cgsecurity.org

Hello

I hope I am not asking questions asked many times before but I was not able to find any.

I had booted from a CD using SystemResueCD and was attempting to see / learn how to use GParted to partition a disk.

The computer I was using had two approx 100GB drives, the "Drive 1" was partitioned about 50 - 50 with 2.49 unallocated and booted into windows XP. "Drive 2" was partitioned approx 96 GB and 3.99 GB. To the best of my knowledge I was poking around with "Drive 2" and the only thing I can recall where I may have caused a problem was presing F5 and F6 at one of the windows. I believe the only way I saw I could leave SystemResueCD was to push the power off button.

Attempts to boot back into XP gave a mising OS. I found "Drive 1" was now partitioned approx 3.99Gb, 80 Gb and 16
unallocated.

I used TestDisk and got to the point of doing a Deeper Search and got a display showing (typed - not screen dump):
---------------------------------------------------------------------------
TestDisk 6.13. Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www:cgsecurity.org
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63
Partition Start End Size in sectors
D HPFS - NTFS 0 1 1 7264 254 63 117226242
D FAT16 < 32M 2363 0 1 2364 254 63 32130 [-VPSGHBOOT-]
D FAT16 < 32M 7260 0 1 7260 254 63 16065 [-VPSGHBOOT-]
D FAT16 < 32M 7290 0 1 7291 254 63 32130 [-VPSGHBOOT-]
* HPFS - NTFS 7297 0 1 14592 254 63 11721040

Structure ok. Use up/down arrow keys TO select partition.
Use left/right Arrow keys to CHANGE partition characteristics:
*=Primary Bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P list files.
Enter to continue
------------------------------------------------------------------------
Using the up/down arrow keys - top to bottom I get: NTFS, 60 Gb / 55 GiB; FAT16, 16MB / 15 MB; FAT16, 8225 KB / 8032 KiB; FAT16, 16MB / 15 MB and NTFS, 60 Gb / 55 GiB.

Using "p" shows valid filenames. My concern is that there is no indication of "Partition 1" etc show on the right column as on the example in the documentation. I don't know the next step.

I would appreciate advice.

John

PS I have not shut the computer down since reahing this point.

Did you after Deeper Search check your first partition pressing p?
It overlaps with your second found partition [-VPSGHBOOT-].
Only one partition is recoverable.
2 partitions can't use the same space.
I assume your first one.
This partition would match also;
D FAT16 < 32M 7290 0 1 7291 254 63 32130 [-VPSGHBOOT-]
Do you have any need for and does it list any data?
This partition is already st for recovery as primary and active/bootable.

Please let me know which partitions do you need and your data must be listed.
Otherwise it would look like your file system is damaged.

Please let me know which partition to recover.

Fiona

Hi Fiona

Thank you for your response.

'P" shows files in all of the Partitions displayed.

I had a bright idea. On this drive I had a Virtual Machine that booted Win 2000 which was created using Ghost. Actually I believe I had more than one instance of this. This might be the -VPSGHBOOT- entries. I do not care if they are lost.

I thought they were on the 2nd of the two partitions with XP on the 1st.

Of the two NTFS partitions the top one has many more files and certainly looks like it contains the Windows files.

Would you suggest marking it with the " * " and the others with "D" ?

John

A little more exploring and there is little doubt to me that the first partition shown " HPFS - NFTS 0 1 1 7296 254 63 117226242" is the Partition 1 on the drive. I can see Program Files, Documents and Settings etc

The 5th parttion shown I have to assume is the second partition on the drive. It starts one sector later i.e. 7297 and has a similar number - 11721040

Thus my gut feeling is to mark the 1st with an asterisk " * " the 5th with a "P" and 2,3 and 5 with a "D".

John

Ooops I noted a typo? in my original post on the End sector of the 1st partition listed. It should be 7296.

i.e.
D HPFS - NTFS 0 1 1 7296 254 63 117226242

Also in my previous post i said I was contemplating leaving a "D' alongside the 2nd, 3rd and 5th. 5th should have been 4th.

My dilemma is whether to mark the 5th as a Primary partition or a Logical partition or?

Thanks

John

Please let me know, do you want to recover both NTFS-partitions?
You wrote the first partition contains your windows and data are listed also?
Then it should be bootable.
Please let me know.

Fiona

Thanks again Fiona

Yes I would like to recover both NTFS partitions.

The 1st one listed looks like the Windows XP system with data.
D HPFS - NTFS 0 1 1 7296 254 63 117226242

The 5th listed is not as important to me.
D HPFS - NTFS 7297 0 1 14592 254 63 117210240

John

Shall I set it up like this and Press Enter ?

* HPFS - NTFS 0 1 1 7296 254 63 117226242
D FAT16 < 32M 2363 0 1 2364 254 63 32130 [-VPSGHBOOT-]
D FAT16 < 32M 7260 0 1 7260 254 63 16065 [-VPSGHBOOT-]
D FAT16 < 32M 7290 0 1 7291 254 63 32130 [-VPSGHBOOT-]
P HPFS - NTFS 7297 0 1 14592 254 63 11721040

John

I pressed Enter, then Write with the 1st line as * , 2nd, 3rd and 4th as D and the 5th as P.

Much to my surprise it doesn't boot into XP. Freezes with a blue screen with the windows XP logo

Re-running - TestDisk Deeper Search - N - Vista gives the same as the original

D HPFS - NTFS 0 1 1 7296 254 63 117226242
D FAT16 < 32M 2363 0 1 2364 254 63 32130 [-VPSGHBOOT-]
D FAT16 < 32M 7260 0 1 7260 254 63 16065 [-VPSGHBOOT-]
D FAT16 < 32M 7290 0 1 7291 254 63 32130 [-VPSGHBOOT-]
* HPFS - NTFS 7297 0 1 14592 254 63 11721040

"p" will list files in all selections

There are many more files dsplayed from the 1st line -
D HPFS - NTFS 0 1 1 7296 254 63 117226242

Windows, My programs etc. It looks like it is the bootable partition.

Is there any hope ??

John
]

I have delayed attempts to get XP to boot without further directions but decided to try with the * on the 2nd

partition.

Did another analyze and again it comes up with the * alongside:
* HPFS - NTFS 7297 0 1 14592 254 63 11721040

It does not look like the boot drive - there are many more files on:
P HPFS - NTFS 0 1 1 7296 254 63 117226242

The "D"s still alongside the [-VPSGHBOOT-]

I did a Write without chnaging anything.
Booting gives NTLDR is missing

I went back for another look and I went to { Advanced } Filesystem Utils. This seems to be telling me that both

filesystems are the same. Back to Analyse with the intent of changing the 2nd partition to Logical for a try. However the only options are *, D or P. I left it as P and rebooted

Re-Boot still goes to a screen with blue in the center with the Windows XP logo with a darker blue border top and bottom.

In the beginning there was 3.99 Gb of Unallocated space. Should this show up with analyse.?

It seems the only way to get the SystemRescueCD out is by using a paper clip. Eject doesn't work shutdown now gets me dwn the ladder a bit but the power off button seesm to be required for a complte shutdown.

Any and all suggestions greatly appreciated

John