Please help me recover a partition. "Disk Too Small!"

[Mark01]

Today for no reason at all, a message appeared on my computer, telling me that "the disk is not formatted"


And guess what, the drive affected was my archive which was full of very important data.

I've tried running testdisk but it says that my partition can't be recovered (there was only one, called "Private"), and something about the disk being too small or something. I honestly have no clue what this means.

Please, help me recover this partition.

Here is my log file, I have no idea what any of that means, so please, please help me, I tried all day to restore this drive but so far I restored nothing.

• Sun Jun 3 16:23:16 2012
  Command line: TestDisk
  
  TestDisk 6.14-WIP, Data Recovery Utility, May 2012
  Christophe GRENIER <grenier@cgsecurity.org>
  http://www.cgsecurity.org
  OS: Windows 7 (7601) SP1
  Compiler: GCC 4.6, Cygwin 1007.9
  Compilation date: 2012-05-21T08:46:51
  ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
  disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
  disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
  disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
  disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
  disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500105740288
  disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=500107829760
  filewin32_getfilesize(\\.\E:) GetFileSize err Funzione non corretta.
  
  filewin32_setfilepointer(\\.\E:) SetFilePointer err Funzione non corretta.
  
  Warning: can't get size for \\.\E:
  Hard disk list
  Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5001AALS-00LWTA0, S/N:2020202057202d444d5759413050353036363230, FW:01.01S01
  Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-00A7B0, S/N:2020202057202d444d5753413759303234333331, FW:01.03B01
  
  Partition table type (auto): Intel
  Disk /dev/sdb - 500 GB / 465 GiB - WDC WD5000AAKS-00A7B0
  Partition table type: Intel
  
  Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  Geometry from i386 MBR: head=255 sector=63
  
  
  test_FAT()
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  sector_size 0
  cluster_size 0
  reserved 0
  fats 0
  dir_entries 0
  sectors 0
  media 00
  fat_length 0
  secs_track 0
  heads 0
  hidden 0
  total_sect 0
  check_part_i386 failed for partition type 0C
  get_geometry_from_list_part_aux head=255 nbr=1
  get_geometry_from_list_part_aux head=8 nbr=2
  get_geometry_from_list_part_aux head=16 nbr=2
  get_geometry_from_list_part_aux head=32 nbr=1
  get_geometry_from_list_part_aux head=64 nbr=1
  get_geometry_from_list_part_aux head=128 nbr=1
  get_geometry_from_list_part_aux head=240 nbr=1
  get_geometry_from_list_part_aux head=255 nbr=1
  Current partition structure:
  Invalid FAT boot sector
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  
  Bad sector count.
  Backup partition structure
  partition_save
  Ask the user for vista mode
  search_vista_part: 1
  
  search_part()
  Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  Search for partition aborted
  
  Results
  
  interface_write()
  
  No partition found or selected for recovery
  simulate write!
  
  write_mbr_i386: starting...
  write_all_log_i386: starting...
  No extended partition
  
  Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  Geometry from i386 MBR: head=255 sector=63
  
  
  test_FAT()
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  sector_size 0
  cluster_size 0
  reserved 0
  fats 0
  dir_entries 0
  sectors 0
  media 00
  fat_length 0
  secs_track 0
  heads 0
  hidden 0
  total_sect 0
  check_part_i386 failed for partition type 0C
  get_geometry_from_list_part_aux head=255 nbr=1
  get_geometry_from_list_part_aux head=8 nbr=2
  get_geometry_from_list_part_aux head=16 nbr=2
  get_geometry_from_list_part_aux head=32 nbr=1
  get_geometry_from_list_part_aux head=64 nbr=1
  get_geometry_from_list_part_aux head=128 nbr=1
  get_geometry_from_list_part_aux head=240 nbr=1
  get_geometry_from_list_part_aux head=255 nbr=1
  Current partition structure:
  Invalid FAT boot sector
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  
  Bad sector count.
  Ask the user for vista mode
  search_vista_part: 1
  
  search_part()
  Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  NTFS at 12748/86/11
  filesystem size 976766976
  sectors_per_cluster 8
  mft_lcn 786432
  mftmirr_lcn 48248063
  clusters_per_mft_record -10
  clusters_per_index_record 1
  HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
  NTFS, blocksize=4096, 500 GB / 465 GiB
  This partition ends after the disk limits. (start=204802048, size=976766976, end=1181569023, disk end=976773168)
  file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
  file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
  file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
  file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
  file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
  file_pread(5,6,buffer,976775170(60801/112/50)) lseek err Invalid argument
  file_pread(5,8,buffer,976775176(60801/112/56)) lseek err Invalid argument
  file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
  file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
  file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
  file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
  file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
  Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  Check the harddisk size: HD jumpers settings, BIOS detection...
  The harddisk (500 GB / 465 GiB) seems too small! (< 604 GB / 563 GiB)
  The following partition can't be recovered:
  HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
  NTFS, blocksize=4096, 500 GB / 465 GiB
  
