partition missing after borked copying

How to use TestDisk to recover lost partition
Post Reply
Message
Author
i4004
Posts: 1
Joined: 10 Oct 2015, 22:06

partition missing after borked copying

#1 Post by i4004 » 11 Oct 2015, 17:41

and oh yeah, NTFS filesystem is messed too.

was (paradoxically) making some backup to the external disk, but that disk also has some things that are not backed up, so by doing backup in such a way i messed the drive i was making backup to. :shock:

anyhow, was copying files via total commander, then power cut occurs, but that doesn't matter as i'm on UPS.
however, i put the pc to stby (as i usually do when power goes off) WHILE COPYING, and then i turn off the external drive (which goes to slep anyway because pc is in stby (sleep) mode).
after power comes on, i continue, and i'm bit surprised to see total commander is continuing to copy file, with no warnings etc.
but it wasn't ment to be! short while later i get "disk full" prompt from total commander, even though i'm pretty sure disk cannot be full because there was more free space than the stuff i was copying.
short while after that i notice folder i was copying to is now actually empty, i also notice windows says filesystem is corrupt ("Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 9.10.2015
Time: 2:52:30
User: N/A
Computer: ASUS
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume G:." ) and then it all goes south fast.

few moments later it's not just empty folder, but the whole disk is gone, ie only the letter G is still there, disk lost it's name and it became "unformatted". now showing as "raw".
(but apparently more raw than the last time i lost NTFS when easeUS partition master saved me, because now easeUS doesn't see any partition)

now first one question and the log (i don't see much difference between analyze and deep search anyway so here's analyze).

if testdisk doesn't list all files (i repeat, all files) is it safe to do re-writing of partition table?
because all i have visible is one file and few folders, which is not even a fraction of the disk previous contents.

no, i didn't write anything to the disk because i don't know answer to that question but i think it's "not, it's not safe".

here's the log (i wonder why one can't attach it straight as attachment):


Code: Select all

Sun Oct 11 03:01:43 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP2
Compiler: GCC 4.9, Cygwin 2002.0
Compilation date: 2015-10-02T11:09:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=40020664320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=40020664320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=5017388544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=120031478784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=34998534144
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000202241024
Hard disk list
Disk /dev/sda - 40 GB / 37 GiB - CHS 4865 255 63, sector size=512 - ST340014A, S/N:4a3547585947574b202020202020202020202020, FW:8.01
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-00UD2A0, FW:01.01A01
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-07A7B0, FW:01.03B01
Disk /dev/sdd - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST312002 6A, FW:8.54
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA Hitachi HDP72505, FW:A52A

Partition table type (auto): Intel
Disk /dev/sdc - 500 GB / 465 GiB - WDC WD5000AAKS-07A7B0
Partition table type: Intel

Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   1  1 60800 254 63  976768002
 1 P HPFS - NTFS              0   1  1 60800 254 63  976768002
No partition is bootable

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
BAD_RS LBA=1170585552 1595234
file_pread(6,3,buffer,1170585552(72865/148/4)) lseek err Invalid argument
file_pread(6,1,buffer,1170585552(72865/148/4)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
     FAT16 <32M           72865 148  4 104945  67 36  515360130
This partition ends after the disk limits. (start=1170585552, size=515360130, end=1685945681, disk end=976773168)
NTFS at 60800/254/63
filesystem size           976768002
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               61048000
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 60800 254 63  976768002
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size           976768002
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               61048000
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          60800 254 63 121601 253 62  976768002
     NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976768002, end=1953536065, disk end=976773168)
file_pread(6,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(6,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(6,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(6,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(6,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(6,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(6,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(6,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(6,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(6,5,buffer,976773186(60801/81/19)) lseek err Invalid argument
file_pread(6,8,buffer,976773311(60801/83/18)) lseek err Invalid argument
file_pread(6,8,buffer,976773439(60801/85/20)) lseek err Invalid argument
file_pread(6,8,buffer,976773567(60801/87/22)) lseek err Invalid argument
file_pread(6,8,buffer,976773695(60801/89/24)) lseek err Invalid argument
file_pread(6,8,buffer,976773823(60801/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,976773951(60801/93/28)) lseek err Invalid argument
file_pread(6,8,buffer,976774079(60801/95/30)) lseek err Invalid argument
file_pread(6,8,buffer,976774207(60801/97/32)) lseek err Invalid argument
file_pread(6,8,buffer,976774335(60801/99/34)) lseek err Invalid argument
file_pread(6,8,buffer,976774463(60801/101/36)) lseek err Invalid argument
file_pread(6,8,buffer,976774591(60801/103/38)) lseek err Invalid argument
file_pread(6,8,buffer,976774719(60801/105/40)) lseek err Invalid argument
file_pread(6,8,buffer,976774847(60801/107/42)) lseek err Invalid argument
file_pread(6,8,buffer,976774975(60801/109/44)) lseek err Invalid argument
file_pread(6,8,buffer,976775103(60801/111/46)) lseek err Invalid argument
file_pread(6,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(6,14,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(6,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(6,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(6,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(6,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(6,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partitions can't be recovered:
     HPFS - NTFS          60800 254 63 121601 253 62  976768002
     NTFS, blocksize=4096, 500 GB / 465 GiB
     FAT16 <32M           72865 148  4 104945  67 36  515360130
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0   1  1 60800 254 63  976768002
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS filesystem need to be repaired.


dir_partition inode=5
   * HPFS - NTFS              0   1  1 60800 254 63  976768002
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0  8-Oct-2015 23:59 .
       5 dr-xr-xr-x     0      0         0  8-Oct-2015 23:59 ..
      40 -r--r--r--     0      0 357780596 22-Nov-2008 04:22 VHS_panacap_sony180vg_porn&blowout_.avi

interface_write()
 1 * HPFS - NTFS              0   1  1 60800 254 63  976768002
Failed to startup volume: Invalid argument.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
 1 P HPFS - NTFS              0   1  1 60800 254 63  976768002
Not an exFAT boot sector.

 1 P HPFS - NTFS              0   1  1 60800 254 63  976768002
Can't open filesystem. Filesystem seems damaged.

TestDisk exited normally.
Attachments
testdisk3_2015-10-11_070856.png
testdisk3_2015-10-11_070856.png (7.26 KiB) Viewed 234 times
testdisk2_2015-10-11_070808.png
testdisk2_2015-10-11_070808.png (7.01 KiB) Viewed 234 times
testdisk1_2015-10-11_030228.png
testdisk1_2015-10-11_030228.png (6.59 KiB) Viewed 234 times

Sponsored links

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests