Page 1 of 1

WIndows 7 RAW partition Recovery

Posted: 15 Dec 2014, 17:42
by halogen
Have drive that the second partition is showing RAW and wants to be reformatted but would like to fix issue so data will remain intact. Here is the Testdisk 7 info from drive 5 which is now attached as a USB drive and the Second Partition is showing RAW on window 7. What are the next steps to repairing this issue?

Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, MinGW 3.11
Compilation date: Nov 13 2014 18:59:59
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592977920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301909504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=252120662016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1500299395072
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3000579915776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1572864000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=487066697728
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=1272023069184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=11467227136
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=2000397884928
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Disk \\.\PhysicalDrive3 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 252 GB / 234 GiB - CHS 30651 255 63, sector size=512
Drive D: - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Drive G: - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096
Drive H: - 1572 MB / 1500 MiB - CHS 191 255 63, sector size=512
Drive I: - 487 GB / 453 GiB - CHS 59215 255 63, sector size=512
Drive J: - 1272 GB / 1184 GiB - CHS 154647 255 63, sector size=512
Drive K: - 11 GB / 10 GiB - CHS 1394 255 63, sector size=512
Drive S: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 191/89/27
NTFS at 59407/43/29
Current partition structure:
1 P HPFS - NTFS 0 32 33 191 89 26 3072000
2 * HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928
Backup partition structure
partition_save

search_part()
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS, blocksize=4096, 1572 MB / 1500 MiB
NTFS at 191/89/27
filesystem size 951302144
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 191 89 27 59407 43 28 951302144
NTFS, blocksize=4096, 487 GB / 453 GiB
NTFS at 59407/43/29
filesystem size 22396928
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 59407 43 29 60801 80 15 22396928
NTFS, blocksize=4096, 11 GB / 10 GiB

Results
* HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS, blocksize=4096, 1572 MB / 1500 MiB
P HPFS - NTFS 191 89 27 59407 43 28 951302144
NTFS, blocksize=4096, 487 GB / 453 GiB
P HPFS - NTFS 59407 43 29 60801 80 15 22396928
NTFS, blocksize=4096, 11 GB / 10 GiB
interface_load
Drive H: - 487 GB / 453 GiB - CHS 59215 255 63 Mon Dec 15 01:06:50 2014
3 * Sys=2B 113201 29 24 147074 114 59 544175136
2 * Sys=73 119380 132 62 153270 41 37 544437093
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
4 * SpeedStor 177063 118 26 177066 225 63 54974
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63 Mon Dec 15 01:10:16 2014
1 * Windows RE(store) 0 32 33 191 89 26 3072000
2 P HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P hid. HPFS/NTFS 59407 43 29 60801 80 15 22396928
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63 Mon Dec 15 10:08:51 2014
1 P HPFS - NTFS 0 32 33 191 89 26 3072000
2 * HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928
check_part_i386 3 type 2B: no test
check_part_i386 2 type 73: no test
check_part_i386 1 type 4F: no test
check_part_i386 4 type 61: no test
Invalid partition structure.

Analyse Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 191/89/27
NTFS at 59407/43/29
Current partition structure:
1 P HPFS - NTFS 0 32 33 191 89 26 3072000
2 * HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928
Backup partition structure
partition_save

search_part()
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS, blocksize=4096, 1572 MB / 1500 MiB
NTFS at 191/89/27
filesystem size 951302144
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 191 89 27 59407 43 28 951302144
NTFS, blocksize=4096, 487 GB / 453 GiB
NTFS at 59407/43/29
filesystem size 22396928
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 59407 43 29 60801 80 15 22396928
NTFS, blocksize=4096, 11 GB / 10 GiB

Results
* HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS, blocksize=4096, 1572 MB / 1500 MiB
P HPFS - NTFS 191 89 27 59407 43 28 951302144
NTFS, blocksize=4096, 487 GB / 453 GiB
P HPFS - NTFS 59407 43 29 60801 80 15 22396928
NTFS, blocksize=4096, 11 GB / 10 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
2 P HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 191/89/27
NTFS at 59407/43/29
Current partition structure:
1 P HPFS - NTFS 0 32 33 191 89 26 3072000
2 * HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928

search_part()
Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 3072000
sectors_per_cluster 8
mft_lcn 128000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS, blocksize=4096, 1572 MB / 1500 MiB
NTFS at 191/89/27
filesystem size 951302144
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 191 89 27 59407 43 28 951302144
NTFS, blocksize=4096, 487 GB / 453 GiB
NTFS at 59407/43/29
filesystem size 22396928
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 59407 43 29 60801 80 15 22396928
NTFS, blocksize=4096, 11 GB / 10 GiB

Results
* HPFS - NTFS 0 32 33 191 89 26 3072000
NTFS, blocksize=4096, 1572 MB / 1500 MiB
P HPFS - NTFS 191 89 27 59407 43 28 951302144
NTFS, blocksize=4096, 487 GB / 453 GiB
P HPFS - NTFS 59407 43 29 60801 80 15 22396928
NTFS, blocksize=4096, 11 GB / 10 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
2 P HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928


I have is running Advanced now but only 15% into run.

Halogen.......

Re: WIndows 7 RAW partition Recovery

Posted: 16 Dec 2014, 07:59
by cgrenier
Run Testdisk, Advanced, select the partition, choose Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit. Restart your computer.
If you still have problem to access this partition, run "cmd" (right click run as administrator) and type "chkdsk /f e:" (replace e: by the correct drive letter).

Re: WIndows 7 RAW partition Recovery

Posted: 30 Dec 2014, 20:23
by halogen
Here is what I have now:

TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63

Partition Start End Size in sectors
1 * HPFS - NTFS 0 32 33 191 89 26 3072000
> 2 P HPFS - NTFS 191 89 27 59407 43 28 951302144
3 P HPFS - NTFS 59407 43 29 60801 80 15 22396928

[ Type ] >[ Boot ] [ List ] [Undelete] [Image Creation] [ Quit ]
Boot sector recovery

Disk \\.\PhysicalDrive5 - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
2 P HPFS - NTFS 191 89 27 59407 43 28 951302144

Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

WHen I list files all I get is this:

2 P HPFS - NTFS 191 89 27 59407 43 28 951302144
Directory /

>dr-xr-xr-x 0 0 0 21-Nov-2014 14:01 .
dr-xr-xr-x 0 0 0 21-Nov-2014 14:01 ..
dr-xr-xr-x 0 0 0 22-Oct-2014 18:55 Program Files

It was showing all the files UNTIL I hit the Repair MFT by Accident :cry: and now it only shows the ones above so I'm not sure where they went or how to get them all back. I did not do any Writes to the disk but I did do an image creation before doing the Repair MFT.

Not sure what to do at this point to get the files back and the partition is still showing Raw on windows disk management.