.

Using TestDisk to repair the filesystem
Post Reply
Message
Author
Threshold
Posts: 2
Joined: 29 Apr 2015, 00:06

.

#1 Post by Threshold » 29 Apr 2015, 01:25

*
Last edited by Threshold on 14 Jun 2015, 19:30, edited 1 time in total.

Sponsored links

hostmagyar
Posts: 2
Joined: 07 Jun 2015, 05:18

Re: USB HDD Switched to "Unknown File System\Raw data"

#2 Post by hostmagyar » 07 Jun 2015, 05:23

I am having the same issue. Had a failing drive that I ddrescued to an external USB. Log looks like this, but it's still showing as RAW, and chkdsk still reports no MFT or mirror.
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319965626368
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000316862464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000048425472
Hard disk list
Disk \\.\PhysicalDrive0 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 319 GB / 297 GiB - CHS 38900 255 63, sector size=512
Drive E: - 1000 GB / 931 GiB - CHS 121614 255 63, sector size=512
Drive F: - 1000 GB / 931 GiB - CHS 121582 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 2000 GB / 1862 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 2000 GB / 1862 GiB - CHS 243197 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/0/3
FAT32 at 121614/237/35
Info: size boot_sector 1953219581, partition 1953219581
FAT1 : 32-238403
FAT2 : 238404-476775
start_rootdir : 476776 root cluster : 2
Data : 476776-1953219559
sectors : 1953219581
cluster_size : 64
no_of_cluster : 30511606 (2 - 30511607)
fat_length 238372 calculated 238372
sect/track 32 (FAT) != 63 (HD)
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 0 3 121588 57 7 1953314816
2 E extended LBA 121614 0 1 243197 57 60 1953234546
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
5 L FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1862 GiB - CHS 243197 255 63
NTFS at 0/0/3
filesystem size 1953314816
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 3 121588 57 7 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
sect/track 32 (FAT) != 63 (HD)
FAT32 at 121614/237/35
FAT1 : 32-238403
FAT2 : 238404-476775
start_rootdir : 476776 root cluster : 2
Data : 476776-1953219559
sectors : 1953219581
cluster_size : 64
no_of_cluster : 30511606 (2 - 30511607)
fat_length 238372 calculated 238372
sect/track 32 (FAT) != 63 (HD)

FAT32 at 121614/237/35
FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]
FAT32, blocksize=32768, 1000 GB / 931 GiB

Results
* HPFS - NTFS 0 0 3 121588 57 7 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
L FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]
FAT32, blocksize=32768, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 0 3 121588 57 7 1953314816
2 E extended LBA 121614 0 1 243197 57 60 1953234546
5 L FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]

search_part()
Disk \\.\PhysicalDrive1 - 2000 GB / 1862 GiB - CHS 243197 255 63
NTFS at 0/0/3
filesystem size 1953314816
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 3 121588 57 7 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
sect/track 32 (FAT) != 63 (HD)
FAT32 at 121614/237/35
FAT1 : 32-238403
FAT2 : 238404-476775
start_rootdir : 476776 root cluster : 2
Data : 476776-1953219559
sectors : 1953219581
cluster_size : 64
no_of_cluster : 30511606 (2 - 30511607)
fat_length 238372 calculated 238372
sect/track 32 (FAT) != 63 (HD)

FAT32 at 121614/237/35
FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]
FAT32, blocksize=32768, 1000 GB / 931 GiB

Results
* HPFS - NTFS 0 0 3 121588 57 7 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
L FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]
FAT32, blocksize=32768, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 0 3 121588 57 7 1953314816
2 E extended LBA 121614 0 1 243197 57 60 1953234546
5 L FAT32 LBA 121614 237 35 243197 57 60 1953219581 [DATA YO]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 121614/0/1,lba=1953728910
You will have to reboot for the change to take effect.

TestDisk exited normally.
Photorec was able to recover about 200 GB of files, so it seems like the actual data isn't too damaged, just the MFT. Any idea on how to help with that? I don't need a full bootable OS, just being able to have file names and directories back would be a big help.

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: USB HDD Switched to "Unknown File System\Raw data"

#3 Post by Fiona » 08 Jun 2015, 18:23

Did you use testdisk 64 bit?
TestDisk 7.1WIP 32bit is recommended.
In most cases if a partition appears as RAW indicates either a problem with the boot sector or file system.
A boot sector diagnose could probably help.
Info will follow.

Please let me know, did you use testdisk 64bit or testdisk 32bit?

Fiona

hostmagyar
Posts: 2
Joined: 07 Jun 2015, 05:18

Re: USB HDD Switched to "Unknown File System\Raw data"

#4 Post by hostmagyar » 11 Jun 2015, 05:05

I definitely used testdisk 64 bit. I'll retry it using the 32 bit application, and print the boot sector diagnostic tomorrow. Thanks for the advice!

Threshold
Posts: 2
Joined: 29 Apr 2015, 00:06

Re: USB HDD Switched to "Unknown File System\Raw data"

#5 Post by Threshold » 14 Jun 2015, 03:01

ò.
Last edited by Threshold on 14 Jun 2015, 19:30, edited 1 time in total.

prakash
Posts: 2
Joined: 14 Jun 2015, 03:24

Re: USB HDD Switched to "Unknown File System\Raw data"

#6 Post by prakash » 14 Jun 2015, 04:05

I have run testdisk on ubuntu.

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
Current partition structure:
Partition Start End Size in sectors

Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 60797 27 30 976703488
1 P FAT16 >32M 0 32 33 60797 27 30 976703488
No partition is bootable



*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests