Page 1 of 1

Recovering NTFS Partition from (partly?) quick-formatted drive

Posted: 17 Sep 2016, 08:31
by shiz0
Hi.
I dont know if this should be in here, or in FS recovery. Apologies if so:

I have here a 1TB disk a friend gave to me. It was his data drive.
He accidentally quick-formatted the wrong disk. :roll:
As soon as he got aware of his error he killed the pc. :roll:

Now the disk is detected as follows:

Code: Select all

# lsblk -o NAME,FSTYPE,SIZE,MODEL
NAME   FSTYPE            SIZE MODEL
[...]
sdi                    931.5G Hitachi HDS72101
└─sdi1                 931.5G

Code: Select all

# fdisk -l /dev/sdi
Disk /dev/sdi: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x7f99d2ff

Device     Boot Start        End    Sectors   Size Id Type
/dev/sdi1        2048 1953521663 1953519616 931.5G  7 HPFS/NTFS/exFAT
In Testdisk, the Drive and also the Partition seems to be detected okay:

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332

Please select the partition table type, press Enter when done.
>[Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

Hint: Intel partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332
     CHS 121601 255 63 - sector size=512

>[ Analyse  ] Analyse current partition structure and search for lost partitions
 [ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ MBR Code ] Write TestDisk MBR code to first sector
 [ Delete   ] Delete all data in the partition table
 [ Quit     ] Return to disk selection

Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.
In "Analyze":

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
No partition is bootable
In "Advanced":

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63

     Partition                  Start        End    Size in sectors
> 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
Trying to list the files fails with error "Filesystem seems damaged".
So first, I go with quick search, and the deeper search, but it only detects some FAT32 Partition with wrong size and says the disk is too small.
The I can only go back to the menu. Going for "Advanced" in Boot Repair it says both boot sectors are bad. Trying to rebuild them fails.
Am I missing something?
I just started the process over from the beginning to get a clean log file.
I will append it here, as soon as its finished (will take some hours ofc).

Any help appreciated.
Thank you.

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

Posted: 17 Sep 2016, 13:29
by cgrenier
In Advanced, try Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.
If it doesn't please post the testdisk.log file content.

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

Posted: 17 Sep 2016, 13:55
by shiz0
During Scans (normal, as well as deep) it outputs:

Code: Select all

Invalid FAT boot sector
 0 D FAT32 LBA            36883 158 33 279707 107 49 3900964364
  FAT32 LBA            36883 158 33 279707 107 49 3900964364
Normal scan finished:

Code: Select all

Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63

The harddisk (1000 GB / 931 GiB) seems too small! (< 2300 GB / 2142 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  FAT32 LBA            36883 158 33 279707 107 49 3900964364


[ Continue ]
1997 GB / 1860 GiB

I will try rebuilding the BS right after the currently running deep scan is finished.
That again will take some hours scanning all the sectors :arrow:
I will report back to you and post the log file after it's all done.
Thank you!

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

Posted: 17 Sep 2016, 17:52
by shiz0
Unfortunately, after trying to rebuild BS, they are still listed as bad.
Listing files is still not possible:
"Can't open filesystem. Filesystem seems damaged."

In the log there are MFTs found, but "read_mft_info failed".
Here's the log:

Code: Select all

$ cat testdisk.log


Sat Sep 17 09:16:02 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.7.3-2-ARCH (#1 SMP PREEMPT Thu Sep 8 09:44:02 CEST 2016) x86_64
Compiler: GCC 5.3
Compilation date: 2016-03-21T14:32:26
ext2fs lib: 1.43.3, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.0
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48 support
/dev/sdc: size       117231408 sectors
/dev/sdc: user_max   117231408 sectors
/dev/sdc: native_max 117231408 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       488397168 sectors
/dev/sdd: user_max   488397168 sectors
/dev/sdd: native_max 488397168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       488397168 sectors
/dev/sde: user_max   488397168 sectors
/dev/sde: native_max 488397168 sectors
/dev/sdf: LBA, HPA, LBA48, DCO support
/dev/sdf: size       1953525168 sectors
/dev/sdf: user_max   1953525168 sectors
/dev/sdf: native_max 1953525168 sectors
/dev/sdg: LBA, HPA, LBA48, DCO support
/dev/sdg: size       1953525168 sectors
/dev/sdg: user_max   1953525168 sectors
/dev/sdg: native_max 1953525168 sectors
/dev/sdh: LBA, HPA, LBA48, DCO support
/dev/sdh: size       1953516911 sectors
/dev/sdh: user_max   1953516911 sectors
/dev/sdh: native_max 1953525168 sectors
/dev/sdi: LBA, HPA, LBA48, DCO support
/dev/sdi: size       1953525168 sectors
/dev/sdi: user_max   1953525168 sectors
/dev/sdi: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 2002 MB / 1910 MiB - CHS 1017 62 62, sector size=512 - Verbatim STORE N GO, FW:5.00
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - OCZ-REVODRIVE, S/N:OCZ-YWPB40YH4GR9643F, FW:1.37
Disk /dev/sdc - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - OCZ-REVODRIVE, S/N:OCZ-0KG9274T2008N1L9, FW:1.37
Disk /dev/sdd - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:S1DBNSBD904354F,
FW:EXT0CB6Q
Disk /dev/sde - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:S1DBNSBF121198K,
FW:EXT0BB6Q
Disk /dev/sdf - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103UJ, S/N:S13PJ1KS802869, FW:1AA011
18
Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103UJ, S/N:S13PJ1KS802870, FW:1AA011
18
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - SAMSUNG HD103SJ, S/N:S246J9CZA11375, FW:1AJ100
01
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDS721010CLA332, S/N:JP9960HZ2NGAAU, F
W:JP4OA3MA

Partition table type (auto): Intel
Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332
Partition table type: Intel
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
Partition table type (auto): Intel
Disk /dev/sdi - 1000 GB / 931 GiB - Hitachi HDS721010CLA332
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616

Analyse Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
No partition is bootable

search_part()
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=592535381 98990
check_part_i386 failed for partition type 0C
     FAT32 LBA            36883 158 33 279707 107 49 3900964364
This partition ends after the disk limits. (start=592535381, size=3900964364, end=4493499744, disk end=1953525168)
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2300 GB / 2142 GiB)
The following partition can't be recovered:
     FAT32 LBA            36883 158 33 279707 107 49 3900964364

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=592535381 98990
check_part_i386 failed for partition type 0C
     FAT32 LBA            36883 158 33 279707 107 49 3900964364
This partition ends after the disk limits. (start=592535381, size=3900964364, end=4493499744, disk end=1953525168)
Disk /dev/sdi - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2300 GB / 2142 GiB)
The following partition can't be recovered:
     FAT32 LBA            36883 158 33 279707 107 49 3900964364

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
filesystem size           16831425191078376410
sectors_per_cluster       0
mft_lcn                   87998667047671
mftmirr_lcn               11844738985903526868
clusters_per_mft_record   -1
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 582190978
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

mft at 582194082
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

mft at 1088141718
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

mft at 1088144822
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             2058
ntfs_find_mft: mftmirr_lcn         5162
ntfs_find_mft: mft_record_size     1024

Potential partition:
 1 P HPFS - NTFS          36239 181 31 157840 174 22 1953519616
 1 P HPFS - NTFS          67733 175 39 189334 168 30 1953519616
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
filesystem size           16831425191078376410
sectors_per_cluster       0
mft_lcn                   87998667047671
mftmirr_lcn               11844738985903526868
clusters_per_mft_record   -1
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS signature is missing.
NTFS signature is missing.
Not an exFAT boot sector.

 1 P HPFS - NTFS              0  32 33 121601  25 24 1953519616
Can't open filesystem. Filesystem seems damaged.

TestDisk exited normally.
I noticed:

Code: Select all

sectors_per_cluster       0
[...]
clusters_per_mft_record   -1
clusters_per_index_record 0
and

Code: Select all

ntfs_find_mft: sectors_per_cluster invalid
Seems to me like the clusters are messed up, is there anything I can do about that?
Thank you.

Re: Recovering NTFS Partition from (partly?) quick-formatted drive

Posted: 20 Sep 2016, 07:56
by shiz0
Anyone?
Any ideas greatly appreciated. :-)