERY, the OS, and a small empty? partition)
I think I repartitioned this to NTFS and created a 6 GB partition, a 100GB partition, before I realized the mistake.

External drive:
2TB factory NTFS partition
I'm not entirely sure how I repartitioned this. Probably much like the laptop drive since that is what I thought I was working on.

Thanks for any assistance anyone can offer!
PhotoBoy
Posts: 6
Joined: 22 Mar 2012, 06:37

Re: Not sure which options to use

#2 Post by PhotoBoy »

I don't remember (I was barely awake) what I ran on the external drive, but it seems to have ended abnormally. Any advice on what to do next with this drive? Thanks in advance!

Here's the full log:

Thu Mar 22 05:17:12 2012
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-21-generic (#32-Ubuntu SMP Fri Apr 16 08:10:02 UTC 2010)
Compiler: GCC 4.4 - Jun 23 2009 17:11:34
ext2fs lib: 1.41.11, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 3694640 sectors
/dev/sda: dco 976773168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 976773168 sectors
/dev/sdb: user_max 976773168 sectors
/dev/sdb: native_max 3694640 sectors
/dev/sdb: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA ST9500420AS
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA ST9500420AS
Disk /dev/sdc - 16 GB / 14 GiB - CHS 15286 64 32, sector size=512 - SanDisk Cruzer
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WD Ext HDD 1021
Disk /dev/sr1 - 100 MB / 95 MiB - CHS 49151 1 1 (RO), sector size=2048 - SanDisk Cruzer

Partition table type (auto): Intel
Disk /dev/sde - 2000 GB / 1863 GiB - WD Ext HDD 1021
Partition table type: Intel

Analyse Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
New options :
Dump : No
Cylinder boundary : Yes
Allow partial last cylinder : Yes
Expert mode : Yes

Interface Advanced

Interface Advanced

Analyse Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 0

search_part()
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced

Analyse Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sde - 2000 GB / 1863 GiB - WD Ext HDD 1021
Partition table type: None

Interface Advanced
P Unknown 0 0 1 243201 254 63 3907040130
Change partition type:
P FAT32 0 0 1 243201 254 63 3907040130

fat32_boot_sector
P FAT32 0 0 1 243201 254 63 3907040130
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

P FAT32 0 0 1 243201 254 63 3907040130
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=5357991, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
FAT32 at 1464218(91/36/36), nbr=1
FAT32 at 1464219(91/36/37), nbr=1
FAT differs, FAT sectors=0-1/1
first_fat 1464218, second_fat 1464219
FAT : 32, reserved=0, fat_length=0
find_sectors_per_cluster skip_sectors=178850 (skip_offset=91571200)
Can't find cluster size

fat32_boot_sector
P FAT32 0 0 1 243201 254 63 3907040130
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
P NTFS 0 0 1 243201 254 63 3907040130

ntfs_boot_sector
P NTFS 0 0 1 243201 254 63 3907040130
filesystem size 17693262833910943942 1
sectors_per_cluster 190 0
mft_lcn 1225836163 0
mftmirr_lcn 3047224948 0
clusters_per_mft_record -16 0
clusters_per_index_record 116 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Search mft stopped: 1376256/3907040130
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
P NTFS 0 0 1 243201 254 63 3907040130
filesystem size 17693262833910943942 1
sectors_per_cluster 190 0
mft_lcn 1225836163 0
mftmirr_lcn 3047224948 0
clusters_per_mft_record -16 0
clusters_per_index_record 116 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Current partition structure:
P Unknown 0 0 1 243201 254 63 3907040130

search_part()
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63

SYSV4 Marker at 1402/113/24

recover_sysv4
SysV 4 1402 113 24 3597865901 54 41 57799693172736 [ò·/Äëˆ]
SysV4, 29593 TB / 26915 TiB
This partition ends after the disk limits. (start=22530272, size=2318270464, end=2340800735, disk end=3907040130)

