Help! Another noob in the Forum

[wutizup]

Hi everyone i am trying to get assistance on using this program. I read the basic manual but i am just not that bright, sorry if you answer these questions all the time.

My laptop crashed and i took out the hard drive and plugged it in my desktop so i can recover important files that i need. I tried searching for the files with Photorec but all i get is hundreds of folders and i cant seem to find the word documents that i am looking for. All i get is a bunch of files that wont open in word, so i am here now trying out TestDisk but i am currently stuck not knowing what to do next.

Here is the drive i am trying to work on:
http://gdurl.com/g8xsY
All drives circle are one drive and the partition that is very important to me is H: were the OS and my files are installed.
So i ran Tesdisk in the following manner:
First i selected my drive. http://gdurl.com/4ho4
Second i selected Intel/Pc as my partition: http://gdurl.com/DlXZ
Third i selected analyse. http://gdurl.com/ZSd7
Forth i clicked on quick search. http://gdurl.com/HGFh
after quick search i was introduce with this http://gdurl.com/2SKe
then i changed it to this http://gdurl.com/tlKf I am not sure if that is correct, but i did not hit WRITE
instead i did a deeper search http://gdurl.com/oRsj
it then started running for about an hour+ http://gdurl.com/XQim
once it was done i got to this part http://gdurl.com/1hy1 so i hit continue
and then i am stuck here http://gdurl.com/mbHG So i dont know what to do next

all i really want is to get into partition H: of the drive so i can retrieve all my documents that i need. Please let me know if this is possible with this software and if so please show me how. Thanks in advance for any help provided.

[Fiona]

As far as I've seen, your partitions are already in your partition table.
Can you run TestDisk again and confirm at the menu "Advanced instead of Analyse?
Select your affected partition and confirm at Boot.
Can you upload another snapshot?
When the menu List would be available, select it and press enter to have a try to list your data.
Please let me know, did you see your data or a message that your file system is damaged?

Fiona

[wutizup]

As far as I've seen, your partitions are already in your partition table.
Can you run TestDisk again and confirm at the menu "Advanced instead of Analyse?
Select your affected partition and confirm at Boot.
Can you upload another snapshot?
When the menu List would be available, select it and press enter to have a try to list your data.
Please let me know, did you see your data or a message that your file system is damaged?

Fiona

Thank You so much for taking the time, i am not sure what you mean by "confirm at Boot but i will now post some snapshots.

Selecting advance : http://gdurl.com/qrc2
Selecting Problem Drive: http://gdurl.com/kpYt
and the list : http://gdurl.com/jZke

So again i am not sure what you mean by "confirm at Boot"

[Fiona]

The next menu at the left of List is the menu Boot.
You can easily mark it and pressing enter will open it.
Can you upload another snapshot?
As fas as I've seen, chkdsk was already running and created a folder called found000.
So it might be possible that some files are changed?
Info about folder found000 abd chk-files:
https://www.raymond.cc/blog/how-to-reco ... -scandisk/

Can your run another diagnose TestDisk / Advanced / Boot and copy and paste the content of your testdisk.log into your next post?
You'll find it within your testdisk folder.
You can use wordpad to open it.

Fiona

[wutizup]

The next menu at the left of List is the menu Boot.
You can easily mark it and pressing enter will open it.
Can you upload another snapshot?
As fas as I've seen, chkdsk was already running and created a folder called found000.
So it might be possible that some files are changed?
Info about folder found000 abd chk-files:
https://www.raymond.cc/blog/how-to-reco ... -scandisk/

Can your run another diagnose TestDisk / Advanced / Boot and copy and paste the content of your testdisk.log into your next post?
You'll find it within your testdisk folder.
You can use wordpad to open it.

Fiona

Here is the image of the boot folder, it will be in 2 parts because i had to scroll down.
http://gdurl.com/U3Rx
http://gdurl.com/iCtJ

i will post the log on on my next post.

[wutizup]

Can your run another diagnose TestDisk / Advanced / Boot and copy and paste the content of your testdisk.log into your next post?
You'll find it within your testdisk folder.
You can use wordpad to open it.

Fiona

question when you say Diagnose, do you mean Analyze? and then do a Deep Search? because i cant find the word diagnose in TestDisk/ advance / boot

[wutizup]

ok here i will post the log file of the option to analyze and deep search:
i will also post a link to the file HERE in case you need to download it.

