Help needed with recovering data from RAW Partition

How to use TestDisk to recover lost partition
Message
Author
harizsofia
Posts: 7
Joined: 04 Oct 2015, 04:47

Help needed with recovering data from RAW Partition

#1 Post by harizsofia » 04 Oct 2015, 05:05

Hello, i am running Windows 7 64 Bit. My laptop freezed and when I restarted it, one of the partitions on my harddisk had changed from NTFS to RAW. Upon running Testdisk analysis, this is what it showed:TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Drive D: - 295 GB / 274 GiB - CHS 35889 255 63
Current partition structure:
Partition Start End Size in sectors

1 * Sys=4F 120527 49 53 234813 237 34 1836016416

Bad relative sector.
2 * Sys=73 119380 132 62 153270 41 37 544437093

Bad relative sector.
3 * Sys=2B 113201 29 24 147074 114 59 544175136

Bad relative sector.
4 * SpeedStor 177063 118 26 177066 225 63 54974

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
3 * Sys=2B 113201 29 24 147074 114 59 544175136
2 * Sys=73 119380 132 62 153270 41 37 544437093
Space conflict between the following two partitions
2 * Sys=73 119380 132 62 153270 41 37 544437093
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
Space conflict between the following two partitions
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
4 * SpeedStor 177063 118 26 177066 225 63 54974

*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition

I then did a quicksearch, i received the following message:TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Drive D: - 295 GB / 274 GiB - CHS 35889 255 63

The harddisk (295 GB / 274 GiB) seems too small! (< 1465 GB / 1364 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in sectors
> FAT12 132009 145 40 178144 139 43 741158401

[ Continue ]
379 GB / 353 GiB

Then advanced search resulted in this:
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Drive D: - 295 GB / 274 GiB - CHS 35889 255 63

The harddisk (295 GB / 274 GiB) seems too small! (< 1465 GB / 1364 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in sectors
> FAT12 132009 145 40 178144 139 43 741158401

[ Continue ]
379 GB / 353 GiB


I am not sure how to proceed now because it says the partition cant be recovered. Is there any way i can recover my harddisk and data?

Thanks in advance for any help u can provide..

Sponsored links

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with recovering data from RAW Partition

#2 Post by Fiona » 04 Oct 2015, 07:12

Under disk selection you should select Disk instead of a drive.
Please use the latest version of TestDisk 7.1 WIP 32bit.
Can you repeat your diagnose and copy and paste the content of your testdisk.log again?
Most important would be Analyse and your current partition structure (partition table).
If all partition in your partition table are correct, you can have a try to run a boot sector diagnose.
Info will follow.

Fiona

harizsofia
Posts: 7
Joined: 04 Oct 2015, 04:47

Re: Help needed with recovering data from RAW Partition

#3 Post by harizsofia » 04 Oct 2015, 08:12

Hi, thanks for responding. I downloaded Testdisk 7.1 WIP and did as you mentioned. The analyse step gave me this output:

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Current partition structure:
Partition Start End Size in sectors

1 P Dell Utility 0 1 1 4 254 63 80262
2 * HPFS - NTFS 5 25 21 2644 189 41 42405888
3 P HPFS - NTFS 2644 189 42 17404 120 62 237115074
4 E extended LBA 17404 120 63 91200 254 63 1185541183
5 L HPFS - NTFS 17404 121 63 53293 254 54 576565156

Bad relative sector.
X extended 53294 0 1 91200 254 63 608975955
6 L HPFS - NTFS 53294 1 1 91200 254 63 608975892





*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition

Then I performed a quicksearch and this is what resulted:

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Partition Start End Size in sectors
>* FAT16 >32M 0 1 1 4 254 63 80262 [DellUtility]
P HPFS - NTFS 5 25 21 2644 189 41 42405888
P HPFS - NTFS 2644 189 42 17404 120 62 237115074
L HPFS - NTFS 17404 121 63 53293 254 51 576565153
L HPFS - NTFS 53294 1 1 91200 254 63 608975892








Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue

Am not sure how to proceed from here though.. Appreciate the help!

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with recovering data from RAW Partition

#4 Post by Fiona » 04 Oct 2015, 10:08

It looks better now.
Altough you left out some parts of the testdisk.log.
But I found something.
The length of a partition in your partition table and found after quick search differ.
You can see it here:
5 L HPFS - NTFS 17404 121 63 53293 254 54 576565156
The sector value in your partition table is 54.
After Quick Search the sector value is 51.
L HPFS - NTFS 17404 121 63 53293 254 51 576565153
It can cause such behavior.
Can you select this partition and press p to have a try to list your files?
You can get back by pressing q for Quit.
As far as I've seen you have a Dell Computer.
There is something to watch writing it to your partition table.
It's your Dell Utility partition.
Info will follow.
Please let me know, is this your affected partition?

