HELP! Recovering Formatted NTFS Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
JoeCanada
Posts: 4
Joined: 14 May 2013, 04:44

HELP! Recovering Formatted NTFS Partition

#1 Post by JoeCanada »

OK, so here's my sad story:
I am running Ubuntu 12.04. I was reformatting a USB stick, so I fired up GParted (don't ask...), unmounted the volume and clicked format. I must have been tired, since I didn't double-check WHICH drive I was doing it to, and I reformatted my data storage drive :o It was a 500GB drive formatted as NTFS.

Later that day, I opened that drive, and realized what I had done...I tried Testdisk once, but the partition that had the same name as the original was only half the size of the original (250GB) and appears to be the last half of the drive space. Still missing more than half my data! There are two more partitions visible from 'deeper search', but they show no data. So I decided to step away slowly...

Now, I want to tread lightly here. Normally, I'd experiment and figure it out, but I don't want to cause any more damage and risk losing more than I have. Fortunately, I've written nothing to the drive, so in theory the data is still sitting there waiting to be found. I have 2 questions:

1) Can somebody recommend a testdisk 'sequence of events' that I can try for my particular set of circumstances?

2) If the partition table is unrecoverable, is there software that can match the files as they sit on the drive and grab them one-by-one? (Easeus is one company I've heard of...is their software successful?)

I will continue to search for the answers that I seek, but I appreciate all input!
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: HELP! Recovering Formatted NTFS Partition

#2 Post by Fiona »

Would it be possible to repeat your diagnose and copy and paste the content of your testdisk.log?
You'll find it in your testdisk folder.

I'd like to check disk size and your disk geometry also,
That's why your log file of your diagnose is appreciated.

Fiona
Top
JoeCanada
Posts: 4
Joined: 14 May 2013, 04:44

Re: HELP! Recovering Formatted NTFS Partition

#3 Post by JoeCanada »

Certainly! Here is a link to my log from when I ran the 'deeper search' last night:

https://dl.dropboxusercontent.com/u/424 ... stdisk.log

And a screenshot of where I sit right after a 'deeper search'. Note my original drive was named 'CEREBELLUM', and if I'm reading this right, it's starting in the middle of the drive space? I Think the middle partition is the one I overwrite the original with, but I'm not sure.

Image

Thanks again for you assistance!
Top
JoeCanada
Posts: 4
Joined: 14 May 2013, 04:44

Re: HELP! Recovering Formatted NTFS Partition

#4 Post by JoeCanada »

Just some more screenshots when I use the 'p' option to view the files:

Image
Image
Image
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: HELP! Recovering Formatted NTFS Partition

#5 Post by Fiona »

It's difficult to figure out, why your partition became into 2 parts/partitions?
The first partition where you got an error message you can have a try to run Advanced / Boot and Rebuild BS to have a try to find your lacking data.
Rebuild BS searches the file system and displays the result if you use List.
If you're able to watch your data, please let me know.
Currently it's recommended to copy your data using testdisk.
If you don't find your missed data, you can try PhotoRec.
PhotoRec doesn't keep file names and directories.
If you'd like to recover file names and directories, you need commercial software.

Fiona
Top
JoeCanada
Posts: 4
Joined: 14 May 2013, 04:44

Re: HELP! Recovering Formatted NTFS Partition

#6 Post by JoeCanada »

Fiona wrote:The first partition where you got an error message you can have a try to run Advanced / Boot and Rebuild BS to have a try to find your lacking data.
Rebuild BS searches the file system and displays the result if you use List.
If you're able to watch your data, please let me know.
Nothing...comes up with a blank partition :(
Fiona wrote: Currently it's recommended to copy your data using testdisk.
Could you explain further what you mean by this?

Regarding the one where it says the Filesystem is Damaged...is there a way to repair this besides what you have suggested? If it matters, this drive was not one I booted from. I understand NTFS backs up the partition table or something elsewhere on the disk?

Otherwise...what commercial software has the highest success rate?
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: HELP! Recovering Formatted NTFS Partition

#7 Post by Fiona »

In your case it's recommended to copy/backup data first.
For example the third partition CEREBELLUM contains data;
https://dl.dropboxusercontent.com/u/424 ... tdisk1.png
You should copy/backup them first.
If you list your data, at the bottom of the screen, you'll find all the commands.
Could you explain further what you mean by this?
It was only intended if you're able to list your data.
Rebuiling a boot sector war a try to get data visible, so that you can copy them.
Unfortunately it didn't work.

In your case, you should use datarecovery software and scan your whole disk and check, do you find all your data?
PhotoRec would be able to recover data.
But it doesn't keep file names and directories.
Otherwise you can test a trial of commercial datarecovery software.

