Deleted VHD partition

[chrispret]

I deleted the partition on a VHD by mistake and I'm trying to use TestDisk to restore it.

When I scanned it as an Intel type it comes back saying 'No partition is bootable'. Running a quick scan yields no partition to try and recover.

Next I scanned it as type None and it found the partition, but won't let me write it. I can view the files, directories and all seems ok.

Then I scanned it as type 'EFI GPT' and it at first states: 'Bad GPT Partition, invalid signature'. Then I did a Quick Search and it finds a partition, I can view the directories and all that.

That said, the partition info is not the same as it found on 'None'. I suspect that the info is probably right, but I don't want to mess it up by assuming...

Is there any way to check?

[cgrenier]

Please post the testdisk.log file content.

[chrispret]

See below, I had to cut out a bunch of 'lseek err' entries (like the one below) to keep the size down, else the file is too big.
file_pread(5,1,buffer,945026006(58825/37/51)) lseek err Invalid argument

The VHD file is on a NAS drive that has minor communication issues, not sure if that is contributing to the lseek err entries.

I also cut out parts of the directory listing, but that's just because I'm being neurotic about people seeing my directory structure. Please do laugh if you feel like it

When you see: ***************************** know that I cut out either option above.



Tue Feb 9 16:05:31 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=483853271040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=483853271040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=225121927168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=137437904896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=137438953472
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63, sector size=512
Drive C: - 225 GB / 209 GiB - CHS 27369 255 63, sector size=512
Drive D: - 137 GB / 127 GiB - CHS 16709 255 63, sector size=512
Drive E: - 137 GB / 128 GiB - CHS 16709 255 63, sector size=512

Partition table type default to Intel
Disk /dev/sdc - 483 GB / 450 GiB
Partition table type: None

Analyse Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
Current partition structure:
P Unknown 0 0 1 58825 36 27 945025920

search_part()
Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=65536, part_size=483852812288, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 2 3 58825 24 15 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
file_pread(5,2,buffer,945027200(58825/56/48)) lseek err Invalid argument
file_pread(5,1,buffer,945027200(58825/56/48)) lseek err Invalid argument
*********************
file_pread(5,1,buffer,945025985(58825/37/30)) lseek err Invalid argument
file_pread(5,1,buffer,945026006(58825/37/51)) lseek err Invalid argument
file_pread(5,1,buffer,945026056(58825/38/38)) lseek err Invalid argument
file_pread(5,1,buffer,945027969(58825/68/61)) lseek err Invalid argument

Results
P NTFS 0 2 3 58825 24 15 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB


dir_partition inode=5
P NTFS 0 2 3 58825 24 15 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
Directory /
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 .
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 ..
35 dr-xr-xr-x 0 0 0 10-Jun-2013 10:07 $Recycle.Bin
*****************************
641 dr-xr-xr-x 0 0 0 24-Apr-2015 16:42 Windows


interface_write()
P NTFS 0 2 3 58825 24 15 945025024

Write isn't available because the partition table type "None" has been selected.
Partition table type default to Intel
Disk /dev/sdc - 483 GB / 450 GiB
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdc - 483 GB / 450 GiB - CHS 58825 255 63
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=65536, part_size=483852812288, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/2/3
filesystem size 945025024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 128 945025151 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
file_pread(5,2,buffer,945027200(58825/56/48)) lseek err Invalid argument
file_pread(5,1,buffer,945027200(58825/56/48)) lseek err Invalid argument
file_pread(5,2,buffer,945027201(58825/56/49)) lseek err Invalid argument
file_pread(5,1,buffer,945027203(58825/56/51)) lseek err Invalid argument
file_pread(5,1,buffer,945027204(58825/56/52)) lseek err Invalid argument
file_pread(5,1,buffer,945027205(58825/56/53)) lseek err Invalid argument
file_pread(5,1,buffer,945027206(58825/56/54)) lseek err Invalid argument
file_pread(5,1,buffer,945027207(58825/56/55)) lseek err Invalid argument
******************************
file_pread(5,8,buffer,945025998(58825/37/43)) lseek err Invalid argument
file_pread(5,11,buffer,945026045(58825/38/27)) lseek err Invalid argument
file_pread(5,1,buffer,945027968(58825/68/60)) lseek err Invalid argument
file_pread(5,7,buffer,945025921(58825/36/29)) lseek err Invalid argument
file_pread(5,8,buffer,945025928(58825/36/36)) lseek err Invalid argument
file_pread(5,1,buffer,945025938(58825/36/46)) lseek err Invalid argument
file_pread(5,1,buffer,945025985(58825/37/30)) lseek err Invalid argument
file_pread(5,1,buffer,945026006(58825/37/51)) lseek err Invalid argument
file_pread(5,1,buffer,945026056(58825/38/38)) lseek err Invalid argument
file_pread(5,1,buffer,945027969(58825/68/61)) lseek err Invalid argument

Results
P MS Data 128 945025151 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB


dir_partition inode=5
P MS Data 128 945025151 945025024
NTFS, blocksize=4096, 483 GB / 450 GiB
Directory /
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 .
5 dr-xr-xr-x 0 0 0 2-Feb-2016 03:47 ..
35 dr-xr-xr-x 0 0 0 10-Jun-2013 10:07 $Recycle.Bin
****************************
641 dr-xr-xr-x 0 0 0 24-Apr-2015 16:42 Windows

interface_write()
1 P MS Data 128 945025151 945025024
simulate write!

TestDisk exited normally.

[chrispret]

So I grew impatient (since no-one replied), copied the VDH to a new location and just wrote the 'EFI GPT' partition to the disk.

Everything seems ok, I guess this thread is dead