testdisk cannot find a partition but photorec can

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dmitry
Posts: 3
Joined: 08 Jun 2012, 19:07

testdisk cannot find a partition but photorec can

#1 Post by dmitry »

I am trying to recover an ext3 partition on a 2 TB drive. This is the only partition on the drive and after a recent reboot of my system I wasn't able to mount it.

I am trying to use testdisk but cannot get past the Search stage. After Quick Search is complete, it reports that there are no partitions. Same happens after Deep Search.

Here is the log (the partition in question is /dev/sdb1):

Code: Select all

Sat Jun  9 09:18:48 2012
Command line: TestDisk /log /dev/sdb1

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.18-194.8.1.el5 (#1 SMP Thu Jul 1 19:04:48 EDT 2010) x86_64
Compiler: GCC 4.4
Compilation date: 2011-11-15T02:42:19
ext2fs lib: 1.41.9, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
Hard disk list
Disk /dev/sdb1 - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512 - WDC WD2003FYYS-02W0B1, S/N:WD-WMAY04712663, FW:01.01D02

Partition table type (auto): Intel
Disk /dev/sdb1 - 2000 GB / 1863 GiB - WDC WD2003FYYS-02W0B1
Partition table type: Intel

Analyse Disk /dev/sdb1 - 2000 GB / 1863 GiB - CHS 243200 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb1 - 2000 GB / 1863 GiB - CHS 243201 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb1 - 2000 GB / 1863 GiB - CHS 243201 255 63

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb1 - 2000 GB / 1863 GiB - CHS 243201 255 63

interface_write()

No partition found or selected for recovery
simulate write!
No extended partition
This partition is also not recognized by fsck:

Code: Select all

> fsck /dev/sdb

fsck 1.39 (29-May-2006)
e2fsck 1.39 (29-May-2006)
Couldn't find ext2 superblock, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/sdb

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
I tried following this suggestion and used alternative superblock numbers (I tried all superblock numbers produced by mke2fs -n /dev/sdb1) but none of them worked.

On the other hand, photorec and fdisk appear to recognize the partition (at least, partially). Here is the photorec log:

Code: Select all

Sat Jun  9 22:06:03 2012
Command line: PhotoRec /log /dev/sdb1

PhotoRec 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.18-194.8.1.el5 (#1 SMP Thu Jul 1 19:04:48 EDT 2010) x86_64
Compiler: GCC 4.4
Compilation date: 2011-11-15T02:42:19
ext2fs lib: 1.41.9, ntfs lib: libntfs-3g, ewf lib: 20100226, libjpeg: 62
Hard disk list
Disk /dev/sdb1 - 2000 GB / 1863 GiB - CHS 243200 255 63 (RO), sector size=512 - WDC WD2003FYYS-02W0B1, S/N:WD-WMAY04712663, FW:01.01D02

Can't open photorec.ses file: No such file or directory
Partition table type (auto): None
   P Unknown                  0   0  1 243200 253 63 3907024002
New options :
 Paranoid : Yes
 Brute force : No
 Allow partial last cylinder : No
 Keep corrupted files : No
 ext2/ext3 mode : No
 Expert mode : No
 Low memory : No
Output of fdisk:

Code: Select all

> fdisk -lu /dev/sdb

Disk /dev/sdb: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1              63  3907024064  1953512001   83  Linux
Perhaps another clue is that Parted recognizes that there is a partition but doesn't recognize its type:

Code: Select all

> parted /dev/sdb

GNU Parted 1.8.1
Using /dev/sdb
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) p                                                                

Model: ATA WDC WD2003FYYS-0 (scsi)
Disk /dev/sdb: 2000GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start   End     Size    Type     File system  Flags
 1      32.3kB  2000GB  2000GB  primary
Notice that the "File system" field of the table is empty.

