Install

Using PhotoRec to recover lost data
Message
Author
asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Install

#1 Post by asgjr » 17 Jun 2014, 17:33

I'm running Windows 8.1. I awoke this morning to find my PC in a perpetual cycle of "preparing automatic repair" then "diagnosing your pc". I was able to reboot and use F12 to get into the BIOS or screen with various options including refresh or reset. I have some data on my c:\ drive I want so do not want to simply reformat everything. I was able to get to the command line and tried to run chkdsk but it said my c:\ drive was corrupt. In the command line it shows me on the x:\ drive. I was able to access a USB thumb drive on d:\. I tried to use this software but it said the version I was trying was not compatible. I tried the last two DOS versions. I also tried windows but I cannot get to windows so that did not work. I tried to see if I could make my USB drive bootable and perhaps that was causing the capability issue with PhotoRec. So any suggestions on what I can do so I can see my files on my c:\ drive? Seems this software will work, but how do I get it to run on my machine? Just says this software is not compatible with the version of windows I'm running.

Thanks for your help!

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Install

#2 Post by Fiona » 17 Jun 2014, 17:59

Would it be possible to have another try using Knoppix?
http://www.knopper.net/knoppix/knoppix720-en.html
http://www.pendrivelinux.com/install-kn ... n-windows/
It's an old descritption, please use the newest version of Knoppix.
Also info:
http://www.cgsecurity.org/wiki/Damaged_ ... nux_LiveCD

Fiona

asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Re: Install

#3 Post by asgjr » 18 Jun 2014, 11:58

Yes this worked. Thank you for the fast and excellent reply. Now I'm using PhotoRec to try and locate any salvagable files on my corrupted partitions. I see in the options that I can look for just certain types of files. I'm simply looking for .xls and .ppt (excel and powerpoint files), but don't see these file types listed. Are they called something else by PhotoRec?

asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Re: Install

#4 Post by asgjr » 18 Jun 2014, 12:03

Sorry just found it listed as Microsoft Office Document.

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Install

#5 Post by Fiona » 18 Jun 2014, 13:58

Yes, should be doc.
If you use Office 2007, use zip file instead.
Some file types are packed into file type families.

Fiona

asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Re: Install

#6 Post by asgjr » 18 Jun 2014, 15:08

If I knew what I was doing in Test Disk should I be able to use it to make my hard drive bootable again so I can pull my files off?

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Install

#7 Post by Fiona » 18 Jun 2014, 16:24

If you have a problem with your partition and not your file system, it could be possible?
At least you can make a diagnose.
Run in TestDisk Analyse, Quick and if your partition is not found Deeper Search.
If a partition is found, you can mark it and press p, to have a try to list your files.
Actually, there not as much to do.
Mostly to confirm in testdisk with enter.
TestDisk creates a file called testdisk.log.
You can open it, using a wordprocessor like wordpad and copy and paste the content.
So I'll get most info to judge your situation.

Fiona

asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Re: Install

#8 Post by asgjr » 18 Jun 2014, 16:39

Thank you for your help. I was also looking at trying to install gpart as I have gparted and when I ask it to assist with file recovery it says I need to install gpart. I was getting errors though when said to "make" even though I have it in the right director. Seems gpart can try and help with the primary partitiion table so I can boot up.

Here is my recent test disk log.





Wed Jun 18 07:29:11 2014
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.9.6 (#25 SMP PREEMPT Sat Jun 15 15:27:01 CEST 2013) i686
Compiler: GCC 4.7
Compilation date: 2012-12-16T16:55:56
ext2fs lib: 1.41.12, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.4, ewf lib: 20100226
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1465149168 sectors
/dev/sda: user_max 1465149168 sectors
/dev/sda: native_max 1465149168 sectors
/dev/sda: dco 1465149168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - TOSHIBA MQ01ABD075, S/N:63KOP9GET, FW:AX0A4M
Disk /dev/sdc - 8039 MB / 7666 MiB - CHS 977 255 63, sector size=512 - Best Buy Geek Squad, FW:8.01
Disk /dev/sde - 3941 MB / 3758 MiB - CHS 1017 122 62, sector size=512 - ADATA USB Flash Drive, FW:0.00