HFS magic value at 1961/249/28
part_size 2750170515
HFS 1961 249 28 173152 44 42 2750170515 [šI#±ÝRÐpSqÍÁZêE?>þ6ĄŠ]
HFS, 1408 GB / 1311 GiB
EXFAT 181721 218 39 181721 218 38 0
EXFAT, 0 B
Partition not added.
FAT12 at 181734/19/49
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 181734/19/49
FAT12 181734 19 49 181735 93 60 20739 [NO NAME]
FAT12, 10 MB / 10 MiB

HFS magic value at 188507/174/38
part_size 2121682611
HFS 188507 174 38 320576 81 22 2121682611 [‚/]
HFS, 1086 GB / 1011 GiB
This partition ends after the disk limits. (start=3028375954, size=2121682611, end=855091268, disk end=3907040130)

cramfs Marker at 190824/227/13

recover_cramfs
CramFS 190824 227 13 190910 74 45 1371983 [GW¹€Ø«ÝŠœÍ(bždSÜ]
cramfs, 702 MB / 669 MiB

LVM magic value at 193737/44/39

LVM magic value at 195644/200/26

LVM magic value at 195681/117/58

LVM magic value at 198924/152/54
check_FAT: Incorrect number of bytes per sector 63932 (FAT) != 512 (HD)
check_FAT: Bad jump in FAT partition

HFS magic value at 203326/58/49
part_size 1929002163
HFS 203326 58 49 323401 15 45 1929002163 [°ÌOüô]
HFS, 987 GB / 919 GiB
This partition ends after the disk limits. (start=3266435892, size=1929002163, end=900470758, disk end=3907040130)
NTFS at 204028/40/13
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 204028 40 13 204028 138 12 6174 [Boot]
NTFS, 3161 KB / 3087 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 204217/205/21
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 204217/205/21
FAT12 204217 205 21 204217 251 2 2880 [EFISECTOR]
FAT12, 1474 KB / 1440 KiB
NTFS at 204703/75/5
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 204703 75 5 204703 173 4 6174 [Boot]
NTFS, 3161 KB / 3087 KiB

HFS magic value at 207371/53/10
part_size 1233944578
HFS 207371 53 10 284180 180 1 1233944578
HFS, 631 GB / 588 GiB
This partition ends after the disk limits. (start=3331418463, size=1233944578, end=270395744, disk end=3907040130)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 212359/111/57
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 212359/111/57
FAT12 212359 111 57 212359 157 38 2880 [EFISECTOR]
FAT12, 1474 KB / 1440 KiB

HFS magic value at 213281/229/54
part_size 2637064706
HFS 213281 229 54 377431 149 49 2637064706 [7,nö1ª[6$tÈÊfÛ#&­
ÜX]]
HFS, 1350 GB / 1257 GiB
This partition ends after the disk limits. (start=3426373745, size=2637064706, end=1768471154, disk end=3907040130)

LVM magic value at 214225/236/22

LVM magic value at 214943/186/6

block_group_nr 18947

recover_EXT2: "e2fsck -b 889281727 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=18947/0, s_mnt_count=11/0, s_blocks_per_group=3268592533, s_inodes_per_group=117503883
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 1
recover_EXT2: part_size 2
ext4 104268 210 45 104268 210 46 2 [ú]
EXT4 Recover Journal dev Backup superblock, 1024 B

LVM magic value at 215737/246/22

LVM magic value at 218191/227/9

HFS magic value at 219089/38/51
part_size 12583170
HFS 219089 38 51 219872 106 41 12583170
HFS, 6442 MB / 6144 MiB

HFS magic value at 220666/180/40
part_size 1646481
HFS 220666 180 40 220769 50 15 1646481 [B1-5E7øA862C-AD45FBB1ë<]
HFS, 842 MB / 803 MiB

LVM magic value at 224077/76/39

LVM magic value at 224631/78/31

block_group_nr 42136

recover_EXT2: part_offset problem
FAT32 at 226609/203/45
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 226609/203/46
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 226609/203/46
FAT12 226609 203 46 226609 249 27 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB

LVM magic value at 231126/226/42

block_group_nr 18947

recover_EXT2: "e2fsck -b 889281727 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=18947/0, s_mnt_count=11/0, s_blocks_per_group=3268592533, s_inodes_per_group=117503883
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 4
recover_EXT2: part_size 8
ext4 129344 78 7 129344 78 14 8 [ú]
EXT4 Journal dev Backup superblock, 4096 B

