Help needed with TestDisk !

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Help needed with TestDisk !

#1 Post by Krollibrius »

Hello,

My computer (an Asus X550LC) has crashed. I thought I lost all my data (I couldn't get anything back with Recuva, nor Photorec), but now that I have tried TestDisk, it looks like there is still a hope. Nevertherless, as I'm really not an expert, I don't want to try anything without being 100% sure. Therefore, I need someone to give me a hand for the final steps…

I first left the settings as they were, and I arrived to the Main Menu. I did Analyze > Quick Search, and TestDisk found four partitions: Recovery, OS, Data and Restore (they are shown in simply white, not green). I can see the files that they contain, and it looks like it is OS and Data that I want to get back. I think I can visualize everything I need, so I don't need a Deeper Search, right?

This is where it is a bit different than the tutorial I was using, so I don't dare going further. I can change the partition type (in *, Primary or Logical), and it turns into green. However, I cannot put both OS and Data in Logical at the same time (it says "Structure: Bad." for the second I'm trying to change)…

I would be so greatful if someone could help me out here, I have on this hard drive really meaningful things for me (old pictures, photos and so on)… And in the future, I'll have perfect BackUp's for sure :)
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk !

#2 Post by Fiona »

Can you copy and paste the content of your testdisk,log into your next post?

Fiona
Top
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Re: Help needed with TestDisk !

#3 Post by Krollibrius »

Hello!

Thanks for your answer Fiona, and sorry for my late response.

Here it is, I hope it is indeed what you need.

Wed May 20 21:50:57 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=307383066624
filewin32_getfilesize(\\.\D:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HTS545032B9A300, S/N:100109PB43001TGSW6LA, FW:PB3OC60F
Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63, sector size=4096 - TOSHIBA MQ01ABF050, S/N:152D20337A0C
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 7600 255 63, sector size=4096 - TOSHIBA MQ01ABF050, S/N:152D20337A0C

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - TOSHIBA MQ01ABF050
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
NTFS at 1/155/27
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 1843200
sectors_per_cluster 8
mft_lcn 76800
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
NTFS, blocksize=4096, 943 MB / 900 MiB
NTFS at 17/252/44
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 390705152
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
NTFS, blocksize=4096, 200 GB / 186 GiB
NTFS at 3058/6/21
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 541792256
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
NTFS, blocksize=4096, 277 GB / 258 GiB
NTFS at 7273/165/61
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 41963520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]
NTFS, blocksize=4096, 21 GB / 20 GiB
file_pread(5,2,buffer,122096647(7600/42/2)) lseek err Invalid argument
file_pread(5,2,buffer,122096649(7600/42/4)) lseek err Invalid argument
file_pread(5,3,buffer,122096655(7600/42/10)) lseek err Invalid argument
file_pread(5,1,buffer,122096896(7600/45/62)) lseek err Invalid argument
file_pread(5,2,buffer,122096646(7600/42/1)) ReadFile Erreur de données (contrôle de redondance cyclique).

file_pread(5,1,buffer,122096648(7600/42/3)) lseek err Invalid argument
file_pread(5,2,buffer,122096653(7600/42/8)) lseek err Invalid argument
file_pread(5,3,buffer,122096661(7600/42/16)) lseek err Invalid argument
file_pread(5,1,buffer,122096902(7600/46/5)) lseek err Invalid argument

Results
HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
NTFS, blocksize=4096, 943 MB / 900 MiB
HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
NTFS, blocksize=4096, 200 GB / 186 GiB
HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
NTFS, blocksize=4096, 277 GB / 258 GiB
HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]
NTFS, blocksize=4096, 21 GB / 20 GiB

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk !

