Wrote the partition table thinking I'd fix it...

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Wrote the partition table thinking I'd fix it...

#11 Post by Fiona »

There are some little things to watch!
Exfat appears as a NTFS-partition but the file system is formatted as exfat.
TestDisk will only display a NTFS-partition and running on GPT as MS Data.
You should mark each MS Data partition and check the bottom of the display.
Example:
exfat.png
exfat.png (80.25 KiB) Viewed 2387 times
It's an NTFS partition ( because it's Intel MBR and not GPT, under GPT it's MS Data).
At the bootom of the screen you can watch it as an exfat-boot sector.
It's a tip to locate exfat better!

Fiona
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Wrote the partition table thinking I'd fix it...

#12 Post by tomtailford »

I don't understand your reply (sorry!)

The disc used is a GRAID - which was formatted using a MacBook Pro and is exfat.

So I selected Intel/PC Partition (although it detected EFI GPT) and now I get this:
goodnews.PNG
goodnews.PNG (82.26 KiB) Viewed 2373 times
Is this good news?? Here's the log - any advice what to do next? THANKS FIONA!

Code: Select all

Tue Dec  1 20:43:27 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=8001490518016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=8001490518016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=206158430208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=246994173952
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1500301908992
Hard disk list
Disk /dev/sda - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk /dev/sdc - 8001 GB / 7451 GiB - CHS 972792 255 63, sector size=512
Drive C: - 206 GB / 192 GiB - CHS 25064 255 63, sector size=512
Drive D: - 246 GB / 230 GiB - CHS 30028 255 63, sector size=512
Drive G: - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdc - 8001 GB / 7451 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 8001 GB / 7451 GiB - CHS 972792 255 63
Geometry from i386 MBR: head=1 sector=1
BAD_RS LBA=1 16065
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Bad relative sector.
No partition is bootable

search_part()
Disk /dev/sdc - 8001 GB / 7451 GiB - CHS 972792 255 63
file_pread(6,1,buffer,2743009280(972792/122/3)) ReadFile The drive cannot find the sector requested.

file_pread(6,14,buffer,2743009281(972792/122/4)) lseek err Invalid argument
file_pread(6,3,buffer,2743009295(972792/122/18)) lseek err Invalid argument
file_pread(6,3,buffer,2743009342(972792/123/2)) lseek err Invalid argument
file_pread(6,8,buffer,2743009358(972792/123/18)) lseek err Invalid argument
file_pread(6,11,buffer,2743009405(972792/124/2)) lseek err Invalid argument
file_pread(6,2,buffer,2743011327(972792/154/34)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdc - 8001 GB / 7451 GiB - CHS 972792 255 63
NTFS at 16/113/34
filesystem size           2048000
sectors_per_cluster       8
mft_lcn                   85333
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
     HPFS - NTFS             25 159  7 972792  89 33 15627497472
     exFAT, blocksize=262144, 8001 GB / 7451 GiB
file_pread(6,2,buffer,2743009280(972792/122/3)) ReadFile The drive cannot find the sector requested.

file_pread(6,1,buffer,2743009280(972792/122/3)) ReadFile The drive cannot find the sector requested.

file_pread(6,2,buffer,2743009310(972792/122/33)) lseek err Invalid argument
file_pread(6,1,buffer,2743009310(972792/122/33)) lseek err Invalid argument
file_pread(6,2,buffer,2743009343(972792/123/3)) lseek err Invalid argument
file_pread(6,1,buffer,2743009343(972792/123/3)) lseek err Invalid argument
file_pread(6,2,buffer,2743009373(972792/123/33)) lseek err Invalid argument
file_pread(6,1,buffer,2743009373(972792/123/33)) lseek err Invalid argument
file_pread(6,1,buffer,2743009280(972792/122/3)) ReadFile The drive cannot find the sector requested.

file_pread(6,14,buffer,2743009281(972792/122/4)) lseek err Invalid argument
file_pread(6,3,buffer,2743009295(972792/122/18)) lseek err Invalid argument
file_pread(6,3,buffer,2743009342(972792/123/2)) lseek err Invalid argument
file_pread(6,8,buffer,2743009358(972792/123/18)) lseek err Invalid argument
file_pread(6,11,buffer,2743009405(972792/124/2)) lseek err Invalid argument
file_pread(6,2,buffer,2743011327(972792/154/34)) lseek err Invalid argument
Search for partition aborted

Results
     HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
     HPFS - NTFS             25 159  7 972792  89 33 15627497472
     exFAT, blocksize=262144, 8001 GB / 7451 GiB
SIGINT detected! TestDisk has been killed.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Wrote the partition table thinking I'd fix it...

#13 Post by Fiona »

Sry that you didn't understand it!
Will make an effort to guide you through.
On your picture, the second partition ist exFAT.
Did you select it and were you pressing p to have a try to list your files?
You should select this partition:
HPFS - NTFS 25 159 7 972792 89 33 15627497472
You can watch it here:
Results
HPFS - NTFS 16 113 34 143 236 29 2048000
NTFS, blocksize=4096, 1048 MB / 1000 MiB
HPFS - NTFS 25 159 7 972792 89 33 15627497472
exFAT, blocksize=262144, 8001 GB / 7451 GiB
Please let me know, can you list your files?
Info will follow.

Fiona
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Wrote the partition table thinking I'd fix it...

#14 Post by tomtailford »

Now it won't show that partition any more... from a quickscan I got:
quickscanresults
quickscanresults
quickscan.PNG (30.06 KiB) Viewed 2353 times
Another thing you might want to know... when a mac formats an exfat drive it says this in windows:
mac_exfat_format.PNG
mac_exfat_format.PNG (29.32 KiB) Viewed 2353 times
Attempting to list files on this partition does this:
quickscanresults
quickscanresults
quickscan.PNG (30.06 KiB) Viewed 2353 times
There is no option for list files on other partition.

Confused!
Attachments
listfiles.PNG
listfiles.PNG (17.25 KiB) Viewed 2353 times
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Wrote the partition table thinking I'd fix it...

#15 Post by tomtailford »

I did create a backup (I think) and am able to load this - would you do this?
loadbackup.PNG
loadbackup.PNG (24.5 KiB) Viewed 2353 times
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Wrote the partition table thinking I'd fix it...

#16 Post by tomtailford »

So you know... this is what originally happened:

RAID 8TB (2x4TB striped raid) - EXFAT - showing up as RAW in windows / not showing partition in mac (only device)

Testdisk detects EFI GPT partition

Analysed - showed correct partition name (Chimp)
List files - showed all my files
Backup - saved current pariton list (not sure where I can find this on my MacBookPro?)
Wrote partition structure to disk (thinking it would fix)
List files - "support for this filesystem hasn't been implemented"
Says MacHFS? (Confusing as 99% sure it was exfat)
Backup - saved current partition list as follows:

Code: Select all

#1447360813 Disk /dev/sdc - 8001 GB / 7451 GiB - CHS 972792 255 63
 1 : start=       40, size=   409600, Id=00, P
 2 : start=   409640, size=2742337456, Id=00, P
Please tell me I've not royally screwed myself :/
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Wrote the partition table thinking I'd fix it...

#17 Post by tomtailford »

Sorry, any ideas on this - have I crashed my raid?

Will I be able to recover? The files were visible before I wrote my partition table :(
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Wrote the partition table thinking I'd fix it...

#18 Post by tomtailford »

Any ideas on this please?

Sorry to bring up this old post but I've still got this drive sitting in my drawer and hoping for it to be recovered.

Is there any other ways of recovering this data?
Top
Locked

Return to “Partition Recovery”