HELP! HELP! HELP! HELP! Revert changes from Testdisk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Messyhardrive
Posts: 2
Joined: 21 Apr 2014, 21:07

HELP! HELP! HELP! HELP! Revert changes from Testdisk

#1 Post by Messyhardrive »

I am not sure what I was doing... I have a hard drive that has Linux system. I am not a computer geek. I will try to explain the best I can. I have a hard drive that was used on a dns server but suddenly the router failed and caused the dns to loose the connection. To be honest I had no clue what I was doing. The dns was working with new router but was not able to read the hard drive. It just failed. I called the manufacturer of the router. They told me that it was a bad hard drive. Later, I connected this hard drive directly to my computer with usb connection that i found online.Then I searched online and I found this program. I decided to give it a try. I wrote a new the partition table. Again, not sure what i was doing. I messed the drive even more. I deleted the logs. How can i recover this now? Is there any way to revert the tables.

Help will be greatly appreciated!!
User avatar
cgrenier
Site Admin
Posts: 5438
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: HELP! HELP! HELP! HELP! Revert changes from Testdisk

#2 Post by cgrenier »

To revert the change, there are several ways:
- use the backup of the list of the partitions (TestDisk, Analyse, Backup to create the backup; TestDisk, Analyse, Quick Search, Load to load the information), it's not an option for you, it's too late
- use the testdisk.log file and manually add each partition: TestDisk, Analyse, Quick Search, 'a' to add each partition.
- run TestDisk, Analyse, Quick Search, if some partitions are not listed, Deeper Search, switch between P(rimary), L(ogical) and D(eleted), write the new partition table.
In your case, it may be a good idea to ask the manufacturer or another user of the same router model the correct partition table.
Messyhardrive
Posts: 2
Joined: 21 Apr 2014, 21:07

Re: HELP! HELP! HELP! HELP! Revert changes from Testdisk

#3 Post by Messyhardrive »

Great thank you I will try that and let you know
olivechicago
Posts: 1
Joined: 20 May 2018, 18:16

Re: HELP! HELP! HELP! HELP! Revert changes from Testdisk

#4 Post by olivechicago »

cgrenier wrote: 23 Apr 2014, 07:48 To revert the change, there are several ways:
- use the backup of the list of the partitions (TestDisk, Analyse, Backup to create the backup; TestDisk, Analyse, Quick Search, Load to load the information), it's not an option for you, it's too late
- use the testdisk.log file and manually add each partition: TestDisk, Analyse, Quick Search, 'a' to add each partition.
- run TestDisk, Analyse, Quick Search, if some partitions are not listed, Deeper Search, switch between P(rimary), L(ogical) and D(eleted), write the new partition table.
In your case, it may be a good idea to ask the manufacturer or another user of the same router model the correct partition table.
I've done a similar thing. How do I read the logs to manually set up the partitions? Drive 14 went from two partitions to ten.



Sun May 20 10:45:03 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdh)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdi)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdj)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdk)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdl)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdm)=1278021206016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdn)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdo)=429496729600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdp)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive8)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive9)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive10)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive11)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive12)=1278021206016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive13)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive14)=429496729600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive15)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479629148160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2649859534848
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1277884891136
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=123345022976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=3000556847104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=4000750501888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=429361442816
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1000168488960
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sde - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdf - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdg - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdh - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdj - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdk - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdl - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdm - 1278 GB / 1190 GiB - CHS 155377 255 63, sector size=512
Disk /dev/sdn - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512
Disk /dev/sdo - 429 GB / 400 GiB - CHS 6527 255 63, sector size=4096
Disk /dev/sdp - 5000 GB / 4657 GiB - CHS 608001 255 63, sector size=512
Disk \\.\PhysicalDrive14 - 429 GB / 400 GiB - CHS 6527 255 63, sector size=4096
Drive C: - 479 GB / 446 GiB - CHS 58311 255 63, sector size=512
Drive D: - 2649 GB / 2467 GiB - CHS 40270 255 63, sector size=4096
Drive G: - 1277 GB / 1190 GiB - CHS 155360 255 63, sector size=512
Drive S: - 123 GB / 114 GiB - CHS 1874 255 63, sector size=4096
Drive T: - 3000 GB / 2794 GiB - CHS 364796 255 63, sector size=512
Drive U: - 4000 GB / 3725 GiB - CHS 486396 255 63, sector size=512
Drive V: - 429 GB / 399 GiB - CHS 6525 255 63, sector size=4096
Drive W: - 1000 GB / 931 GiB - CHS 121596 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive14 - 429 GB / 400 GiB
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive14 - 429 GB / 400 GiB - CHS 6527 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=104857599 (expected 104857599)
hdr_lba_start=6
hdr_lba_end=104857594
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 256 33023 32768
check_part_gpt failed for partition
2 P MS Data 33024 104857594 104824571
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 256 33023 32768
1 P MS Reserved 256 33023 32768
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 33024 104857594 104824571
2 P MS Data 33024 104857594 104824571

