Partition recovery after windows installation

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
boobytrap
Posts: 2
Joined: 11 Sep 2015, 12:16

Partition recovery after windows installation

#1 Post by boobytrap »

Hello,

For some reason after i tried to install windows on another partition my entire partition table got deleted and instead of i 1TB disk it showed just a 137gb empty space. WIth testdisk i was able to recover all except one 50-60gb NTFS partition (i don't remember the exact size) which is now shown as 39gb unallocated along with some 1mb to 6mb chunks. I run the whole deeper search for about 5 hours which gave me some errors you'll se below in the log. When i clicked list files it wouldn't show saying it's to corrupted.

fdisk -l output

Code: Select all

Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x69205244

Device     Boot     Start        End    Sectors   Size Id Type
/dev/sda1  *     81920000  169768959   87848960  41.9G 83 Linux
/dev/sda2       169771008  171724799    1953792   954M 82 Linux swap / Solaris
/dev/sda3       171726848  172023807     296960   145M 83 Linux
/dev/sda4       172023808 1953523711 1781499904 849.5G  f W95 Ext'd (LBA)
/dev/sda5       172036096 1953519615 1781483520 849.5G  7 HPFS/NTFS/exFAT
gparted:
Image

testdisk.log

Code: Select all

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 10708/191/44
Current partition structure:
 1 * Linux                 5099  72 30 10567 160 25   87848960 [kali]
 2 P Linux Swap           10567 192 58 10689  95 30    1953792
 3 P Linux                10689 127 63 10707 251 40     296960
 4 E extended LBA         10707 251 41 121601  57 56 1781499904
 5 L HPFS - NTFS          10708 191 44 121600 247 55 1781483520
Backup partition structure
partition_save

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63

recover_EXT2: s_block_group_nr=0/335, s_mnt_count=525/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB
     Linux Swap           10567 192 58 10689  95 14    1953776
     SWAP2 version 1, pagesize=4096, 1000 MB / 953 MiB

recover_EXT2: s_block_group_nr=0/18, s_mnt_count=679/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 63 10707 251 40     296960
     ext4 blocksize=1024 Sparse superblock, 152 MB / 145 MiB
NTFS at 10708/191/44
filesystem size           1781483520
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               111342719
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          10708 191 44 121600 247 55 1781483520
     NTFS, blocksize=4096, 912 GB / 849 GiB

Results
   * Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB
   P Linux Swap           10567 192 58 10689  95 30    1953792
     SWAP2 version 1, pagesize=4096, 1000 MB / 954 MiB
   P Linux                10689 127 63 10707 251 40     296960
     ext4 blocksize=1024 Sparse superblock, 152 MB / 145 MiB
   L HPFS - NTFS          10708 191 44 121600 247 55 1781483520
     NTFS, blocksize=4096, 912 GB / 849 GiB
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
 1 * Linux                 5099  72 30 10567 160 25   87848960 [kali]
 2 P Linux Swap           10567 192 58 10689  95 30    1953792
 3 P Linux                10689 127 63 10707 251 40     296960
 4 E extended LBA         10707 251 41 121601  57 56 1781499904
 5 L HPFS - NTFS          10708 191 44 121600 247 55 1781483520

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 5099/72/29
filesystem size           81917952
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               5119871
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33  5099  72 29   81917952
     NTFS found using backup sector, blocksize=4096, 41 GB / 39 GiB

recover_EXT2: s_block_group_nr=0/335, s_mnt_count=525/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB
NTFS at 7139/31/60
filesystem size           114688000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33  7139  31 60  114688000
     NTFS found using backup sector, blocksize=4096, 58 GB / 54 GiB

recover_EXT2: s_block_group_nr=0/210, s_mnt_count=681/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8160
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 6884864
recover_EXT2: part_size 55078912
     Linux                 7139  31 61 10567 160 25   55078912
     ext4 blocksize=4096 Large file Sparse superblock, 28 GB / 26 GiB

recover_EXT2: s_block_group_nr=0/335, s_mnt_count=524/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 7728 218 43 13197  51 38   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB

recover_EXT2: s_block_group_nr=0/335, s_mnt_count=524/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 7732 173 58 13201   6 53   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB
FAT16 at 7942/164/31
FAT1 : 1-156
FAT2 : 157-312
start_rootdir : 313
Data : 345-159548
sectors : 159552
cluster_size : 4
no_of_cluster : 39801 (2 - 39802)
fat_length 156 calculated 156
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT16 at 7942/164/31
     FAT16 LBA             7942 164 31  7952 147  3     159552 [NO NAME]
     FAT16, blocksize=2048, 81 MB / 77 MiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/335, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8176
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 10981120
recover_EXT2: part_size 87848960
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 44 GB / 41 GiB
     Linux Swap           10567 192 58 10689  95 14    1953776
     SWAP2 version 1, pagesize=4096, 1000 MB / 953 MiB