Fiona
Top
joel96
Posts: 3
Joined: 27 May 2013, 18:34

Re: HELP! Recovering Formatted NTFS Partition

#8 Post by joel96 »

I have a similar issue. I quick formatted the larger data partition, and deleted the smaller boot partition. I ran it with disk geometry set to 204800, 255, and 63. Here's the results from Deeper Scan with TestDisk:

Code: Select all

Mon May 27 15:13:58 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-05-25T13:15:04
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=750153367552
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=103809024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=499999834112
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 2009821 27 18, sector size=512 - ST3500418AS, S/N:2020202020202020202020205635374d56464d4a, FW:CC38
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750330AS, S/N:2020202020202020202020205139304b5438504d, FW:SD1A
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1001FALS-00J7B0, S/N:2020202057202d444d5754413856373530393738, FW:05.00K05

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ST3500418AS
Partition table type: Intel

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 2009821 27 18
Geometry from i386 MBR: head=224 sector=19
BAD_RS LBA=2048 1941
NTFS at 4/5/15
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
BAD_RS LBA=206848 25754
NTFS at 425/16/11
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
Current partition structure:
Warning: number of heads/cylinder mismatches 224 (NTFS) != 27 (HD)
Warning: number of sectors per track mismatches 19 (NTFS) != 18 (HD)
 1 * HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]

Warning: Bad starting head (CHS and LBA don't match)
Warning: number of heads/cylinder mismatches 224 (NTFS) != 27 (HD)
Warning: number of sectors per track mismatches 19 (NTFS) != 18 (HD)
 2 P HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]

Warning: Bad ending sector (CHS and LBA don't match)

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 2009821 27 18
NTFS at 4/5/15
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]
     NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 425/16/11
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
filesystem size           976562176
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]
     NTFS, blocksize=4096, 499 GB / 465 GiB
file_pread(4,2,buffer,976773596(2009822/5/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773596(2009822/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976773614(2009822/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773614(2009822/6/15)) lseek err Invalid argument
file_pread(4,2,buffer,976773632(2009822/7/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773632(2009822/7/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774082(2009823/5/15)) lseek err Invalid argument
file_pread(4,1,buffer,976774082(2009823/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774100(2009823/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976774100(2009823/6/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774567(2009824/5/14)) lseek err Invalid argument
file_pread(4,1,buffer,976774567(2009824/5/14)) lseek err Invalid argument
file_pread(4,2,buffer,976774568(2009824/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774586(2009824/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976774586(2009824/6/15)) lseek err Invalid argument
file_pread(4,2,buffer,976775053(2009825/5/14)) lseek err Invalid argument
file_pread(4,1,buffer,976775053(2009825/5/14)) lseek err Invalid argument
file_pread(4,2,buffer,976775054(2009825/5/15)) lseek err Invalid argument
file_pread(4,1,buffer,976775054(2009825/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976775072(2009825/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976775072(2009825/6/15)) lseek err Invalid argument
file_pread(4,3,buffer,976773183(2009821/9/16)) lseek err Invalid argument
file_pread(4,1,buffer,976773183(2009821/9/16)) lseek err Invalid argument
file_pread(4,8,buffer,976773199(2009821/10/14)) lseek err Invalid argument
file_pread(4,11,buffer,976773246(2009821/13/7)) lseek err Invalid argument
file_pread(4,2,buffer,976775168(2009825/12/3)) lseek err Invalid argument
file_pread(4,8,buffer,976773376(2009821/20/11)) lseek err Invalid argument
Warning: the current number of heads per cylinder is 27 but the correct value may be 255.

Results
   * HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]
     NTFS, blocksize=4096, 103 MB / 99 MiB
   P HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]
     NTFS, blocksize=4096, 499 GB / 465 GiB

