Disk not readable after Swapping

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Heuchi95
Posts: 3
Joined: 09 Jan 2016, 14:02

Disk not readable after Swapping

#1 Post by Heuchi95 »

I build myself a new PC and used the HDD's from my old one, so long everything worked except one drive which contains the backup of my old C drive :oops:

I tried analyzing it with Testdisk and after I got the

Code: Select all

warning: number of heads/cylinders 240 (NTFS) != 255 (HD)
while scanning I'm now at the state where its telling me the harddisk is to small. I tried listing the files of the found partition but they won't show.

This is the current state of TestDisk
Image

Any ideas what to do next?
Top
User avatar
cgrenier
Site Admin
Posts: 5440
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Disk not readable after Swapping

#2 Post by cgrenier »

Can you copy and paste the testdisk.log file content ?
Top
Heuchi95
Posts: 3
Joined: 09 Jan 2016, 14:02

Re: Disk not readable after Swapping

#3 Post by Heuchi95 »

Code: Select all


Fri Jan 08 16:40:14 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=63496519680
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=375703732224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=624497262592
Hard disk list
Disk \\.\PhysicalDrive0 - 64 GB / 59 GiB - CHS 124053 16 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 63 GB / 59 GiB - CHS 123032 16 63, sector size=512
Drive H: - 375 GB / 349 GiB - CHS 45676 255 63, sector size=512
Drive I: - 624 GB / 581 GiB - CHS 75924 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=240 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P W2K Dynamic/SFS          0   1  1 60801  48 31  976771057
No partition is bootable

search_part()
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 31870/166/41
heads/cylinder 240 (NTFS) != 255 (HD)
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          31870 166 41 92671 149 22  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=512002048, size=976766976, end=1488769023, disk end=976773168)
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 762 GB / 709 GiB)
The following partition can't be recovered:
     HPFS - NTFS          31870 166 41 92671 149 22  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()
 
No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Here is the Log
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Disk not readable after Swapping

#4 Post by Fiona »

Did you use TestDisk 64bit?
TestDisk 64bit is only intended on genuine 64bit computer like Itanium, as some features are missing.
As long as you've a normal computer and you can run 32bit programs, TestDisk 7.1WIP 32bit is recommended.
Can you in case repeat your diagnose and under disk selection, can you select Disk /dev/sd* (*= a, b, c, etc..) instead of your PhysicalDrive and copy and paste the content of your log again?
Currently your disk is diplayed as dynamically and testdisk can convert it back to Intel MBR.
Run another diagnose through Analyse, Quick Search and if your partition is not found Deeper Search also.

Fiona
Top
Heuchi95
Posts: 3
Joined: 09 Jan 2016, 14:02

Re: Disk not readable after Swapping

#5 Post by Heuchi95 »

Ok, I used the 7.0 32 Bit version and it found the partition through deeper search. I'm now where I was before.

What should be the next move?
testDiskScreen2.png
testDiskScreen2.png (16.38 KiB) Viewed 3343 times
testDiskScreen2.png
testDiskScreen2.png (16.38 KiB) Viewed 3343 times
Here is the Log:

Code: Select all


Mon Jan 11 12:24:56 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=2002780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2002780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=63496519680
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000204845056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2002780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000200994816
Hard disk list
Disk /dev/sda - 64 GB / 59 GiB - CHS 124053 16 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sde - 2002 MB / 1910 MiB - CHS 243 255 63, sector size=512
Drive C: - 63 GB / 59 GiB - CHS 123032 16 63, sector size=512
Drive E: - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive I: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=240 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P W2K Dynamic/SFS          0   1  1 60801  48 31  976771057
No partition is bootable

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 31870/166/41
heads/cylinder 240 (NTFS) != 255 (HD)
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          31870 166 41 92671 149 22  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=512002048, size=976766976, end=1488769023, disk end=976773168)
file_pread(6,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(6,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(6,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(6,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(6,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(6,13,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(6,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(6,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(6,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(6,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(6,2,buffer,976777215(60801/145/16)) lseek err Invalid argument
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 762 GB / 709 GiB)
The following partition can't be recovered:
     HPFS - NTFS          31870 166 41 92671 149 22  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB

Results

interface_write()
 
No partition found or selected for recovery
Attachments
testDiskScreen3.png
testDiskScreen3.png (21.31 KiB) Viewed 3343 times
Top
Locked

Return to “Partition Recovery”