The following partitions can't be recovered

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

The following partitions can't be recovered

#1 Post by woist »

Hi there!

I was hoping someone from here would be able to help me restore my data or/and partition structure.

I was searching the forums and I couldn't find the solution to my problem. I'm also new with testdisk. Here is the story: my raspberry pi stopped working and I took sd card out and found with gparted that it's corrupted. I then ran fsck -a /dev/sde2 (second partition - ext4 is the problematical) and the output I got was:

Code: Select all

fsck from util-linux 2.22.2
fsck.ext2: Bad magic number in super-block while trying to open /dev/sde2
/dev/sde2: 
The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
Don't know what I should do next with fsck or e2fsck because I don't know what would blocksize 8193 do...

Then I tried with testdisk. Here is how I tried to get my data back and repair partition structure:
Started testdisk -> create new log -> selected /dev/sde (my sd card) -> enter on Intel parition -> analyse -> quick search -> continue -> continue

I think I have multiple problems here due to the following messages:
- check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1
- The harddisk (3965 MB / 3782 MiB) seems too small! (< 4798 MB / 4576 MiB)
- The following partitions can't be recovered
- Warning: the current number of heads per cylinder is 122 but the correct value may be 255.

About the following partition can't be recovered. There should only be one Linux (ext4) partition but testdisk shows two partitions. Probably because I accidentally try to analyze boot sector and did a mistake due to my ignorance and not ask first and act later :cry: hope I didn't mess things even more because of this mistake.

Screenshots:
after analyse
Image

after quick search
Image

after continue - second partition
Image

after continue -> continue
Image

after enter
Image

after deep search
Image

I would me most grateful if someone takes 2minutes of her/his life and explains to me what is going on and how can I restore my second partition. Note that first partition (fat) is working and I can mount it normally.

Again I'd be much appricieted if someone who is more knowladgable in this area could help me out.

Log:

Code: Select all

Tue Apr  2 14:04:12 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.7.10-1-ARCH (#1 SMP PREEMPT Thu Feb 28 09:50:17 CET 2013) x86_64
Compiler: GCC 4.7
Compilation date: 2013-01-29T15:43:06
ext2fs lib: 1.42.7, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       234441648 sectors
/dev/sda: user_max   234441648 sectors
/dev/sda: native_max 234441648 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSA2CW120G3, S/N:BTPR1363032Y120LGN, FW:4PC10362
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WD 10EAVS External, FW:1.05
Disk /dev/sde - 3965 MB / 3781 MiB - CHS 1023 122 62, sector size=512 - Generic- SD/MMC, FW:1.00

Partition table type (auto): Intel
Disk /dev/sde - 3965 MB / 3781 MiB - Generic- SD/MMC
Partition table type: Intel

Analyse Disk /dev/sde - 3965 MB / 3781 MiB - CHS 1023 122 62
Geometry from i386 MBR: head=64 sector=32
BAD_RS LBA=2048 3968
FAT16 at 0/33/3
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
Info: size boot_sector 184320, partition 184320
FAT1 : 4-183
FAT2 : 184-363
start_rootdir : 364
Data : 400-184319
sectors : 184320
cluster_size : 4
no_of_cluster : 45980 (2 - 45981)
fat_length 180 calculated 180
BAD_RS LBA=186368 688324
check_part_i386 failed for partition type 83
Current partition structure:
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
 1 * FAT32 LBA                0  33  3    24  77 58     184320

Bad relative sector.
No ext2, JFS, Reiser, cramfs or XFS marker
 2 P Linux                   24  77 59  1023 105 30    7558144
 2 P Linux                   24  77 59  1023 105 30    7558144

Bad relative sector.
Computes LBA from CHS for Disk /dev/sde - 3965 MB / 3782 MiB - CHS 1024 122 62
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sde - 3965 MB / 3782 MiB - CHS 1024 122 62
FAT16 at 0/33/3
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
FAT1 : 4-183
FAT2 : 184-363
start_rootdir : 364
Data : 400-184319
sectors : 184320
cluster_size : 4
no_of_cluster : 45980 (2 - 45981)
fat_length 180 calculated 180

FAT16 at 0/33/3
     FAT16 >32M               0  33  3    24  77 58     184320
     FAT16, 94 MB / 90 MiB

recover_EXT2: s_block_group_nr=0/28, s_mnt_count=9/4294967295, s_blocks_per_group=32768, s_inodes_per_group=7776
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 944768
recover_EXT2: part_size 7558144
     Linux                  234  24 57  1233  52 28    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
This partition ends after the disk limits. (start=1771520, size=7558144, end=9329663, disk end=7745536)

recover_EXT2: s_block_group_nr=0/28, s_mnt_count=9/4294967295, s_blocks_per_group=32768, s_inodes_per_group=7776
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 944768
recover_EXT2: part_size 7558144
     Linux                  239 108 37  1239  14  8    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
This partition ends after the disk limits. (start=1814528, size=7558144, end=9372671, disk end=7745536)
Disk /dev/sde - 3965 MB / 3782 MiB - CHS 1024 122 62
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3965 MB / 3782 MiB) seems too small! (< 4798 MB / 4576 MiB)
The following partitions can't be recovered:
     Linux                  234  24 57  1233  52 28    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
     Linux                  239 108 37  1239  14  8    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
Warning: the current number of heads per cylinder is 122 but the correct value may be 255.