interface_write()
 1 * HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]
 2 P HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 2009821 27 18
NTFS at 4/5/15
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]
     NTFS, blocksize=4096, 103 MB / 99 MiB
NTFS at 421/10/14
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
filesystem size           202752
sectors_per_cluster       8
mft_lcn                   8448
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 103 MB / 99 MiB
NTFS at 425/16/10
heads/cylinder 255 (NTFS) != 27 (HD)
sect/track 63 (NTFS) != 18 (HD)
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              4   5 15   425  16 10     204800 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 425/16/11
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
filesystem size           976562176
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]
     NTFS, blocksize=4096, 499 GB / 465 GiB
BAD_RS LBA=1631805114 311849
file_pread(4,3,buffer,1631805114(3357623/18/13)) lseek err Invalid argument
file_pread(4,1,buffer,1631805114(3357623/18/13)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            3357623  18 13 4208019  23  6  413292540
This partition ends after the disk limits. (start=1631805114, size=413292540, end=2045097653, disk end=976773168)
BAD_RS LBA=187838263 128957
check_part_i386 failed for partition type 01
     FAT12                386498  13  2 3355216   7  3 1442796842
This partition ends after the disk limits. (start=187838263, size=1442796842, end=1630635104, disk end=976773168)
BAD_RS LBA=1030749156 334553
file_pread(4,3,buffer,1030749156(2120883/1/1)) lseek err Invalid argument
file_pread(4,1,buffer,1030749156(2120883/1/1)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA            2120883   1  1 6399266  19 18 2079294480
This partition ends after the disk limits. (start=1030749156, size=2079294480, end=3110043635, disk end=976773168)
BAD_RS LBA=452254114 125984
check_part_i386 failed for partition type 01
     FAT12                930564   0 11 3864850  20 14 1426063360
This partition ends after the disk limits. (start=452254114, size=1426063360, end=1878317473, disk end=976773168)
BAD_RS LBA=522825260 4621
check_part_i386 failed for partition type 01
     FAT12                1075772   3 15 4011141  10 18 1426589464
This partition ends after the disk limits. (start=522825260, size=1426589464, end=1949414723, disk end=976773168)
BAD_RS LBA=1255888177 16072
file_pread(4,3,buffer,1255888177(2584132/1/8)) lseek err Invalid argument
file_pread(4,1,buffer,1255888177(2584132/1/8)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                2584132   1  8 11421378  12 13 4294901760
This partition ends after the disk limits. (start=1255888177, size=4294901760, end=1255822640, disk end=976773168)
NTFS at 2009812/21/14
heads/cylinder 224 (NTFS) != 27 (HD)
sect/track 19 (NTFS) != 18 (HD)
filesystem size           976562176
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]
     NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
NTFS at 2009817/0/10
heads/cylinder 255 (NTFS) != 27 (HD)
sect/track 63 (NTFS) != 18 (HD)
filesystem size           976564224
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            425  16 11 2009817   0 10  976564224 [DANGER FILE LOSS IF DRIVE USED]
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
file_pread(4,2,buffer,976773596(2009822/5/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773596(2009822/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976773614(2009822/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773614(2009822/6/15)) lseek err Invalid argument
file_pread(4,2,buffer,976773632(2009822/7/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773632(2009822/7/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774082(2009823/5/15)) lseek err Invalid argument
file_pread(4,1,buffer,976774082(2009823/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774100(2009823/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976774100(2009823/6/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774567(2009824/5/14)) lseek err Invalid argument
file_pread(4,1,buffer,976774567(2009824/5/14)) lseek err Invalid argument
file_pread(4,2,buffer,976774568(2009824/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976774586(2009824/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976774586(2009824/6/15)) lseek err Invalid argument
file_pread(4,2,buffer,976775053(2009825/5/14)) lseek err Invalid argument
file_pread(4,1,buffer,976775053(2009825/5/14)) lseek err Invalid argument
file_pread(4,2,buffer,976775054(2009825/5/15)) lseek err Invalid argument
file_pread(4,1,buffer,976775054(2009825/5/15)) lseek err Invalid argument
file_pread(4,2,buffer,976775072(2009825/6/15)) lseek err Invalid argument
file_pread(4,1,buffer,976775072(2009825/6/15)) lseek err Invalid argument
file_pread(4,3,buffer,976773183(2009821/9/16)) lseek err Invalid argument
file_pread(4,1,buffer,976773183(2009821/9/16)) lseek err Invalid argument
file_pread(4,8,buffer,976773199(2009821/10/14)) lseek err Invalid argument
file_pread(4,11,buffer,976773246(2009821/13/7)) lseek err Invalid argument
file_pread(4,2,buffer,976775168(2009825/12/3)) lseek err Invalid argument
file_pread(4,2,buffer,976773270(2009821/14/13)) lseek err Invalid argument
file_pread(4,2,buffer,976773288(2009821/15/13)) lseek err Invalid argument
file_pread(4,2,buffer,976773306(2009821/16/13)) lseek err Invalid argument
file_pread(4,8,buffer,976773376(2009821/20/11)) lseek err Invalid argument
file_pread(4,1,buffer,976773491(2009821/26/18)) lseek err Invalid argument
file_pread(4,1,buffer,976773492(2009822/0/1)) lseek err Invalid argument
NTFS at 425/16/10
heads/cylinder 255 (NTFS) != 27 (HD)
sect/track 63 (NTFS) != 18 (HD)
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Disk /dev/sda - 500 GB / 465 GiB - CHS 2009821 27 18
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 2842 GB / 2646 GiB)
The following partitions can't be recovered:
     FAT12                386498  13  2 3355216   7  3 1442796842
     FAT12                930564   0 11 3864850  20 14 1426063360
     FAT12                1075772   3 15 4011141  10 18 1426589464
     FAT32 LBA            2120883   1  1 6399266  19 18 2079294480
     FAT12                2584132   1  8 11421378  12 13 4294901760
     FAT16 LBA            3357623  18 13 4208019  23  6  413292540
Warning: the current number of heads per cylinder is 27 but the correct value may be 255.

Results
     HPFS - NTFS              4   5 15   421  10 14     202752 [System Reserved]
     NTFS, blocksize=4096, 103 MB / 99 MiB
     HPFS - NTFS              4   5 15   425  16 10     204800 [System Reserved]
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS            425  16 10   847   0  5     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS            425  16 11 2009812  21 14  976562176 [DANGER FILE LOSS IF DRIVE USED]
     NTFS, blocksize=4096, 499 GB / 465 GiB
     HPFS - NTFS            425  16 11 2009817   0 10  976564224 [DANGER FILE LOSS IF DRIVE USED]
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Top
Locked

Return to “Partition Recovery”