#4 Post by Fiona »

Your current partition table only contain an efi gpt partition:
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295
I wonder on how did you get an efi gpt partition into your partition table?
But it looks like, that testdisk found all partitions using Quick Search?
Results
HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
NTFS, blocksize=4096, 943 MB / 900 MiB
HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
NTFS, blocksize=4096, 200 GB / 186 GiB
HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
NTFS, blocksize=4096, 277 GB / 258 GiB
HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]
NTFS, blocksize=4096, 21 GB / 20 GiB
Instruction for recovery:
TestDisk should display the results as above.
You should mark each partition and press p to have a try to list your files.
If you were able to list all files on all partitions, you can recover them.
I've no idea from which partition do you boot?
I assume should be your OS-Partition?
Please mark your OS partition and set it with your right or left arraow key on your keyboard to star * for primary active and bootable.
You'll see it at the left side.
Set the other 3 partitions to P for primary only.
Press enter, in case you should mark Write und confirm with enter and y for yes.
In case if there would be any problem wit a boot sector it would be possible that the testdisk menu boot appears.
Only in case confirm with backupBS.

Otherwise quit testdisk and restart your PC.
Please check your partitions and data.

Some Info:
Lots of PC's and Laptops delivered today have a recovery partition.
If you loose any partition and/or your MBR gets modified you'll not to be able to boot into your recovery partition anymore.
In rare cases it helped to reinstall the software for setting back your computer to factory settings delivered with your computer to modify it again.
But as I mentioned above only in rare cases.
Otherwise you should call the support.

Fiona
Top
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Re: Help needed with TestDisk !

#5 Post by Krollibrius »

Hello Fiona.

Again, thank you for your time.

So this is what I have done :

I followed your explanations; I've put OS partition to *, and the 4 others to [P]. I've pressed enter, then "Write" and Yes for confirmation.

Then, "Partition: Write error" was written, and all I could do what going back to the main menu.

I cannot see "BackupBS" anywhere. There is a "Backup" at the beginning, just before running the Quick Search, but no "BackupBS".

Two additional remarks:

-At the beginning (at disk selection), I can see two disks for the same hard-drive.
One is: Disk /dev.sdb - 500GB / 465 GiB - TOSHIBA MQ01ABF050
And the second one is: Disk \\. \PhysicalDrive1 - 500GB / 465GiB - TOSHIBA MQ01ABF050
I've tried with both, and they look exactly the same during the next steps, but who knows... It there any difference?

-Before Quick Search, I used to have

Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Now I have directly the four partitions, with the structures ( * and P) I've put, but with a warning for each:

Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)

Finally, to answer you, I have no idea how I had a efi gpt partition into my partition table, if it is suppose to be weird, but I have actually no idea what it represents.

I really hope you can still help me. What should I do now ?

Thanks !!
Top
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Re: Help needed with TestDisk !

#6 Post by Krollibrius »

Here is the .log file if it can help you.

Sun May 24 22:27:19 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=307383066624
filewin32_getfilesize(\\.\D:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HTS545032B9A300, S/N:100109PB43001TGSW6LA, FW:PB3OC60F
Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63, sector size=4096 - TOSHIBA MQ01ABF050, S/N:152D20337A0C
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 7600 255 63, sector size=4096 - TOSHIBA MQ01ABF050, S/N:152D20337A0C

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - TOSHIBA MQ01ABF050
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/155/27
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 1843200, partition 230400
NTFS at 17/252/44
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 390705152, partition 48838144
NTFS at 3058/6/21
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 541792256, partition 67724032
NTFS at 7273/165/61
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
Info: size boot_sector 41963520, partition 5245440
Current partition structure:
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
1 P HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
2 * HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
3 P HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
4 P HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
NTFS at 1/155/27
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 1843200
sectors_per_cluster 8
mft_lcn 76800
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
NTFS, blocksize=4096, 943 MB / 900 MiB
NTFS at 17/252/44
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 390705152
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
NTFS, blocksize=4096, 200 GB / 186 GiB
NTFS at 3058/6/21
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 541792256
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
NTFS, blocksize=4096, 277 GB / 258 GiB
NTFS at 7273/165/61
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 41963520
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]
NTFS, blocksize=4096, 21 GB / 20 GiB
file_pread(5,2,buffer,122096647(7600/42/2)) lseek err Invalid argument
file_pread(5,2,buffer,122096649(7600/42/4)) lseek err Invalid argument
file_pread(5,3,buffer,122096655(7600/42/10)) lseek err Invalid argument
file_pread(5,1,buffer,122096896(7600/45/62)) lseek err Invalid argument
file_pread(5,2,buffer,122096646(7600/42/1)) ReadFile Erreur de données (contrôle de redondance cyclique).