Fiona

harizsofia
Posts: 7
Joined: 04 Oct 2015, 04:47

Re: Help needed with recovering data from RAW Partition

#5 Post by harizsofia » 04 Oct 2015, 11:21

Hi,

Yes I am able to select the partition that you mentioned and was able to list the files. And yes, I do have a Dell computer.

The partition that you mentioned is the one that I am having trouble with.

Looking forward to hearing from you.

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with recovering data from RAW Partition

#6 Post by Fiona » 04 Oct 2015, 12:28

After Quick Search, your Dell Utility labeled FAT16-partition must be selected.
Press t for Type (partition type) on your keyboard.
Press enter to proceed.
At the bottom of the display you can watch your current partition type.
Easily type de for Dell Utility.
Press Enter to close the menu Type.
This procedure changes your FAT16-partition back to your Dell Utility-Partition and will be not visible under Windows.
It's a manufacturer setting and it's intended that users can't change anything.
Now you have to set the right partition as active and bootable.
It's this partition:
P HPFS - NTFS 5 25 21 2644 189 41 42405888
Please select it and use the right or left arrow key on your keyboard to set it to Star* instead of P for primary only.
You can watch it at the left.

Your display should look like this:
1 P Dell Utility 0 1 1 4 254 63 80262
* HPFS - NTFS 5 25 21 2644 189 41 42405888
P HPFS - NTFS 2644 189 42 17404 120 62 237115074
L HPFS - NTFS 17404 121 63 53293 254 51 576565153
L HPFS - NTFS 53294 1 1 91200 254 63 608975892
Press enter (your extended partition appears here automatically), check the menu Write, press enter again and confirm with yes.
Close TestDisk using Quit and restart your PC.

Fiona

harizsofia
Posts: 7
Joined: 04 Oct 2015, 04:47

Re: Help needed with recovering data from RAW Partition

#7 Post by harizsofia » 04 Oct 2015, 12:46

Hi,

I completed all the steps until the part where I had to change the Star part using the arrow keys. I think I have done it the way you mentioned, but I would just like to check with you if this is correct as i show below. I am not really sure because in your example there is a 1 before the P for the Dell Utility, but using the arrows on my computer doesn't give me the 1?

Also, after restarting, will my partition be back to normal? Should I backup my data before proceeding with the next step?

This is what I have... can you confirm if this is correct and I can proceed?

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Partition Start End Size in sectors
P Dell Utility 0 1 1 4 254 63 80262 [DellUtility]
>* HPFS - NTFS 5 25 21 2644 189 41 42405888
P HPFS - NTFS 2644 189 42 17404 120 62 237115074
L HPFS - NTFS 17404 121 63 53293 254 51 576565153
L HPFS - NTFS 53294 1 1 91200 254 63 608975892

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with recovering data from RAW Partition

#8 Post by Fiona » 04 Oct 2015, 13:01

Yes, everything looks correct.
The 1 was copied out of your partition table here:
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Current partition structure:
Partition Start End Size in sectors

1 P Dell Utility 0 1 1 4 254 63 80262
2 * HPFS - NTFS 5 25 21 2644 189 41 42405888
3 P HPFS - NTFS 2644 189 42 17404 120 62 237115074
4 E extended LBA 17404 120 63 91200 254 63 1185541183
5 L HPFS - NTFS 17404 121 63 53293 254 54 576565156

Bad relative sector.
X extended 53294 0 1 91200 254 63 608975955
6 L HPFS - NTFS 53294 1 1 91200 254 63 608975892
You should write your partition structure now as it is.

harizsofia
Posts: 7
Joined: 04 Oct 2015, 04:47

Re: Help needed with recovering data from RAW Partition

#9 Post by harizsofia » 04 Oct 2015, 13:40

Hi,

Ok,have done as you asked and restarted my laptop. However, the partition that I am having problems with is still RAW instead of NTFS, as you can see in the attachment.

Also if I run TestDisk again, the partitions look like this.. is this correct?

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63
Partition Start End Size in sectors
>* FAT16 >32M 0 1 1 4 254 63 80262 [DellUtility]
P HPFS - NTFS 5 25 21 2644 189 41 42405888
P HPFS - NTFS 2644 189 42 17404 120 62 237115074
L HPFS - NTFS 17404 121 63 53293 254 51 576565153
L HPFS - NTFS 53294 1 1 91200 254 63 608975892

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
Attachments
2015-10-04_203647.png
2015-10-04_203647.png (49.3 KiB) Viewed 1390 times

User avatar
Fiona
Posts: 2836
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Help needed with recovering data from RAW Partition

#10 Post by Fiona » 04 Oct 2015, 13:58

I didn't have the full log file.
That's why it was for me difficult to judge, do you have any problem with your file system or boot sector?
You can run testdisk again.
Don't confirm at analyse but advanced.
Select your affected partition and confirm at boot.
Please upload another snapshot.
Info will follow.

Fiona

Post Reply

Who is online

Users browsing this forum: Google [Bot] and 1 guest