search_part()
Disk \\.\PhysicalDrive14 - 429 GB / 400 GiB - CHS 6527 255 63
NTFS at 41/220/27
sect/track 56 (NTFS) != 63 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 16750384
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 1046898
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 672551 2766348 2093798
NTFS, blocksize=4096, 8576 MB / 8178 MiB
Linux Swap 2804923 2804924 2
SWAP2 version 0, pagesize=8192, 8192 B

block_group_nr 343

recover_EXT2: part_offset problem

block_group_nr 343

recover_EXT2: part_offset problem
NTFS at 250/30/46
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 125825024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 4018185 19746312 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
NTFS at 1236/108/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 19863194 19863965 771
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1237/145/8
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 19881547 19882318 771
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1243/89/27
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 125825024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 19974428 35702555 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
NTFS at 2259/151/15
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 125825024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 36300362 52028489 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
NTFS at 3456/80/22
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 55525701 55526472 771 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 3476/114/55
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 125825024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 55849176 71577303 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
NTFS at 4651/180/55
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 41963520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 74729709 79975148 5245440
NTFS, blocksize=4096, 21 GB / 20 GiB
file_win32_pread(620,2,buffer,104857599(6527/21/22)) read err: read after end of file
file_win32_pread(620,2,buffer,104857599(6527/21/22)) read err: read after end of file

Results
P MS Data 672551 2766348 2093798
NTFS, blocksize=4096, 8576 MB / 8178 MiB
P Linux Swap 2804923 2804924 2
SWAP2 version 0, pagesize=8192, 8192 B
P MS Data 4018185 19746312 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
P MS Data 19863194 19863965 772
NTFS, blocksize=512, 3162 KB / 3088 KiB
P MS Data 19881547 19882318 772
NTFS, blocksize=512, 3162 KB / 3088 KiB
P MS Data 19974428 35702555 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
P MS Data 36300362 52028489 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
P MS Data 55525701 55526472 772 [Boot]
NTFS, blocksize=512, 3162 KB / 3088 KiB
P MS Data 55849176 71577303 15728128
NTFS, blocksize=4096, 64 GB / 59 GiB
P MS Data 74729709 79975148 5245440
NTFS, blocksize=4096, 21 GB / 20 GiB

interface_write()
1 P MS Data 672551 2766348 2093798
2 P Linux Swap 2804923 2804924 2
3 P MS Data 4018185 19746312 15728128
4 P MS Data 19863194 19863965 772
5 P MS Data 19881547 19882318 772
6 P MS Data 19974428 35702555 15728128
7 P MS Data 36300362 52028489 15728128
8 P MS Data 55525701 55526472 772 [Boot]
9 P MS Data 55849176 71577303 15728128
10 P MS Data 74729709 79975148 5245440
write!
No extended partition
You will have to reboot for the change to take effect.
Partition table type default to EFI GPT
Disk /dev/sdp - 5000 GB / 4657 GiB
Partition table type: EFI GPT

Analyse Disk /dev/sdp - 5000 GB / 4657 GiB - CHS 608001 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdp - 5000 GB / 4657 GiB - CHS 608001 255 63
Search for partition aborted

Results
SIGHUP detected! TestDisk has been killed.
User avatar
cgrenier
Site Admin
Posts: 5438
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: HELP! HELP! HELP! HELP! Revert changes from Testdisk

#5 Post by cgrenier »

olivechicago, using testdisk, Analyse, quick search, use 'Stop', use 'a' to manually add

Code: Select all

P MS Reserved 256 33023 32768
P MS Data 33024 104857594 104824571
You will have to use the arrow keys to set the partition as P(rimary) and the other as D(eleted).
On next screen, choose Write, confirm, Quit.

Once it's done, the best move is probably to run TestDisk, Advanced, select the second partition, Boot, RebuildBS, List and if you can see your files, Write, confirm, Quit and restart.
Locked