recover_EXT2: s_block_group_nr=0/18, s_mnt_count=679/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 63 10707 251 40     296960
     ext4 blocksize=1024 Sparse superblock, 152 MB / 145 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/18, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 61 10707 251 38     296960
     ext4 blocksize=1024 Sparse superblock Backup superblock, 152 MB / 145 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/18, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 61 10707 251 38     296960
     ext4 blocksize=1024 Sparse superblock Backup superblock, 152 MB / 145 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/18, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 61 10707 251 38     296960
     ext4 blocksize=1024 Sparse superblock Backup superblock, 152 MB / 145 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/18, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 61 10707 251 38     296960
     ext4 blocksize=1024 Sparse superblock Backup superblock, 152 MB / 145 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/18, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=1960
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 148480
recover_EXT2: part_size 296960
     Linux                10689 127 61 10707 251 38     296960
     ext4 blocksize=1024 Sparse superblock Backup superblock, 152 MB / 145 MiB
NTFS at 10708/191/44
filesystem size           1781483520
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               111342719
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          10708 191 44 121600 247 55 1781483520
     NTFS, blocksize=4096, 912 GB / 849 GiB
BAD_RS LBA=3069233919 749725
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M           191050 248 46 208745 229 46  284268979
This partition ends after the disk limits. (start=3069233919, size=284268979, end=3353502897, disk end=1953525168)
BAD_RS LBA=3120452955 12220473
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
     FAT32                194239  54 19 277054 223 55 1330433659
This partition ends after the disk limits. (start=3120452955, size=1330433659, end=155919317, disk end=1953525168)
NTFS at 121600/247/55
filesystem size           1781483520
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               111342719
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          10708 191 44 121600 247 55 1781483520
     NTFS found using backup sector, blocksize=4096, 912 GB / 849 GiB
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2278 GB / 2122 GiB)
The following partitions can't be recovered:
     FAT16 >32M           191050 248 46 208745 229 46  284268979
     FAT32                194239  54 19 277054 223 55 1330433659

Results
     HPFS - NTFS              0  32 33  5099  72 29   81917952
     NTFS found using backup sector, blocksize=4096, 41 GB / 39 GiB
     HPFS - NTFS              0  32 33  7139  31 60  114688000
     NTFS found using backup sector, blocksize=4096, 58 GB / 54 GiB
     Linux                 5099  72 30 10567 160 25   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB
     Linux                 7139  31 61 10567ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x00000000  size: 1024   usa_ofs: 0  usa_count: 65535: Invalid argument
Record 0 has no FILE magic (0x0)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xd1cbae36  size: 1024   usa_ofs: 18343  usa_count: 6173: Invalid argument
Record 0 has no FILE magic (0xd1cbae36)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xd1cbae36  size: 1024   usa_ofs: 18343  usa_count: 6173: Invalid argument
Record 0 has no FILE magic (0xd1cbae36)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xd1cbae36  size: 1024   usa_ofs: 18343  usa_count: 6173: Invalid argument
Record 0 has no FILE magic (0xd1cbae36)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xd1cbae36  size: 1024   usa_ofs: 18343  usa_count: 6173: Invalid argument
Record 0 has no FILE magic (0xd1cbae36)
Failed to load $MFT: Input/output error
 160 25   55078912
     ext4 blocksize=4096 Large file Sparse superblock, 28 GB / 26 GiB
     Linux                 7728 218 43 13197  51 38   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB
     Linux                 7732 173 58 13201   6 53   87848960 [kali]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 44 GB / 41 GiB
     FAT16 LBA             7942 164 31  7952 150  6     159744 [NO NAME]
     FAT16, blocksize=2048, 81 MB / 78 MiB
     Linux Swap           10567 192 58 10689  95 30    1953792
     SWAP2 version 1, pagesize=4096, 1000 MB / 954 MiB
     Linux                10689 127 61 10707 251 38     296960
     ext4 blocksize=1024 Sparse superblock Backup superblock, 152 MB / 145 MiB
     Linux                10689 127 63 10707 251 40     296960
     ext4 blocksize=1024 Sparse superblock, 152 MB / 145 MiB
     HPFS - NTFS          10708 191 44 121600 247 55 1781483520
     NTFS, blocksize=4096, 912 GB / 849 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

     HPFS - NTFS              0  32 33  5099  72 29   81917952
     NTFS found using backup sector, blocksize=4096, 41 GB / 39 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

     HPFS - NTFS              0  32 33  7139  31 60  114688000
     NTFS found using backup sector, blocksize=4096, 58 GB / 54 GiB
Can't open filesystem. Filesystem seems damaged.
As you can shee it shows a 58gb but it is not recoverable, and also a NTFS 41gb which i don't know what it is. I wonder if i have other options or i should just reformat the partition and consider the data lost. Thanks in advance!
Top
User avatar
cgrenier
Site Admin
Posts: 5427
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Partition recovery after windows installation

#2 Post by cgrenier »

Old OS (Windows 2000 before SP4, XP before SP1...) are limited to 128 GB/137GB. Are you in this case ?
Top
boobytrap
Posts: 2
Joined: 11 Sep 2015, 12:16

Re: Partition recovery after windows installation

#3 Post by boobytrap »

Yes, i forgot to mention it was Windows Xp i was trying to install. Wish i'd known about this limitation, that's probably what messed up everything.

Btw, this is what gparted show, which is not visible in the original post for some reason:

http://www.fastpic.info/image/1d280eae2a
Top
Locked

Return to “Partition Recovery”