Partition table missing Topic is solved

How to use TestDisk to recover lost partition
Locked
Message
Author
sideburns
Posts: 6
Joined: 22 Aug 2013, 23:44

Partition table missing

#1 Post by sideburns » 23 Aug 2013, 00:17

Sorry if I'm posting twice, but the first time I tried to post it didn't show up. I have an 8 GB flash drive with data on it that I took off of my Linux box before reinstalling. Now, all of a sudden, the drive won't mount on any computer. Trying gParted only told me that the drive consisted of nothing but unallocated space and the partition table couldn't be recovered. Testdisk also couldn't find a partition table. I told it that the drive didn't have a partition table but had been formatted as FAT32, as I'd not played with the formatting at any time. Now, I'm creating an image.dd of the contents (I hope.) but don't know what to do next. Any advice, suggestions or pointers to useful information will be greatly appreciated.

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Partition table missing

#2 Post by Fiona » 23 Aug 2013, 07:24

I've removed your crosspost.

Would it be possible to repeat your diagnose?
In your testdisk folder you'll find a file called testdisk.log.
Can you copy and past the content into your next post?

sideburns
Posts: 6
Joined: 22 Aug 2013, 23:44

Re: Partition table missing

#3 Post by sideburns » 23 Aug 2013, 07:32

Here's the log from the first time I ran it. I only thought of trying to copy the data off later:

Thu Aug 22 15:37:28 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.10.7-200.fc19.i686.PAE (#1 SMP Fri Aug 16 00:22:51 UTC 2013) i686
Compiler: GCC 4.8
Compilation date: 2013-03-01T11:07:56
ext2fs lib: 1.42.7, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20130128
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 234441648 sectors
/dev/sda: user_max 234441648 sectors
/dev/sda: native_max 234441648 sectors
/dev/sda: dco 234441648 sectors
/dev/sdb: LBA, HPA, DCO support
/dev/sdb: size 160086528 sectors
/dev/sdb: user_max 160086528 sectors
/dev/sdb: native_max 160086528 sectors
/dev/sdb: dco 160086528 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST3120827AS, S/N:3MS01V3C, FW:3.42
Disk /dev/sdb - 81 GB / 76 GiB - CHS 9964 255 63, sector size=512 - Maxtor 6Y080P0, S/N:Y2MKBXNE, FW:YAR41BW0
Disk /dev/sdc - 8006 MB / 7635 MiB - CHS 1021 247 62, sector size=512, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sdc - 8006 MB / 7635 MiB
Partition table type: Intel

Analyse Disk /dev/sdc - 8006 MB / 7635 MiB - CHS 1021 247 62
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/sdc - 8006 MB / 7635 MiB - CHS 1021 247 62

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdc - 8006 MB / 7635 MiB - CHS 1021 247 62

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced
New options :
Dump : No
Cylinder boundary : Yes
Allow partial last cylinder : No
Expert mode : No

TestDisk exited normally.


In case you're wondering, I told it the drive doesn't use Vista mode because I have no idea what that is, or if it's being used. (I stopped using Windows well before Vista came out, and I've forgotten most of what I used to know about Windows simply through lack of use.)

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Partition table missing

#4 Post by Fiona » 23 Aug 2013, 07:40

I told it the drive doesn't use Vista mode because I have no idea what that is,
Since Vista, Microsoft doesn't align partitions on cylinder boundary (Intel-MBR-Standard) but megabyte boundaries.
That's why it's better to leave vista mode enabled.
There would be a couple of tests to have a try to find your previous partition.
Would it be possible to run Deeper Search?
It's a try to find a backup of your bootsector.