Results
   * FAT16 >32M               0  33  3    24  77 58     184320
     FAT16, 94 MB / 90 MiB

interface_write()
 1 * FAT16 >32M               0  33  3    24  77 58     184320

search_part()
Disk /dev/sde - 3965 MB / 3782 MiB - CHS 1024 122 62
FAT16 at 0/33/3
check_FAT: Unusual number of reserved sectors 4 (FAT), should be 1.
FAT1 : 4-183
FAT2 : 184-363
start_rootdir : 364
Data : 400-184319
sectors : 184320
cluster_size : 4
no_of_cluster : 45980 (2 - 45981)
fat_length 180 calculated 180

FAT16 at 0/33/3
     FAT16 >32M               0  33  3    24  77 58     184320
     FAT16, 94 MB / 90 MiB

recover_EXT2: s_block_group_nr=0/28, s_mnt_count=9/4294967295, s_blocks_per_group=32768, s_inodes_per_group=7776
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 944768
recover_EXT2: part_size 7558144
     Linux                  234  24 57  1233  52 28    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
This partition ends after the disk limits. (start=1771520, size=7558144, end=9329663, disk end=7745536)

recover_EXT2: s_block_group_nr=0/28, s_mnt_count=9/4294967295, s_blocks_per_group=32768, s_inodes_per_group=7776
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 944768
recover_EXT2: part_size 7558144
     Linux                  239 108 37  1239  14  8    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
This partition ends after the disk limits. (start=1814528, size=7558144, end=9372671, disk end=7745536)
Disk /dev/sde - 3965 MB / 3782 MiB - CHS 1024 122 62
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3965 MB / 3782 MiB) seems too small! (< 4798 MB / 4576 MiB)
The following partitions can't be recovered:
     Linux                  234  24 57  1233  52 28    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
     Linux                  239 108 37  1239  14  8    7558144
     EXT4 Large file Sparse superblock Recover, 3869 MB / 3690 MiB
Warning: the current number of heads per cylinder is 122 but the correct value may be 255.

Results
   * FAT16 >32M               0  33  3    24  77 58     184320
     FAT16, 94 MB / 90 MiB

interface_write()
 1 * FAT16 >32M               0  33  3    24  77 58     184320
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Top
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

Re: The following partitions can't be recovered

#2 Post by woist »

Hi there.

Note that I was searching the forums and I couldn't find a solution for my mess here. I was however able to restore some data from other hard drive some time ago but didn't have such problems as with this sd card...

So please, I ask someone, anyowne who is experienced with TestDisk and data recovery to help me save my data. I will be much grateful.
Top
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

Re: The following partitions can't be recovered

#3 Post by woist »

If someone would at least give me an explanation of what is going on including my mistake I made with testdisk would help a lot.
Top
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

Re: The following partitions can't be recovered

#4 Post by woist »

Still struggling to rescue my data but so far no rescued data.

Can someone give me at list a hint what to do? I Would be much grateful :!:
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: The following partitions can't be recovered

#5 Post by Fiona »

Would it be possible to repeat your diagnose and partition table type none?
Currently it looks like your partition starts not at the beginning of the card and ends after disk limit.
Before we use any trick like increasing the amount of cylinder to have a try to access the data of your partition, I'd like to see the results of partition table type None.
You'll find the partition table types after you confirmed with enter at your disk/card selection.
To provide the complete diagnose, you can copy and paste the contetnt of the testdisk.log.

Fiona
Top
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

Re: The following partitions can't be recovered

#6 Post by woist »

Fiona, thank you so much for your reply!

Here are the steps how I performed no partition choice:

After no partition table:
Image

after analyse
Image

after quick search
Image

after contiune
Image

after enter
Image

after deeper search
Image

after continue
Image

after enter
Image

And here is the log: http://sprunge.us/PeNC

Fiona, thank you again for your time and help :!:

Hope the log and/or screen shots help you help me.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: The following partitions can't be recovered

#7 Post by Fiona »

Didn't find another ext4-partition!
Your current ext4-partition is still in your partition table.
To have a try to run fsck successful, you can use testdisk to determine a backup of your superblock and run fsck again.
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
For ext4-partitions is the same procedure.
Otherwise you'd need dataraecovery software which reads underlying data in sectors, like PhotoRec.

Fiona
Top
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

Re: The following partitions can't be recovered

#8 Post by woist »

Hi Fiona!

Thank you for your help!

If I understand this correctly my superblock size s_blocksize=4096 is 4096 and is located at block numbers_blocks_per_group=32768 32768?

That is if I'm reading log correctly...
Top
woist
Posts: 7
Joined: 02 Apr 2013, 12:59

Re: The following partitions can't be recovered

#9 Post by woist »

Fiona, some promising news!

This is what I did:

Code: Select all

sudo fsck.ext4 -b 32768 -B 4096 /dev/sde2
and this is what I got:

Code: Select all

e2fsck 1.42.7 (21-Jan-2013)
/dev/sde2: recovering journal
fsck.ext4: unable to set superblock flags on /dev/sde2


/dev/sde2: ***** FILE SYSTEM WAS MODIFIED *****

/dev/sde2: ********** WARNING: Filesystem still has errors **********
Then I ran testdisk and again chose no partition;

here are the steps I did:

quick search
Image

after quick search
Image

after enter
Image

after deeper search
Image

after continue
Image

Image
Image

Here is the log http://sprunge.us/KQNj


Note that after quick search there is ext4 partition present. Is there anything else I can do to get as much data back as I can with testdisk or is that it?

Thank you for your help so far Fiona, I really appreciate it.
Top
Locked

Return to “Partition Recovery”