How do I extend the partition to its orginal state Topic is solved

How to use TestDisk to recover lost partition
Message
Author
perh
Posts: 5
Joined: 27 Apr 2012, 11:19

How do I extend the partition to its orginal state

#1 Postby perh » 27 Apr 2012, 11:58

I have lost a logical partition. When I searched using TestDisk, there was a space conflict between the two partitions on the disc. I tried to fix it by using the partition backup, but I think there was something wrong with the partition backup. This is probably where I made a mistake.
Now the second partition starts at wrong place, it should start at 3830. Is there some way I can correct this? Any help appreciated!

TestDisk.PNG
TestDisk.PNG (44.56 KiB) Viewed 1873 times

Sponsored links

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: How do I extend the partition to its orginal state

#2 Postby Fiona » 27 Apr 2012, 12:51

I tried to fix it by using the partition backup, but I think there was something wrong with the partition backup. This is probably where I made a mistake.

Some more explanation would be appreciated. :)
What backup did you use and how did you try to fix it?
Did you write to your disk?

Would it be possible to repeat Deeper Search, even if you receive a message about your space conflict.
Please upload a screenshot of the result.

Fiona

perh
Posts: 5
Joined: 27 Apr 2012, 11:19

Re: How do I extend the partition to its orginal state

#3 Postby perh » 27 Apr 2012, 13:41

Sorry for the double post by the way, did not realize new threads were moderated.

This was the original situation reported after a search:

Code: Select all

Space conflict between the following two partitions
 1 * HPFS - NTFS              0   1  1  3829 254 63   61528887 [Dokument]
 2 E extended LBA          1280 150  7 38912 254 63  604564689


I did a Deeper search:

Code: Select all

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
NTFS at 0/1/1
filesystem size           61528881
sectors_per_cluster       8
mft_lcn                   74296
mftmirr_lcn               481
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  3829 254 57   61528881 [Dokument]
     NTFS, 31 GB / 29 GiB
NTFS at 38912/254/63
filesystem size           420180012
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               524288
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          12758   1  1 38912 254 63  420180012
     NTFS found using backup sector!, 215 GB / 200 GiB
file_pread(4,8,buffer,625140373(38913/48/5)) lseek err Invalid argument
file_pread(4,1,buffer,625140373(38913/48/5)) lseek err Invalid argument
file_pread(4,8,buffer,625140501(38913/50/7)) lseek err Invalid argument
file_pread(4,8,buffer,625140629(38913/52/9)) lseek err Invalid argument
file_pread(4,8,buffer,625140757(38913/54/11)) lseek err Invalid argument
file_pread(4,8,buffer,625140885(38913/56/13)) lseek err Invalid argument
file_pread(4,8,buffer,625141013(38913/58/15)) lseek err Invalid argument
file_pread(4,8,buffer,625141141(38913/60/17)) lseek err Invalid argument
file_pread(4,2,buffer,625141173(38913/60/49)) lseek err Invalid argument
file_pread(4,2,buffer,625141236(38913/61/49)) lseek err Invalid argument
file_pread(4,8,buffer,625141269(38913/62/19)) lseek err Invalid argument
file_pread(4,2,buffer,625141299(38913/62/49)) lseek err Invalid argument
file_pread(4,8,buffer,625141397(38913/64/21)) lseek err Invalid argument
file_pread(4,8,buffer,625141525(38913/66/23)) lseek err Invalid argument
file_pread(4,8,buffer,625141653(38913/68/25)) lseek err Invalid argument
file_pread(4,1,buffer,625141759(38913/70/5)) lseek err Invalid argument
file_pread(4,1,buffer,625141760(38913/70/6)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
   * HPFS - NTFS              0   1  1  3829 254 63   61528887 [Dokument]
     NTFS, 31 GB / 29 GiB
   L HPFS - NTFS          12758   1  1 38912 254 63  420180012
     NTFS found using backup sector!, 215 GB / 200 GiB