file_pread(5,1,buffer,122096648(7600/42/3)) lseek err Invalid argument
file_pread(5,2,buffer,122096653(7600/42/8)) lseek err Invalid argument
file_pread(5,3,buffer,122096661(7600/42/16)) lseek err Invalid argument
file_pread(5,1,buffer,122096902(7600/46/5)) lseek err Invalid argument

Results
HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
NTFS, blocksize=4096, 943 MB / 900 MiB
HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
NTFS, blocksize=4096, 200 GB / 186 GiB
HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
NTFS, blocksize=4096, 277 GB / 258 GiB
HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]
NTFS, blocksize=4096, 21 GB / 20 GiB

interface_write()
1 P HPFS - NTFS 1 155 27 15 242 35 230400 [Recovery]
2 * HPFS - NTFS 17 252 44 3058 6 20 48838144 [OS]
3 P HPFS - NTFS 3058 6 21 7273 165 60 67724032 [Data]
4 P HPFS - NTFS 7273 165 61 7600 41 57 5245440 [Restore]
Top
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Re: Help needed with TestDisk !

#7 Post by Krollibrius »

Ok. Sorry, but I haven't notice something important.

I quit TestDisk and restarted my computer as you said.

And when plugging again the harddisk to the computer, Windows now shows 4 aditionnal harddisks: E:, F:, G:, H: (under the C: harddisk from the computer, you know, as USB sticks). But i cannot open them. Windows is telling me I should format each to use it, I put Cancel, and then it says "The volume is not available, etc etc".

These partitions are also showing in TestDisk now, but I'm not going any further.

Thanks :)
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with TestDisk !

#8 Post by Fiona »

And when plugging again the harddisk to the computer, Windows now shows 4 aditionnal harddisks: E:, F:, G:, H: (under the C: harddisk from the computer, you know, as USB sticks).
It's recommended to use testdisk 7.1 and the 32bit version.
Background processes like Antivirus can prevent testdisk from writing too?
Drives are probably your 4 partitions?
Would it be possible that your partitions are already written and you have a problem about ownership?
Please let me know how your disk is listed in your disk management console and I'd need info running testdisk / Analyse about your current partition strucure.
Might be possible that you have to put your disk back into your Asus Laptop and test it again.

Fiona
Top
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Re: Help needed with TestDisk !

#9 Post by Krollibrius »

Hello Fiona!

I think I have great news.

I have tried with the latest version of TestDisk, and with my Antivirus off as you said.

I haven't tried to re-write. When showing the files in the different partitions (I can still see them, by pressing P when the four partitions are showed), you can Select and Copy files from the harddisk to the computer. I've tried with a short video just to try, and it seems to work perfectly! I can actually watch it on my computer...

I won't get too excited now, we never know what can happen. I have selected all the files I want from my harddrive, and TestDisk is now copying them on my computer. I can actually see all the files coming, so looks very good! I'll let it run overnight. We'll see tomorrow if it is alright :)
Top
Krollibrius
Posts: 8
Joined: 03 May 2015, 20:25

Re: Help needed with TestDisk !

#10 Post by Krollibrius »

I have got all my data back!

Thank you SO MUCH for your help Fiona. Internet is a wonderful place!

Is there anything I can do for you in return?? I would love to thank you somehow :)

Bye bye!
Top
Locked

Return to “Partition Recovery”