Any suggestions for fixing this issue would be greatly appreciated.
Top
dmitry
Posts: 3
Joined: 08 Jun 2012, 19:07

Re: testdisk cannot find a partition but photorec can

#2 Post by dmitry »

Update to my previous post:

I was able to get testdisk to partially recognize a partition. I've run "sfdisk -d /dev/sdc > out" followed by "sfdisk /dev/sdc < out" (/dev/sdc is the name of the problematic drive):

Code: Select all

> sfdisk -d /dev/sdc > out
> sfdisk /dev/sdc < out
Checking that no-one is using this disk right now ... 
OK

Disk /dev/sdc: 243201 cylinders, 255 heads, 63 sectors/track
Old situation:
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System  
   /dev/sdc1          0+ 243200  243201- 1953512001   83  Linux
   /dev/sdc2          0       -       0          0    0  Empty
   /dev/sdc3          0       -       0          0    0  Empty
   /dev/sdc4          0       -       0          0    0  Empty
   New situation:
   Units = sectors of 512 bytes, counting from 0

      Device Boot    Start       End   #sectors  Id  System  
      /dev/sdc1            63 3907024064 3907024002  83  Linux
      /dev/sdc2             0         -          0   0  Empty
      /dev/sdc3             0         -          0   0  Empty
      /dev/sdc4             0         -          0   0  Empty
      Warning: no primary partition is marked bootable (active)
      This does not matter for LILO, but the DOS MBR will not boot this disk.
      Successfully wrote the new partition table

      Re-reading the partition table ...

      If you created or changed a DOS partition, /dev/foo7, say, then use dd(1)
      to zero the first 512 bytes:  dd if=/dev/zero of=/dev/foo7 bs=512 count=1
Now testdisk recognizes the partition at first (before I run the partition search) but after the partition search it says that there are no partitions! Here is the log file:

Code: Select all

Fri Jun 22 10:44:18 2012
Command line: TestDisk /log /dev/sdc

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.18-194.8.1.el5 (#1 SMP Thu Jul 1 19:04:48 EDT 2010) x86_64
Compiler: GCC 4.4
Compilation date: 2011-11-15T02:42:19
ext2fs lib: 1.41.9, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
Hard disk list
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD2003FYYS-02W0B1, S/N:WD-WMAY04984866, FW:01.01D02

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - WDC WD2003FYYS-02W0B1
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 83
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
No ext2, JFS, Reiser, cramfs or XFS marker
 1 P Linux                    0   1  1 243200 254 63 3907024002
 1 P Linux                    0   1  1 243200 254 63 3907024002
No partition is bootable
Backup partition structure
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0
search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63

interface_write()
 
No partition found or selected for recovery
simulate write!
Note that before running the search, testdisk lists the partition twice (which I think is a sign of a problem). On the other hand, the backup file created by testdisk lists the partition only once:

Code: Select all

#1340376283 Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
 1 : start=       63, size=3907024002, Id=83, P
So, I restarted testdisk and loaded the disk structure from the backup file. This seems to have helped things a little: testdisk finally recognized that there is a single partition! I wrote the partition structure, rebooted the computer and now I am back at the same state as I was before: testdisk thinks that there are 2 partitions before I run partition search.

Here is a log of my attempt to write the partition structure from the backup file:

Code: Select all

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.18-194.8.1.el5 (#1 SMP Thu Jul 1 19:04:48 EDT 2010) x86_64
Compiler: GCC 4.4
Compilation date: 2011-11-15T02:42:19
ext2fs lib: 1.41.9, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
Hard disk list
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD2003FYYS-02W0B1, S/N:WD-WMAY04984866, FW:01.01D02

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - WDC WD2003FYYS-02W0B1
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 83
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
No ext2, JFS, Reiser, cramfs or XFS marker
 1 P Linux                    0   1  1 243200 254 63 3907024002
 1 P Linux                    0   1  1 243200 254 63 3907024002
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 1

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243202 255 63
Search for partition aborted
interface_load
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63 Fri Jun  8 14:47:06 2012
 1 P Linux                    0   1  1 243200 254 63 3907024002
check_part_i386 failed for partition type 83
Couldn't open reiser filesystem 

interface_write()
 1 P Linux                    0   1  1 243200 254 63 3907024002
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.
Any suggestions?
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: testdisk cannot find a partition but photorec can

#3 Post by Fiona »

There is a partition in your partition table, would it be possible to use testdisk and Advanced / Superblock to determine a backup of your superblock?
Afterwards you can try the following procedur to get access to your files;
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock

Fiona
Top
dmitry
Posts: 3
Joined: 08 Jun 2012, 19:07

Re: testdisk cannot find a partition but photorec can

#4 Post by dmitry »

Thanks! I was able to get the superblock number and the blocksize using the Advanced menu. I'm now running e2fsck using this information.
Top
Locked

Return to “Partition Recovery”