Fiona

sideburns
Posts: 6
Joined: 22 Aug 2013, 23:44

Re: Partition table missing

#5 Post by sideburns » 23 Aug 2013, 08:06

OK, I re-ran the test with Vista mode enabled. No partition table, even after a Deeper scan:

Thu Aug 22 23:51:12 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.10.7-200.fc19.i686.PAE (#1 SMP Fri Aug 16 00:22:51 UTC 2013) i686
Compiler: GCC 4.8
Compilation date: 2013-03-01T11:07:56
ext2fs lib: 1.42.7, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20130128
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 234441648 sectors
/dev/sda: user_max 234441648 sectors
/dev/sda: native_max 234441648 sectors
/dev/sda: dco 234441648 sectors
/dev/sdb: LBA, HPA, DCO support
/dev/sdb: size 160086528 sectors
/dev/sdb: user_max 160086528 sectors
/dev/sdb: native_max 160086528 sectors
/dev/sdb: dco 160086528 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST3120827AS, S/N:3MS01V3C, FW:3.42
Disk /dev/sdb - 81 GB / 76 GiB - CHS 9964 255 63, sector size=512 - Maxtor 6Y080P0, S/N:Y2MKBXNE, FW:YAR41BW0
Disk /dev/sdc - 8006 MB / 7635 MiB - CHS 1021 247 62, sector size=512, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sdc - 8006 MB / 7635 MiB
Partition table type: Intel

Analyse Disk /dev/sdc - 8006 MB / 7635 MiB - CHS 1021 247 62
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

As I wrote, I do have everything stored in image.dd, and I presume there's a way to use it. If needed, I can rebuild the file system and restore, but I'll need instructions. (If it helps, I did tech support for almost eight years for an ISP, and was considered a Windows Internals geek. In the last five or six years, I've turned myself into something of a Linux internals geek; I'm not in the least bit uncomfortable working with a CLI.) One of the few nice things about this is that as long as I still have that image.dd, I can always go back and try, try again if I mess up.

sideburns
Posts: 6
Joined: 22 Aug 2013, 23:44

Re: Partition table missing

#6 Post by sideburns » 23 Aug 2013, 23:03

A little more information: I ran testdisk again on image.dd, told it that the media didn't have a partition table, and that the file system was FAT32. Now, it was able to find the data, but I've no idea what to do with it. At this point, I'm guessing that I'm eventually going to have to reformat the drive and copy things back, but there's no point in reformatting it until I've recovered the data from the image and have it ready to copy over.

And, if it helps, back when I did tech support for an ISP, we never tried to figure out what went wrong; we just wanted to get our customers up and running ASAP. I don't care how or why this happened, so if the only way to recover everything is to nuke the forensics let's get it over with.

(BTW, I later did tech support for a company who's mantra was, "You don't have enough information to fix the problem until you know everything about it." It wasn't until after I left that I realized that customers were being charged for my time on the phone, and this might have been a reason for the attitude.)

User avatar
cgrenier
Site Admin
Posts: 3619
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partition table missing

#7 Post by cgrenier » 25 Aug 2013, 12:53

If you are able to list your files, you can also copy them using TestDisk.

sideburns
Posts: 6
Joined: 22 Aug 2013, 23:44

Re: Partition table missing

#8 Post by sideburns » 25 Aug 2013, 23:16

I just tried that, copying everything to a different directory on the same partition. (Using the image.dd.) When I was finished, nothing was there. Weird. I'm going to try to do the same thing again, but this time I'm going to use the actual flash drive as the source because the documentation says that it's supposed to be a different drive/partition, and this will make sure that's true. Live and learn.

sideburns
Posts: 6
Joined: 22 Aug 2013, 23:44

Re: Partition table missing  Topic is solved

#9 Post by sideburns » 25 Aug 2013, 23:40

Second try. I started with the bad flash drive, found the file system and tried to copy it into the directory I wanted. However, I simply pointed at the directory instead of actually entering it (Like in "Paste into folder" from a file manager.) and got a mess of files until I managed to kill testdisk. Third try, I was careful to make sure I was inside the proper directory before starting the copy and everything copied over correctly. Now, I can reformat the drive and try, try again, knowing that if it's a bad drive, I've still got everything on my hard drive ready to go onto a replacement.

It might me a Good Idea to expand the documentation slightly to explain that just pointing testdisk at a directory isn't enough; you have to enter it, and that you can't copy files from image.dd to a different directory on the same drive. (Unless, of course, I did something wrong, which is quite possible; possibly my second try just overwrote my first, but I didn't think of that until just now.) In any event, thanx for all of your assistance.

Locked

Who is online

Users browsing this forum: No registered users and 1 guest