LVM magic value at 242365/4/14
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 29593 TB / 26915 TiB)
The following partitions can't be recovered:
SysV 4 1402 113 24 3597865901 54 41 57799693172736 [ò·/Äëˆ]
SysV4, 29593 TB / 26915 TiB
HFS 188507 174 38 320576 81 22 2121682611 [‚/]
HFS, 1086 GB / 1011 GiB
HFS 203326 58 49 323401 15 45 1929002163 [°ÌOüô]
HFS, 987 GB / 919 GiB
HFS 207371 53 10 284180 180 1 1233944578
HFS, 631 GB / 588 GiB
HFS 213281 229 54 377431 149 49 2637064706 [7,nö1ª[6$tÈÊfÛ#&­
ÜX]]
HFS, 1350 GB / 1257 GiB
SIGINT detected! TestDisk has been killed.
PhotoBoy
Posts: 6
Joined: 22 Mar 2012, 06:37

Re: Not sure which options to use

#3 Post by PhotoBoy »

Here's the deeper search of the laptop 500GB. I'm trying to get files/partitions back from the original Dell factory partitions. Looks like a mess, but I'm not sure. Help?
Attachments
testdisk.log.zip
(88.28 KiB) Downloaded 800 times
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Not sure which options to use

#4 Post by cgrenier »

Unless you have seen your old partition while using Quick Search or Deeper Search, run PhotoRec, in Options, enable the expert mode, launch a Search on the whole disk, use a 512 bytes blocksize, use the default values otherwise.
PhotoBoy
Posts: 6
Joined: 22 Mar 2012, 06:37

Re: Not sure which options to use

#5 Post by PhotoBoy »

Good day CJ. Thanks for the help.

I started what you said, but was prompted if I wanted to try to unformat a FAT file system. I said no for now and it will run all day while I'm at work. Should I try again?

Also, I noticed some file types are not in the list. Of critical importance of the top of my head (there may be others) is my Adobe Lightroom .lrdata and .lrcat catalog files. While photorec find and take these?

I'm curious, have you given the photorec advice because I just want some files back, or are the partitions too messed up to do anything with? In other words, if photorec doesn't get what I need this time, are there any next steps?

Thanks for the help and for such a great product. Donation will be on the way.
PhotoBoy
Posts: 6
Joined: 22 Mar 2012, 06:37

Re: Not sure which options to use

#6 Post by PhotoBoy »

Photorec ran about 3 hours and had about 8 to go when it ended with a core dump. Is there a log I can grab?

Also, I just realized two most important files I am looking for were at least a couple hundred megabytes each, and thus likely highly fragmented. Would that mean photorec would not work, and only option to try to rebuild the file system?
Attachments
20120324 testdisk 500GB deeper search.log.zip
(5.34 KiB) Downloaded 645 times
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Not sure which options to use

#7 Post by cgrenier »

Use PhotoRec 6.14-WI instead of 6.11 to avoid the bug:

Code: Select all

wget -N http://www.cgsecurity.org/testdisk-6.14-WIP.linux26.tar.bz2
tar xjf testdisk-6.14-WIP.linux26.tar.bz2
cd testdisk-6.14-WIP
sudo ./photorec_static
If the original file was fragmented, PhotoRec may not work, it only handle some simple form of data fragmentation.
There is no miracle way to recover your data if fragmentation is heavy or complex: the information is missing and can't be recreated.
PhotoBoy
Posts: 6
Joined: 22 Mar 2012, 06:37

Re: Not sure which options to use

#8 Post by PhotoBoy »

Thank you Christophe!

Yes, I understand there are limitations to what any tool can do. I'm out of storage to try the Photorec at this point.

With time came recollection about how I got here. I think the drive with the best likelihood for recovery is the 2TB backup since little to nothing should have been written there. It was originally formatted as NTFS from the factory. I bought two of them at the same time. Would I be able to rebuild anything on the one in question using partition information from the good one?

--Jeff
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Not sure which options to use

#9 Post by cgrenier »

Unless it's a disk image, there is no information you can use to improve the recovery.
Locked