  Results
  
  interface_write()
  
  No partition found or selected for recovery
  $MFT has invalid magic.
  ntfs_mft_load(): Failed.
  Failed to load $MFT: Input/Output error.
  Failed to startup volume: Input/Output error.
  $MFT has invalid magic.
  ntfs_mft_load(): Failed.
  Failed to load $MFT: Input/Output error.
  $MFT has invalid magic.
  ntfs_mft_load(): Failed.
  Failed to load $MFT: Input/Output error.
  Failed to startup volume: Input/Output error.
  $MFT has invalid magic.
  ntfs_mft_load(): Failed.
  Failed to load $MFT: Input/Output error.
  
  search_part()
  Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  NTFS at 12748/53/41
  filesystem size 976766976
  sectors_per_cluster 8
  mft_lcn 786432
  mftmirr_lcn 48248063
  clusters_per_mft_record -10
  clusters_per_index_record 1
  NTFS part_offset=104857599488, part_size=500104691712, sector_size=512
  NTFS partition cannot be added (part_offset<part_size).
  NTFS at 12748/86/10
  filesystem size 204800000
  sectors_per_cluster 8
  mft_lcn 786432
  mftmirr_lcn 2
  clusters_per_mft_record -10
  clusters_per_index_record 1
  HPFS - NTFS 0 32 33 12748 86 10 204800000
  NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
  NTFS at 12748/86/11
  filesystem size 976766976
  sectors_per_cluster 8
  mft_lcn 786432
  mftmirr_lcn 48248063
  clusters_per_mft_record -10
  clusters_per_index_record 1
  HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
  NTFS, blocksize=4096, 500 GB / 465 GiB
  This partition ends after the disk limits. (start=204802048, size=976766976, end=1181569023, disk end=976773168)
  Search for partition aborted
  Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  Check the harddisk size: HD jumpers settings, BIOS detection...
  The harddisk (500 GB / 465 GiB) seems too small! (< 604 GB / 563 GiB)
  The following partition can't be recovered:
  HPFS - NTFS 12748 86 11 73549 68 55 976766976 [Private]
  NTFS, blocksize=4096, 500 GB / 465 GiB
  
  Results
  * HPFS - NTFS 0 32 33 12748 86 10 204800000
  NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
  Not an exFAT boot sector.
  
  P HPFS - NTFS 0 32 33 12748 86 10 204800000
  NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
  Can't open filesystem. Filesystem seems damaged.
  
  interface_write()
  1 P HPFS - NTFS 0 32 33 12748 86 10 204800000
  Don't write, no confirmation
  
  Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
  Geometry from i386 MBR: head=255 sector=63
  
  
  test_FAT()
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  sector_size 0
  cluster_size 0
  reserved 0
  fats 0
  dir_entries 0
  sectors 0
  media 00
  fat_length 0
  secs_track 0
  heads 0
  hidden 0
  total_sect 0
  check_part_i386 failed for partition type 0C
  get_geometry_from_list_part_aux head=255 nbr=1
  get_geometry_from_list_part_aux head=8 nbr=2
  get_geometry_from_list_part_aux head=16 nbr=2
  get_geometry_from_list_part_aux head=32 nbr=1
  get_geometry_from_list_part_aux head=64 nbr=1
  get_geometry_from_list_part_aux head=128 nbr=1
  get_geometry_from_list_part_aux head=240 nbr=1
  get_geometry_from_list_part_aux head=255 nbr=1
  Current partition structure:
  Invalid FAT boot sector
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  1 * FAT32 LBA 0 1 1 60801 80 63 976773105
  
  Bad sector count.

[remy]

There's now a FAT32 partition. Did you accept to format the disk ?
If yes, what was the previous filesystem ? FAT32 or NTFS ?

[Mark01]

There's now a FAT32 partition. Did you accept to format the disk ?
If yes, what was the previous filesystem ? FAT32 or NTFS ?

