Damaged 1To HD

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
lythium
Posts: 12
Joined: 03 Mar 2012, 12:42

Re: Damaged 1To HD

#21 Post by lythium »

Sorry I was busy last days...

I can't plug the HDD internally (I own only laptops) and can't create image file as I don't have a large enough drive to hold the broken one data.

Thank you very much for your time but I think I'll suggest to my friend to buy a data recovery software and a brand new hard drive :)

Thanks again, it's a marvelous forum you have here !
yesoptus
Posts: 5
Joined: 29 Jun 2014, 15:21

Re: Damaged 1To HD

#22 Post by yesoptus »

Fiona wrote:Yes, do it and let it work.
Should normally take a couple of minutes!

If it's finished, you should see a menu List.
Please highlight it and press enter.
Do you see your required data or an error message?



H Fiona..
I am having similar issue on my western digital hard drive(500Gb).
The disk is connection to my windows 7 desktop through USB.
I followed all the steps :

Start TestDisk.
Proceed through at Create a log, select your affected disk, choose partition table type intel,
Don't confirm at Analyse but Advanced.
Confirm at Boot with enter also.


Output for this screen gave:
Boot sector
Status: Bad

Backup boot sector
Status: OK


After that I selected rebuild option and when finished, I should see a menu List.
I pressed enter for it and see my required data.
At the end it gives me options to:
change directory
hide alternate data stream
quit
select current file
select all files
copy selected files
copy current file.

I have send you the screenshot in your message box as I wasn't sure how to copy text from testdis_win screen

Please advise how to process from her?

Thanks
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Damaged 1To HD

#23 Post by Fiona »

If you get a message like this:
Output for this screen gave:
Boot sector
Status: Bad

Backup boot sector
Status: OK
It means that the backup of your boot secor is OK.
Have you been able to list your files without running "RebuildBS"?
If yes, you can repair your boot sector confirming at BackupBS.

Please let me know.

Fiona
yesoptus
Posts: 5
Joined: 29 Jun 2014, 15:21

Re: Damaged 1To HD

#24 Post by yesoptus »

Yes, I can list all files without running "RebuildBS".

I select [Backup BS] and then I get prompt to : copy backup boot sector over boot sector Y/N
I say Y
and get the message
write error: Can't overwrite NTFS boot sector
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Damaged 1To HD

#25 Post by Fiona »

Antivirus and other background processes can prevent testdisk from writing.
Could you disable it?
Also download the latest version from the homepage.
Please open the testdisk.log and copy and paste the content of your testdisk.log into your next post.
Did you execute testdisk with administrator privileges?
In case, rightclick testdisk_win.exe and open it using administrator privileges and repeat it.
If it doesn't work, run RebuildBS. list your files and have another try to write it.

Please copy the content of your testdisk.log, because I'd like to check your file system.

Fiona
yesoptus
Posts: 5
Joined: 29 Jun 2014, 15:21

Re: Damaged 1To HD

#26 Post by yesoptus »

Fiona wrote:Antivirus and other background processes can prevent testdisk from writing.
Could you disable it?
Also download the latest version from the homepage.
Please open the testdisk.log and copy and paste the content of your testdisk.log into your next post.
Did you execute testdisk with administrator privileges?
In case, rightclick testdisk_win.exe and open it using administrator privileges and repeat it.
If it doesn't work, run RebuildBS. list your files and have another try to write it.

Please copy the content of your testdisk.log, because I'd like to check your file system.

Fiona
I disabled antivirus(MSE) and using latest version (downloaded yesterday)
running with admin privileges.

I followed the steps and every time fives the same error
Can't overwrite NTFS boot sector

Can you please tell where to find the log file? so that I can share with you.

Thanks
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Damaged 1To HD

#27 Post by Fiona »

You'll find the testdisk.log file in your testdisk folder.
Might be possible that win7 doesn't display file extensions.
In cast, you only see testdisk.
You can try to open it using wordpad.

Fiona
yesoptus
Posts: 5
Joined: 29 Jun 2014, 15:21

Re: Damaged 1To HD

#28 Post by yesoptus »

you are correct. It is saved as testdisk

Here is the log info:

Mon Jun 30 11:17:49 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=37643878400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=52436140032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=99639296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=35124377600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=500000882688
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD1600AAJS-08L7A0, S/N:2020202057202d444d5756414132394d30313130, FW:03.03E03
Disk /dev/sdb - 500 GB / 465 GiB - CHS 229504 224 19, sector size=512 - WDC WD50 00AAKS-00UU3A0, S/N:801130168383
Drive E: - 99 MB / 95 MiB - CHS 23 64 32, sector size=2048 - Optiarc DVD RW AD-7230S, FW:1.D2

