Can't find all partitions on a triple-boot drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Cubytus
Posts: 1
Joined: 26 Apr 2015, 07:16

Can't find all partitions on a triple-boot drive

#1 Post by Cubytus »

Hi there,

After some operation I can't recall, I ended up with an unbootable hard drive. Before attempting repair, I made sure the drive wasn't dead with SMART short and long tests, and found it running fine. The problem is, I can't remember exactly how the partitions were laid out.

It powers a triple-boot machine with the following structure and approximate size:
  • Windows XP, 35GB, NTFS
  • Ubuntu Desktop 12.04, around 33GB, ext3 or ext4, can't remember.
  • common Ubuntu /home folder shared between Ubuntu Desktop and Ubuntu server (two different usernames, so no conflicts), around 120GB, ext3 or ext4
  • Ubuntu Server 12.04, around 50GB, ext3 or ext4, last installed.
  • And a Linux space partition, around 4GB, as large as the RAM is, though I don't recall if I placed it at the end or at the beginning of the disk.
.

Five partitions would require a logical + extended structure, but the problem is I can't remember the layout I applied in the first place. ( :!: Problem zero) Chances are I used GParted Live since it provides for a "move" option that is not available in Ubuntu's installers.

Quick scan result
After a quick scan and writing the partition structure, TestDisk was able to find the Windows partition and lists the files on it. All the partitions were marked as deleted, so I set up all of the four found partitions as primary. I don't know if that is correct given that I know Ubuntu Server was the last installed OS.
Screenshot - 04252015.png
Screenshot - 04252015.png (25.25 KiB) Viewed 980 times
Since the boot sector was still corrupted, I used Hiren's Boot CD to bypass it and directly load partition 1, containing Windows. The Windows XP logo indeed appeared, then a blue screen of death very briefly flashed before the machine restarted, so fast that I couldn't write down the error code. Safe Mode would end up crashing on restart as well. And Windows XP doesn't have the "Don't reboot on error" option when pressing F8 on boot. I wanted to manually run chkdsk /f on that one since Linux doesn't have a proper NTFS-checking tool, but the Mini Windows XP on Hiren's boot CD only saw it as unformatted.

:!: This is the first issue: Windows XP can't boot for a reason I can't understand. How would I follow the usual advice of attempting repair using chkdsk if it doesn't mount properly in Mini Windows XP?
Before anyone asks, this is my only hardware Windows machine. Virtual machines are available, though.

I then tried to repair the partition table type, thinking it was a standard MBR, then restarted the whole process, only for TestDisk to find nothing, so I went back and set it to GPT, then wrote the found structure on disk.

Deep scan result
The I restarted on PartedMagic, which contains TestDisk 6.14, and performed a deep search.
I got many warnings

Code: Select all

Number of heads/cylinders mismatches 240 (NTFS) != 255 (HD)
, which is supposed to be benign, and

Code: Select all

Bad root_cluster
check_FAT: unusual media descriptor (0cf0!=0xf8)
Screenshot - 04262015 2.png
Screenshot - 04262015 2.png (112.65 KiB) Viewed 980 times
It found HUNDREDS of cadavers of dead partitions, most of which were the "MS Data" global type, and that apparently included traces of live CDs I booted in its lifetime. The wiki says that if files can be seen, then partition can be recovered since nothing inside is corrupted. All of those partitions were still marked as deleted.
Screenshot - 04262015.png
Screenshot - 04262015.png (112.68 KiB) Viewed 980 times
:!: Here lies the second problem: I can't possibly explore each of these partitions as there are too many of them. How do I find out what is the right combination of partitions?

As a first attempt to solve that, I wrote down the boundaries of known partitions, and could find the four main ones just like the quick scan did, but the second one remains desperately unreadable, likely Ubuntu Desktop. Search for magic blocks returned nothing, while the ones on the other two Linux partitions could be found. I tried switching the sub-type manually to ext2, ext3, ext4 (previously detected as NTFS) but no file shows. To further complicate the matter, I don't see any partition large enough to encompass the Desktop, /home, and Server.

:!: This is problem number three: how can I read the files of a partition I know isn't formatted, but somehow doesn't display?

As I hit a wall, I thought repairing the boot sector might help, but it didn't. So my last resort would be to repair GRUB, but as you can guess, I forgot where it was installed in the first place.

I don't really know what to do next. I know the results show a solution is very close, but I don't know how to proceed from there. Any help is appreciated.

Locked