Partition table type (auto): EFI GPT
Disk /dev/sda - 750 GB / 698 GiB - TOSHIBA MQ01ABD075
Partition table type: EFI GPT

Analyse Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1465149167 (expected 1465149167)
hdr_lba_start=34
hdr_lba_end=1465149134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P Unknown 2048 2099199 2097152 [Basic data partition]
2 P EFI System 2099200 2631679 532480 [Basic data partition]
3 P MS Reserved 2631680 2893823 262144 [Basic data partition]
4 P MS Data 2893824 1442260991 1439367168 [Basic data partition]
5 P Unknown 1442260992 1443182591 921600
6 P Unknown 1443182592 1465147391 21964800 [Basic data partition]

search_part()
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/32/33
filesystem size 2097152
sectors_per_cluster 8
mft_lcn 87381
mftmirr_lcn 131071
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 2099199 2097152 [System]
NTFS, blocksize=4096, 1073 MB / 1024 MiB
FAT32 at 130/170/41
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 58104 root cluster : 6241
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513
set_FAT_info: name from BS used

FAT32 at 130/170/41
MS Data 2099200 2631679 532480 [NO NAME]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 163/207/45
filesystem size 262144
sectors_per_cluster 8
mft_lcn 10922
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2631680 2893823 262144
NTFS, blocksize=4096, 134 MB / 128 MiB
NTFS at 180/33/46
filesystem size 1439367168
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 10485759
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2893824 1442260991 1439367168
NTFS, blocksize=4096, 736 GB / 686 GiB
NTFS at 89776/151/40
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1442260992 1443182591 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 89833/245/13
filesystem size 21964800
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1443182592 1465147391 21964800 [Recovery]
NTFS, blocksize=4096, 11 GB / 10 GiB

Results
P MS Data 2048 2099199 2097152 [System]
NTFS, blocksize=4096, 1073 MB / 1024 MiB
P MS Data 2099200 2631679 532480 [NO NAME]
FAT32, blocksize=4096, 272 MB / 260 MiB
P MS Data 2631680 2893823 262144
NTFS, blocksize=4096, 134 MB / 128 MiB
P MS Data 2893824 1442260991 1439367168
NTFS, blocksize=4096, 736 GB / 686 GiB
P MS Data 1442260992 1443182591 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
P MS Data 1443182592 1465147391 21964800 [Recovery]
NTFS, blocksize=4096, 11 GB / 10 GiB
ntfs_device_testdisk_io_ioctl() unimplemented


dir_partition inode=5
P MS Data 2048 2099199 2097152 [System]
NTFS, blocksize=4096, 1073 MB / 1024 MiB
Directory /
5 dr-xr-xr-x 0 0 0 25-Sep-2013 23:44 .
5 dr-xr-xr-x 0 0 0 25-Sep-2013 23:44 ..
35 dr-xr-xr-x 0 0 0 10-Jul-2013 08:28 Bin
59 dr-xr-xr-x 0 0 0 10-Jul-2013 08:28 boot
179 dr-xr-xr-x 0 0 0 26-Sep-2013 00:43 Recovery
192 -r--r--r-- 0 0 0 17-Jun-2014 19:13 Recovery.txt
86 dr-xr-xr-x 0 0 0 10-Jul-2013 08:29 RicaTools
85 dr-xr-xr-x 0 0 0 12-Apr-2014 07:11 System Volume Information
172 dr-xr-xr-x 0 0 0 10-Jul-2013 08:29 TFR
173 -r--r--r-- 0 0 88 26-Sep-2013 01:26 WinRePartition.ini