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - WDC WD50 00AAKS-00UU3A0
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 640
check_part_i386 failed for partition type 07
BAD_RS LBA=206848 55328
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 0 107 16 48 134 14 204800
2 P HPFS - NTFS 48 134 15 229504 107 15 976564224

ntfs_boot_sector
2 P HPFS - NTFS 48 134 15 229504 107 15 976564224
NTFS at 48/134/15
heads/cylinder 255 (NTFS) != 224 (HD)
sect/track 63 (NTFS) != 19 (HD)
filesystem size 1 976564224
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
ntfs_boot_sector: Can't read boot sector.
Status: Bad

Backup boot sector
Warning: number of heads/cylinder mismatches 255 (NTFS) != 224 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 19 (HD)
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(5,16,buffer,206849(48/134/16)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206849(48/134/16)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,206850(48/134/17)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206852(48/134/19)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206853(48/135/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206854(48/135/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206855(48/135/3)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206856(48/135/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206857(48/135/5)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206858(48/135/6)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206859(48/135/7)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206860(48/135/8)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206861(48/135/9)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206862(48/135/10)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206863(48/135/11)) ReadFile Data error (cyclic redundancy check).

mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
file_pread(5,16,buffer,206848(48/134/15)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206848(48/134/15)) ReadFile Data error (cyclic redundancy check).

create_ntfs_boot_sector: Can't read boot sector.
New / Current boot sector
filesystem size 976564224 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Extrapolated boot sector and current boot sector are different.
filesystem size 976564224 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Write new boot!
file_pwrite(5,1,buffer,206848(48/134/15)) write err Input/output error
Write error: Can't write new NTFS boot sector
file_pwrite(5,1,buffer,976771071(229504/107/15)) write err Input/output error
Write error: Can't write new NTFS backup boot sector

ntfs_boot_sector
2 P HPFS - NTFS 48 134 15 229504 107 15 976564224
file_pread(5,1,buffer,206848(48/134/15)) ReadFile Data error (cyclic redundancy check).

NTFS at 48/134/15
heads/cylinder 255 (NTFS) != 224 (HD)
sect/track 63 (NTFS) != 19 (HD)
filesystem size 1 976564224
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
ntfs_boot_sector: Can't read boot sector.
Status: Bad

Backup boot sector
Warning: number of heads/cylinder mismatches 255 (NTFS) != 224 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 19 (HD)
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector
file_pwrite(5,1,buffer,206848(48/134/15)) write err Input/output error
Write error: Can't overwrite NTFS boot sector

ntfs_boot_sector
2 P HPFS - NTFS 48 134 15 229504 107 15 976564224
file_pread(5,16,buffer,206848(48/134/15)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206848(48/134/15)) ReadFile Data error (cyclic redundancy check).

NTFS at 48/134/15
heads/cylinder 255 (NTFS) != 224 (HD)
sect/track 63 (NTFS) != 19 (HD)
filesystem size 1 976564224
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
ntfs_boot_sector: Can't read boot sector.
Status: Bad

Backup boot sector
Warning: number of heads/cylinder mismatches 255 (NTFS) != 224 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 19 (HD)
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Damaged 1To HD

#29 Post by Fiona »

Looks like your file system is slightly damaged.
You have some CRC errors.
Info;
file_pread(5,16,buffer,206849(48/134/16)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206849(48/134/16)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,206850(48/134/17)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206852(48/134/19)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206853(48/135/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206854(48/135/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206855(48/135/3)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206856(48/135/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206857(48/135/5)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206858(48/135/6)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,206859(48/135/7)) ReadFile Data error (cyclic redundancy check).
As long as testdisk displays your files, you should copy/backup them to an intact healthy partition/disk.
Might be currently the safest solution.

If you list your files, at the bottom of the screen, you'll find all the commands.
If you mark that 2 dots on the upper area of the screen and press enter, you'll get each time 1 directory up until you get to your disk selection and select another healthy disk or partition for recovery.
If you'd like to enter a folder as a destination to recover your data, you can mark it and use your right arrow key on your keyboard to enter it.
Standard path is your testdisk folder.

Afterwards you can have a try to run chkdsk driveletter: /r to have a try to repair your file system or create a new partition, format it and copy your data back.
Please note: Chkdsk is a try to repair a file system, but it's not intended to recover data.

If testdisk hangs due to read errors, please let me know.

Fiona
yesoptus
Posts: 5
Joined: 29 Jun 2014, 15:21

Re: Damaged 1To HD

#30 Post by yesoptus »

Sorry, stepped out for a while.
I am trying it now and will update the result
Thanks
Locked