interface_write()
 1 * HPFS - NTFS              0   1  1  3829 254 63   61528887 [Dokument]
 2 E extended LBA         12758   0  1 38912 254 63  420180075
 5 L HPFS - NTFS          12758   1  1 38912 254 63  420180012
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 12758/0/1,lba=204957270

ntfs_boot_sector
 5 L HPFS - NTFS          12758   1  1 38912 254 63  420180012
     NTFS found using backup sector!, 215 GB / 200 GiB
NTFS at 12758/1/1
filesystem size           1 420180012
sectors_per_cluster       0 8
mft_lcn                   0 4
mftmirr_lcn               0 524288
clusters_per_mft_record   0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad

Backup boot sector
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector

ntfs_boot_sector
 5 L HPFS - NTFS          12758   1  1 38912 254 63  420180012
     NTFS found using backup sector!, 215 GB / 200 GiB
NTFS at 12758/1/1
NTFS at 12758/1/1
filesystem size           420180012
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               524288
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.

TestDisk exited normally.


I did not pay attention enough to the results so I did not notice at first that the start of the second (missing) partition ended up in the wrong place.
I think there was a problem with the backup partition table. Actually I hade another configuration on the drive a while ago with three partitions. When is the backup partition table written to?

I have tried Deeper Search a couple of times again, I get the result in the screenshot of the first post each time.

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: How do I extend the partition to its orginal state

#4 Postby Fiona » 27 Apr 2012, 19:17

It would be a possibility to add a partition manually, assuming that you used the whole space as a second partition and have a boot sector diagnose.
But it would only make sense, if you didn't overwrite any data from your previous second partition.
Did you overwrite a part of your second partition?

Fiona

perh
Posts: 5
Joined: 27 Apr 2012, 11:19

Re: How do I extend the partition to its orginal state

#5 Postby perh » 28 Apr 2012, 09:53

Fiona>>
Now I have recovered every single file, actually using a commercial recovery software... =(
Since the drive just failed between one boot of the computer and another I had not written anything to it.
I could probably have defined the partition manually but that felt risky.

The difference between TestDisk and some other softwares I tried was that the other softwares could see several different partitions (they were obviously in conflict with each other).
TestDisk only displayed the partition that was 200 Gb (I think that was an old partition that used to be on the physical drive a year ago)
With other software I saw that partition but also others, one that was 269 Gb which was actually the partition that disappeared.
When I selected the 269 Gb partition I found all my data intact.

Maybe something for the developers to look into for coming versions of TestDisk?

Thank you for your help in this thread!

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: How do I extend the partition to its orginal state  Topic is solved

#6 Postby Fiona » 28 Apr 2012, 18:26

TestDisk finds also partition where overlap.
I assume, in your case the disk geometry which found your partition was different.
In case it might be possible that TestDisk could probably find it using partition table type None.
But it would only provide the values about your disk geometry and you woudn't be able to write a partition because partition table type None was chosen.
Also, TestDisk only finds a partition, if a bootsector, its backup or a superblock is available.
For example if a partition is out of the partiton table and and boot sector and its backup are not found either, TestDisk wouldn't find that partition.
In case, creating an unformatted partition equal to the previous one and rebuild the boot sector helped.
But this is only possible if you know exactly the partition type, start and size.

Fiona

perh
Posts: 5
Joined: 27 Apr 2012, 11:19

Re: How do I extend the partition to its orginal state

#7 Postby perh » 28 Apr 2012, 22:36

Thank you, now I get it! I do not think I understood the entire possibilities of the program at first but now I have learned better how to use it.

I tested to use partition type "None"
I was indeed able to both find the partition (see the starting point) and copy files from it.
I could go back and add the partition manually and write the partition table.
Only a quick reboot and then the entire drive was back without anything missing!


Return to “Partition Recovery”

Who is online

Users browsing this forum: No registered users and 0 guests