No, I didn't accept to format the disk. The error appeared suddenly while I was using the computer normally. I'm 100% sure when I turned on the computer it was still fine (I have my desktop folder on that drive, when I started the computer all my icons and desktop stuff was there, when the error appeared all my stuff on the desktop disappeared). The disk was NTFS, I think it was a dynamic disk as I merged two partitions that were on it some time ago into a single one called private, but honestly, I don't remember. Anyway, under "my computer", the disk appeared as a single partition of 500Gb in NTFS.

What could have happened? And is there any way to recover it?

I tried PhotoRec but it recovers without filenames and this is a big problem, because the disk was almost full (had about 50Gb free out of 500) and it would require days of sorting to put it back the way it was before.

[Fiona]

Today for no reason at all, a message appeared on my computer, telling me that "the disk is not formatted"

Your case looks a kind of weird.
Reason is, you have an unformatted FAT32-partition in your partition table and your NTFS-Partition labeled as Private is displaced and starts about a quarter after the beginning of the disk and ends beyond the disk limit.
In your case, you should have a try to increase the amount of your disk/Cylinder like in these cases and have a try to list your data;
http://forum.cgsecurity.org/phpBB3/post ... icky#p1093
http://forum.cgsecurity.org/phpBB3/post ... icky#p2334
Would it be possible to diagnose your disk exactly like in the first case.
The amount/value of your cylinders is different and should be 73550.
If you still have any question, please let me know.

Fiona

[Mark01]

YES! After changing the number of cylinders I was able to see my data and then it recovered succesfully.

I am so freaking happy!

Anyway, I think I did something wrong at some point, because now I have my old Private partition which is intact and has no corrupted files as far as I can tell, but instead of showing up as D:, it now shows up as F: along with a "ghost" D: drive in "my computer", which is raw. I have no idea where that other D comes from because the Private partition is there and just like it was before with only about 50Gb free out of 500.

Not a big problem, it's probably just a misconfiguration that I caused while I was freaking out when the catastrophe happened. I succesfully managed to reassign the letter D to Private and now everything is back the way it was before.

Thank you very much Fiona and Remy for the support you offered me.

If I may make a last request, I'd like to know more about how you figured out how many cylinders the drive should have had. If you don't mind, explain it to me or link me to an article that explains it. Seems like useful knowledge to have.

Thanks againg for solving my problem. You have my eternal gratitude.

I still have no idea how my partition disappeared to begin with, I'm 100% sure I did nothing partition related when it happened. Oh well.

[remy]

You have my eternal gratitude.

Thanks, it's more than all the money on earth. Event when making half/half with Fiona


For Cylinders :
Your disk has a geometry, for example X Cylinders (C), 255 heads by cylinder (H), 63 sector by head. (S)
LBA size is :
C*H*S-1=C*255*63-1
Size of your disk is then LBA*sector size (512 most of time, sometimes 4096)

If you have the size of your disk eiuither in bytes or in LBA, you can define the number of cylinder.

There, it's just a sum with the place wher the partition should begin and the size it should have. But you are lying to your computer (and to testdisk also) : you can't do a 800GB disk with one that is 500GB.... That's just a way to recover data with dynamic disks, wher filesystem begin sometimes... after the end.

Hope that was clear enough, if not, contact me by PM : I close the thread and mark it as solved

[remy]

Thread reoppened after mail received :

Hi, thanks for explaining me how to figure out those parameters and all, it was very clear and after reading up on what heads, cylinders, etc were, I think I fully understood it.

Anyway, I found a small problem with my drive. I would have added this to my thread but I see you have locked it.

My problem is that some of my files are damaged and cannot be opened under windows. I'd say about 10% of all my files are like that, it's not a big problem as most of those were unimportant files but still, it's bothering me, because I get this error if I try to copy the files to another drive (pic from google)

http://nerd.steveferson.com/wp-content/ ... -error.png

Also, I have that weird "ghost" partition that appeared as a consequence of me messing around blindly in testdisk while panicking (pic from my drive):

http://imageshack.us/photo/my-images/265/catturaeb.png/

I don't know exactly why that partition appeared, but I think it shouldn't exist and that it might be the cause of the corrupted files on my drive.

If you can help me on removing that weird partition and maybe recovering those corrupted files too, I'd appreciate it.

Thanks in advance.

[remy]

I'm sorry, but :
1/ The first pic seems to have a broken link. I'm not sure, but corruption may come from writtings on the disk while your first tries.
2/ I have no idea how to manage partition under windows, even more when dynamic disks are involved. In my opinion, if recovery is finished, the easiest is to copy data somewhere else and to reformat a clean volume on your disk. This will also defragment your data and provide better efficiency.