Code: Select all

Wed Jan 13 20:20:47 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319231623168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1500299395072
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=208666624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=300078333952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=15523119104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=4260716544
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive C: - 319 GB / 297 GiB - CHS 38811 255 63, sector size=512
Drive D: - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Drive G: - 208 MB / 199 MiB - CHS 25 255 63, sector size=512
Drive H: - 300 GB / 279 GiB - CHS 36482 255 63, sector size=512
Drive I: - 15 GB / 14 GiB - CHS 1887 255 63, sector size=512
Drive J: - 4260 MB / 4063 MiB - CHS 518 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 320 GB / 298 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 25/126/38
NTFS at 36507/240/22
FAT32 at 38395/47/53
Info: size boot_sector 8321712, partition 8321712
FAT1 : 162-8272
FAT2 : 8273-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-8321711
sectors : 8321712
cluster_size : 8
no_of_cluster : 1038166 (2 - 1038167)
fat_length 8111 calculated 8111
Current partition structure:
 1 * HPFS - NTFS              0  32 33    25 126 37     407552
 2 P HPFS - NTFS             25 126 38 36507 240 21  586090496
 3 P HPFS - NTFS          36507 240 22 38395  47 52   30318592
 4 P FAT32 LBA            38395  47 53 38913  48 31    8321712 [HP_TOOLS]

search_part()
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 0/32/33
filesystem size           407552
sectors_per_cluster       8
mft_lcn                   16981
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    25 126 37     407552
     NTFS, blocksize=4096, 208 MB / 199 MiB
NTFS at 25/126/38
filesystem size           586090496
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             25 126 38 36507 240 21  586090496
     NTFS, blocksize=4096, 300 GB / 279 GiB
NTFS at 36507/240/22
filesystem size           30318592
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          36507 240 22 38395  47 52   30318592
     NTFS, blocksize=4096, 15 GB / 14 GiB
FAT32 at 38395/47/53
FAT1 : 162-8272
FAT2 : 8273-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-8321711
sectors : 8321712
cluster_size : 8
no_of_cluster : 1038166 (2 - 1038167)
fat_length 8111 calculated 8111

FAT32 at 38395/47/53
     FAT32 LBA            38395  47 53 38913  48 31    8321712 [HP_TOOLS]
     FAT32, blocksize=4096, 4260 MB / 4063 MiB
file_pread(6,2,buffer,625142448(38913/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,625142448(38913/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(6,2,buffer,625142480(38913/81/33)) lseek err Invalid argument
file_pread(6,1,buffer,625142480(38913/81/33)) lseek err Invalid argument
file_pread(6,2,buffer,625142511(38913/82/1)) lseek err Invalid argument
file_pread(6,1,buffer,625142511(38913/82/1)) lseek err Invalid argument
file_pread(6,2,buffer,625142543(38913/82/33)) lseek err Invalid argument
file_pread(6,1,buffer,625142543(38913/82/33)) lseek err Invalid argument
file_pread(6,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,625142528(38913/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,625142528(38913/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,625142656(38913/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,625142784(38913/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,625142912(38913/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,625143040(38913/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,625143168(38913/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,625143296(38913/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,625143424(38913/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,625143552(38913/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,625143680(38913/100/36)) lseek err Invalid argument
file_pread(6,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,625145855(38913/135/6)) lseek err Invalid argument

Results
     HPFS - NTFS              0  32 33    25 126 37     407552
     NTFS, blocksize=4096, 208 MB / 199 MiB
     HPFS - NTFS             25 126 38 36507 240 21  586090496
     NTFS, blocksize=4096, 300 GB / 279 GiB
     HPFS - NTFS          36507 240 22 38395  47 52   30318592
     NTFS, blocksize=4096, 15 GB / 14 GiB
     FAT32 LBA            38395  47 53 38913  70  5    8323072 [HP_TOOLS]
     FAT32, blocksize=4096, 4261 MB / 4064 MiB

interface_write()
 
No partition found or selected for recovery

[Fiona]

For a better understanding.
I always make a diagnose first and watch the results, that's why the word diagnose is in testdisk not available.
I assume that your boot partition is correct, and only your second partition is the affected one.
The testdisk menu Boot is only intended to repair a boot sector.
All NTFS and FAT-partitions have a boot sector.
The boot sector is the first sector of a partition.
When the boot sector is not valid or damaged, your partition appears as unformatted (as RAW) and you can't access any data.
Under Advanced, can you select your affected partition (should be the second one) and mark the menu Boot and press enter?
TestDisk will display tha status of your boot sector and its backup.
Can you upload another snapshot?
As far as I've seen, chkdsk was already running and created a folder found000.
That's why it'd be possible that your windows got already modified and doesn't work anymore?
In case, I'd suggest to copy your important data off of your windows partition (like pictures, documents, music etc..).
When you use the menu List, at the bottom of the display you'll find all the commands to copy your data.
To copy a specific folder like Pictures, you can have a look for a folder like user.
You can enter it, through selecting the folder and using the right arrow key on your keyboard to enter it.
You should have a look for a folder with your username and enter it too.
There you can select your folder which you'd like to copy using the copy commands.
To start the copying process you can press C for example.
Standard path will be the testdisk folder.
If you'd like to copy your data to another healthy disk or partition:
When you select these 2 dots in the upper area of the display and pressing enter, each time you'll get 1 directory up until you get to your disk/drive selection.
There, you can select another disk or partition to copy your data to.
After chkdsk, when your boot sector and file system is Ok and windows doesn´t boot, it might be possible to run a windows repair or reinstall it.
Info will follow.

Fiona