dir_partition inode=0
P MS Data 2099200 2631679 532480 [NO NAME]
FAT32, blocksize=4096, 272 MB / 260 MiB
FAT: cluster=6241(0x1861), pos=2157304
Directory /
X 3 drwxr-xr-x 0 0 4096 16-May-2013 17:06 _FI
X 6240 drwxr-xr-x 0 0 4096 10-Jul-2013 05:45 _FI
2 drwxr-xr-x 0 0 0 25-Sep-2013 20:43 EFI
13723 -r-xr-xr-x 0 0 512 18-Mar-2014 10:28 BOOTSECT.BAK
ntfs_device_testdisk_io_ioctl() unimplemented


dir_partition inode=5
ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65534: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xffffffff size: 1024 usa_ofs: 65535 usa_count: 65534: Invalid argument
Record 0 has no FILE magic (0xffffffff)
Failed to load $MFT: Input/output error
P MS Data 2631680 2893823 262144
NTFS, blocksize=4096, 134 MB / 128 MiB
Directory /
5 dr-xr-xr-x 0 0 0 10-Jul-2013 08:28 .
5 dr-xr-xr-x 0 0 0 10-Jul-2013 08:28 ..
36 dr-xr-xr-x 0 0 0 11-Mar-2014 15:12 System Volume Information
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

P MS Data 2893824 1442260991 1439367168
NTFS, blocksize=4096, 736 GB / 686 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_device_testdisk_io_ioctl() unimplemented


dir_partition inode=5
P MS Data 1442260992 1443182591 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
Directory /
5 dr-xr-xr-x 0 0 0 17-Jun-2014 00:30 .
5 dr-xr-xr-x 0 0 0 17-Jun-2014 00:30 ..
35 dr-xr-xr-x 0 0 0 17-Jun-2014 00:30 Recovery
45 -r--r--r-- 0 0 0 17-Jun-2014 20:58 Recovery.txt
40 dr-xr-xr-x 0 0 0 12-Apr-2014 07:11 System Volume Information
ntfs_device_testdisk_io_ioctl() unimplemented


dir_partition inode=5
P MS Data 1443182592 1465147391 21964800 [Recovery]
NTFS, blocksize=4096, 11 GB / 10 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Mar-2014 14:05 .
5 dr-xr-xr-x 0 0 0 11-Mar-2014 14:05 ..
35 dr-xr-xr-x 0 0 0 26-Sep-2013 02:10 Recovery
193 dr-xr-xr-x 0 0 0 12-Apr-2014 07:11 System Volume Information

interface_write()
1 P MS Data 2048 2099199 2097152 [System]
2 P MS Data 2099200 2631679 532480 [NO NAME]
3 P MS Data 2631680 2893823 262144
4 P MS Data 2893824 1442260991 1439367168
5 P MS Data 1442260992 1443182591 921600
6 P MS Data 1443182592 1465147391 21964800 [Recovery]
simulate write!

TestDisk exited normally.

asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Re: Install

#9 Post by asgjr » 18 Jun 2014, 16:48

Here is the error I'm getting when trying to run make for gpart. Perhaps I don't even need gpart if I have TestDisk?

root@Microknoppix:/home/knoppix/Desktop/gpart# make
make -C src
make[1]: Entering directory `/home/knoppix/Desktop/gpart/src'
gcc -Wall -O2 -pedantic -DVERSION=\"0.1f\" -c -o disku.o disku.c
disku.c: In function ‘disk_geometry’:
disku.c:48:50: error: ‘errno’ undeclared (first use in this function)
disku.c:48:50: note: each undeclared identifier is reported only once for each function it appears in
disku.c: In function ‘reread_partition_table’:
disku.c:78:53: error: ‘errno’ undeclared (first use in this function)
make[1]: *** [disku.o] Error 1
make[1]: Leaving directory `/home/knoppix/Desktop/gpart/src'
make: *** [gpart] Error 2

asgjr
Posts: 8
Joined: 17 Jun 2014, 17:14

Re: Install

#10 Post by asgjr » 18 Jun 2014, 16:57

Attaching a gparted screenshot to help
Attachments
screenshot.png
screenshot.png (65.35 KiB) Viewed 1980 times

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest