Big partition became small partition and unallocated space.

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
jimbo
Posts: 3
Joined: 11 Apr 2012, 19:12

Big partition became small partition and unallocated space.

#1 Post by jimbo »

Hi Everybody,

First, thank you for a great tool! I didn't knew it before and I won't forget it, because it looks really helpfull.
So why I'm here? Like my topic title is my problem really confusing and strange. I wasn't sure if it fits under partition recovery or filesystem repair, because it's a little bit of both. I would like to ask for some advice.
But let's start at the beginning.

My patient:
- Data Disk, 500GB Western Digital, IDE (onboard controller).
- 1 Partition (465GB in Windows Explorer)
- NTFS
- Cluster Size 4KB (I think)
- Windows XP SP3

In short:
- I got some balloon notifications from windows xp, that it couldn't write data to the affected disk.
- I checked the windows event-log and saw controller-errors. One of the event log reccomended chkdsk.
- So I ran chkdsk /f. Chkdsk began fixing a lot of stuff, really a lot. I was getting nervous but didn't know if I break something when I cancel the process. So I let it finish.
- After it was done I checked the disk (didn't check it before chkdsk - my biggest mistake) and it shrinked from total size 465GB to 20GB. Shock!
- All the files and folders are still there, but 0KB.

What I think what happened:
- Because of the controller error (and not chkdsk I believe) the partition went from 465GB to 20GB.
- chkdsk f/ fixed the $MFT and removed all the links to the data which was not in the first 20GB and couldn't be found anymore. Result: 0KB files.

So how is it lookig now? (click for large screens)
Windows Disk Management (which says the 20GB are error free):
Image

TestDisk (after deep scan):
Image
and
Image

Advanced (I checked advanced before I made the deep scan - does this make a difference in the advanced result?):
Image

Boot:
Image

List:
Image

Rebuild BS:
Image

Repair MFT:
Image

Ontrack Easy Recovery shows in the disk overview
- F:\ NTFS (20GB)
- Unidentified (212.87 GB)
- Unidentified (232.89 GB)
which is also strange because it shows two unidentified.

MiniTool Partition Wizard Home:
- F:\ 20GB
- 445.76 Unallocated

What I already tried:
Different tools for raw data recovery. They find files, but the results don't really make sense because they don't have the original filenames and are not in the original folder anymore.

What I could try:
I could write the logical disk info which TestDisk found as second partition. But I don't believe there will be any data on this partition.
And try other tools for raw data recovery.

What I would like to do:
Modify the 20GB partition so it will be shown as 465GB partition again.
Try to fix the $MFT table again (chkdsk or TestDisk) so it relinks all the files.

So my question would be: Can I do one of the steps with TestDisk?

Thanks in advance for any advice or input.
Best regards,
Jimbo.
Top
User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:
Contact remy

Re: Big partition became small partition and unallocated spa

#2 Post by remy »

I can't see the result of your deepersearch above, may you please provide it ?
Top
jimbo
Posts: 3
Joined: 11 Apr 2012, 19:12

Re: Big partition became small partition and unallocated spa

#3 Post by jimbo »

Hi remy,
thanks for your reply and looking over it. I did the Quick Search and the Deeper Search again.
As far as I can tell, TestDisk just wants to make a new extended partition with the free space.

Start Quick Search:
Image

Result Quick Search:
Image

After selecting the green result & starting Deeper Search:
Image

Result Deeper Search:
Image

Going one menu back with Q:
Image

Extd Part:
Image
Top
User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:
Contact remy

Re: Big partition became small partition and unallocated spa

#4 Post by remy »

Won't be a pleasure to solve. Don't event kow if it's possible. Depend on whar chkdsk has really done.

YOu should have an NTFS in 2611/1/1, ending else just before th one detected (if yoy had 3 NTFS) or if was really shrinked then ending in 60800/254/63.

I suggest you try adding this partition and have a look on advanced menu to try recover the initial MFT position and see if you are able to access files...
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Big partition became small partition and unallocated spa

#5 Post by Fiona »

There is an unusual behavior after chkdsk in the disk management console.
Controller might be a possible cause, but it looks like that chkdsk did the rest.
The normal size of the partition is 465,76 GB.
On the upper area the drive size is listed as 20 GB and the green bar looks like an wrong extended partition?
Don't use chkdsk wihtout backup anymore.

Would it be possible to uplad the testdisk.log?
I'd like to check for another partition found during scans.
Top
jimbo
Posts: 3
Joined: 11 Apr 2012, 19:12

Re: Big partition became small partition and unallocated spa

#6 Post by jimbo »

Dear Fiona,

Yep, the top info in disk managemnet shows how the disk is now,
the bottom info how the disk used to be.

This is the log (just as info, the partiton now is drive letter I:):

Code: Select all


Thu Apr 19 08:26:51 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, March 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-03-25T21:26:26
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=21476173824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=228572273664
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=750153729024
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - SAMSUNG SP2514N, S/N:30534238314a5930343933313735202020202020, FW:VF100-33
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKB-00YSA0, FW:12.01C02
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Promise 1+0 JBOD, FW:1.10
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Promise 1+0 JBOD, FW:1.10
Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Promise 1+0 JBOD, FW:1.10

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - WDC WD5000AAKB-00YSA0
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
 1 * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
 2 E extended LBA          2611   0  1 30399 254 63  446430285

test_logical: 
Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
search_vista_part: 0

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size           41945652
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2621603
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
     NTFS, 21 GB / 20 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
     NTFS, 21 GB / 20 GiB

interface_write()
 1 * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size           41945652
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2621603
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
     NTFS, 21 GB / 20 GiB
NTFS at 2610/254/63
filesystem size           41945652
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2621603
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
     NTFS found using backup sector!, 21 GB / 20 GiB
NTFS at 60800/254/63
filesystem size           41945652
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               601
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          58190   1  1 60800 254 63   41945652
     NTFS found using backup sector!, 21 GB / 20 GiB
file_pread(5,8,buffer,976773261(60801/82/31)) lseek err Invalid argument
file_pread(5,1,buffer,976773261(60801/82/31)) lseek err Invalid argument
file_pread(5,8,buffer,976773389(60801/84/33)) lseek err Invalid argument
file_pread(5,8,buffer,976773517(60801/86/35)) lseek err Invalid argument
file_pread(5,8,buffer,976773645(60801/88/37)) lseek err Invalid argument
file_pread(5,8,buffer,976773773(60801/90/39)) lseek err Invalid argument
file_pread(5,8,buffer,976773901(60801/92/41)) lseek err Invalid argument
file_pread(5,8,buffer,976774029(60801/94/43)) lseek err Invalid argument
file_pread(5,8,buffer,976774157(60801/96/45)) lseek err Invalid argument
file_pread(5,8,buffer,976774285(60801/98/47)) lseek err Invalid argument
file_pread(5,8,buffer,976774413(60801/100/49)) lseek err Invalid argument
file_pread(5,8,buffer,976774541(60801/102/51)) lseek err Invalid argument
file_pread(5,8,buffer,976774669(60801/104/53)) lseek err Invalid argument
file_pread(5,8,buffer,976774797(60801/106/55)) lseek err Invalid argument
file_pread(5,8,buffer,976774925(60801/108/57)) lseek err Invalid argument
file_pread(5,8,buffer,976775053(60801/110/59)) lseek err Invalid argument
file_pread(5,8,buffer,976775181(60801/112/61)) lseek err Invalid argument
file_pread(5,8,buffer,976775309(60801/114/63)) lseek err Invalid argument
file_pread(5,8,buffer,976775437(60801/117/2)) lseek err Invalid argument
file_pread(5,8,buffer,976775565(60801/119/4)) lseek err Invalid argument
file_pread(5,8,buffer,976775693(60801/121/6)) lseek err Invalid argument
file_pread(5,8,buffer,976775821(60801/123/8)) lseek err Invalid argument
file_pread(5,8,buffer,976775949(60801/125/10)) lseek err Invalid argument
file_pread(5,8,buffer,976776077(60801/127/12)) lseek err Invalid argument
file_pread(5,8,buffer,976776205(60801/129/14)) lseek err Invalid argument
file_pread(5,8,buffer,976776333(60801/131/16)) lseek err Invalid argument
file_pread(5,8,buffer,976776461(60801/133/18)) lseek err Invalid argument
file_pread(5,2,buffer,976783377(60801/243/4)) lseek err Invalid argument
file_pread(5,2,buffer,976783440(60801/244/4)) lseek err Invalid argument
file_pread(5,2,buffer,976783503(60801/245/4)) lseek err Invalid argument
file_pread(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,976784130(60802/0/1)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
     NTFS, 21 GB / 20 GiB
   L HPFS - NTFS          58190   1  1 60800 254 63   41945652
     NTFS found using backup sector!, 21 GB / 20 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
 2 E extended LBA         58190   0  1 60800 254 63   41945715
 5 L HPFS - NTFS          58190   1  1 60800 254 63   41945652
add_ext_part_i386: max

interface_write()
 1 * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
 2 E extended LBA          2611   0  1 60800 254 63  934822350
 5 L HPFS - NTFS          58190   1  1 60800 254 63   41945652
add_ext_part_i386: min

interface_write()
 1 * HPFS - NTFS              0   1  1  2610 254 63   41945652 [SOURCE]
 2 E extended LBA         58190   0  1 60800 254 63   41945715
 5 L HPFS - NTFS          58190   1  1 60800 254 63   41945652
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 58190/0/1,lba=934822350

TestDisk exited normally.
Thank you and best regards.
Top
Locked

Return to “Filesystem repair”