Lost Partition/Lost FAT/Lost FS

How to use TestDisk to recover lost partition
Message
Author
sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#11 Post by sbtm77 » 20 Apr 2015, 05:40

Fiona wrote:I've only got some information that you've changed your partition type Fat16<32M to NTFS using the menu Advanced / Type.
As the result, either there is no NTFS boot sector or both are invalid?
Did you already run RebuildBS?

When you were running Quick and Deeper Search, did you get any message of unrecoverable partitions?

Fiona
Hi Fiona,

RebuildBS was already done and nothing came out of it. Re-running it now as we speak.

With Quick and Deeper Search, I have never gotten these messages before. I will run them as well and send across the log file.

--Sadiq

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost Partition/Lost FAT/Lost FS

#12 Post by Fiona » 20 Apr 2015, 06:56

You can copy and paste the content of your testdisk.log running Analyse, Quick and Deeper Search into your next post!
Could be more detailed about your situation finding any boot sector and a backup of it at another location?

Fiona

sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#13 Post by sbtm77 » 26 Apr 2015, 03:26

Fiona wrote:I've only got some information that you've changed your partition type Fat16<32M to NTFS using the menu Advanced / Type.
As the result, either there is no NTFS boot sector or both are invalid?
Did you already run RebuildBS?

When you were running Quick and Deeper Search, did you get any message of unrecoverable partitions?

Fiona
Good morning Fiona,

Ran all searches along with RebuildBS and tried to List as well. No success. Before running all this, I ran qphotorec_win and all I got was 1 pst file and a lot of mp3, which FYI I didn't have a single mp3 on that disk!

Anyways, here are is the log for testdisk run:

Code: Select all


Fri Apr 24 22:52:37 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2015-03-09T19:49:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdh)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=699004928
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 64601 240 63, sector size=512 - ST500DM002-1BD142, S/N:202020202020202020202020365a45454c453645, FW:KC48
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1ER164, S/N:202020202020202020202020345a315a4e373231, FW:CC25
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1ER164, S/N:202020202020202020202020345a315a4e373844, FW:CC25
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST310005 24AS, S/N:152D20337A0C
Drive L: - 699 MB / 666 MiB - CHS 341311 1 1, sector size=2048

Partition table type (auto): Intel
Disk /dev/sdh - 1000 GB / 931 GiB - ST310005 24AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
Change partition type:
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616

Analyse Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
No partition is bootable

search_part()
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
file_pread(7,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(7,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(7,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(7,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(7,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(7,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 121601/25/24
filesystem size           2930286592
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1000203091456, part_size=1500306735104, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
file_pread(7,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(7,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(7,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(7,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(7,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(7,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
No partition is bootable

search_part()
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(7,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(7,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(7,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(7,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(7,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
file_pread(7,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(7,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(7,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(7,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(7,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(7,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(7,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(7,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616

fat1x_boot_sector
 1 P FAT16 >32M               0  32 33 121601  25 24 1953519616
Boot sector
Bad

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
NTFS at 0/32/33
Error: size boot_sector 2930286592 > partition 1953519616
filesystem size           1 2930286592
sectors_per_cluster       0 8
mft_lcn                   0 786432
mftmirr_lcn               0 2
clusters_per_mft_record   0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad

Backup boot sector
Error: size boot_sector 2930286592 > partition 1953519616
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
NTFS at 0/32/33
Error: size boot_sector 2930286592 > partition 1953519616
filesystem size           1 2930286592
sectors_per_cluster       0 8
mft_lcn                   0 786432
mftmirr_lcn               0 2
clusters_per_mft_record   0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad

Backup boot sector
Error: size boot_sector 2930286592 > partition 1953519616
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
*Fingers crossed*

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost Partition/Lost FAT/Lost FS

#14 Post by Fiona » 04 May 2015, 11:03

Partition information in your boot sector is far beyond your disk limit and size of your partition.
RebuildBS didn't work either.
That's why it looks that your file system is damaged.
You should use datarecovery software like PhotoRec and trying to recover data.
You should run PhotoRec on your disk and scanning the whole space.
http://www.cgsecurity.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
You can use FileOpt and pressing s to deselect all file types and only activating these file types where you'd like to recover.
It saves recovering of unnecessary files.

You can test to recover first a small amount of files and test it.
You can stop PhotoRec and if you restart it, PhotoRec will ask to continue your previous session.

Fiona

sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#15 Post by sbtm77 » 04 May 2015, 11:05

Many thanks Fiona for your response. I will try this immediately and hope for the best :)

--Sadiq

sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#16 Post by sbtm77 » 05 May 2015, 15:49

Hi Fiona,

The list of files PhotoRec has found is really not right. The hard drive that I am scanning used to my OS (Win7) drive and had all the program files.

The extensions it has found is:
mp3: 12180 recovered
txt: 23 recovered
ogg: 17 recovered
tib: 4 recovered
gz: 3 recovered
gpg: 2 recovered
pst: 1 recovered

I didn't have any mp3 files there and I can't see executables either. Granted the scan hasn't finished yet.

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost Partition/Lost FAT/Lost FS

#17 Post by Fiona » 05 May 2015, 16:17

I've no idea why the result is so poor?
In case to get an overview about the condition of your data, you could download a trial of commercial software like restorer ultimate and scan your drive.
Please scan your whole disk and it's absolutely important.
Afterwards you can check all partitions found and the condition of your data, even folder?

Fiona

sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#18 Post by sbtm77 » 05 May 2015, 16:34

I think I'll download the commercial software ava see what I come up with.

Let's hope for the best.

I'll report back!

sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#19 Post by sbtm77 » 23 May 2015, 15:44

Fiona wrote:restorer ultimate and scan your drive.
Fiona
Hi Fiona,

Sorry for not writing back earlier. I guess I have given up.

Downloaded Restorer Ultimate and got the same exact output as earlier. It gave me a bunch of mp3 (tens of thousands) and a few here and there. This obviously doesn't seem correct because that was the OS (Win7) drive and had user folders, program files and that's it. All docs were on seperate drive.

I am tempted now to format that drive and run a scan then!

What do you think???

sbtm77
Posts: 16
Joined: 31 Mar 2015, 06:56

Re: Lost Partition/Lost FAT/Lost FS

#20 Post by sbtm77 » 23 May 2015, 15:57

Btw, Fiona, I just remembered one thing; the Win7 drive had a "system reserved" partition of about 100MB.

Maybe that's whats throwing off the rescue apps? Or maybe we can recreate the partitions having this in mind? Just a thought.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests