I used testdisk's analyze to find that I have a partition that starts at 29989 134 34 and ends at 38530 146 16 and a size of 137211904 blocks. I'm trying to convert the start and stop to LBA values. I've tried using the conversion at:
https://en.wikipedia.org/wiki/Logical_b ... conversion
i.e. this equation: LBA = (C × HPC + H) × SPT + (S - 1)
I tried the values of HPC = 16 and SPT = 63 (as the page says is "typical"), but that would imply that the extent of the partition (i.e. space between start and stop) is 8610066 instead of 137211904 blocks. Obviously I'm doing something wrong.
How is it that these values get turned into LBA values? Maybe my constants for HPC/SPT are wrong? Or maybe the equation doesn't apply at all to my drive? Is there a way to get testdisk to just list those values directly instead of CHS?
Thanks for any help.
Converting CHS to LBA Topic is solved
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5440
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Converting CHS to LBA
Please post the testdisk.log file.
If it's an existing partition, you use "testdisk_win.exe -lu" to get the values.
If it's an existing partition, you use "testdisk_win.exe -lu" to get the values.
-
ApproximateIdentity
- Posts: 3
- Joined: 11 May 2017, 19:22
Re: Converting CHS to LBA
Thanks for the response!
Sorry I should have been more specific. I'm not actually on Windows I'm using Linux (debian 8). I installed testdisk from the debian repositories. This is the version info:
I'm not entirely sure how I should answer the question of whether it is an existing partition. My situation is as follows: I have a drive that accidentally partially wiped. But I'm lucky because I actually did not care about the first (larger) partion(s) which were NTFS partitions that had nothing useful on them. However, the first extended partition has data from a Linux installation that I would like to access. So roughly I had a situation like this (I remember because I looked at it a few times with fdisk before screwing stuff up):
I know that the dd command killed all the partitions before the Logical Partition, but I'm essentially totally sure it did not make it to the extended partitions. Basically what I want to do is to get the exact location of the start of the extended partition as an LBA address if possible. I think that as long as I could find the exact beginning of the Logical partition housing the rest, I'd be okay by just looking at the specs of how these things are setup. (By the way, I presume there is a way for me to directly access the sda5 partition using testdisk, but I'm actually a little curious to do some of this stuff by hand...especially since I won't be editing the drive anyway...well ignore the dding of course.
Here's the log. I appended a couple analyze runs because I was confused about how the program worked. The first time it found information about the extended partitions and the second time it seemed to find info on the NTFS partitions as well:
Thanks again!
Sorry I should have been more specific. I'm not actually on Windows I'm using Linux (debian 8). I installed testdisk from the debian repositories. This is the version info:
Code: Select all
$ testdisk -v
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Version: 6.14
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Code: Select all
sda1 Primary NTFS
sda2 Primary NTFS <--- Not sure if there were two but I think so. Also maybe both weren't NTFS
sda3 Logical Partition
sda5 Extended Partition <--- This one I care about
sda6 Swap
Here's the log. I appended a couple analyze runs because I was confused about how the program worked. The first time it found information about the extended partitions and the second time it seemed to find info on the NTFS partitions as well:
Code: Select all
Wed Jan 1 13:13:37 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
recover_EXT2: s_block_group_nr=0/523, s_mnt_count=366/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 17151488
recover_EXT2: part_size 137211904
Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
Linux Swap 38530 178 49 38913 69 52 6146032
SWAP2 version 1, pagesize=4096, 3146 MB / 3000 MiB
Results
* Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
P Linux Swap 38530 178 49 38913 70 5 6146048
SWAP2 version 1, pagesize=4096, 3146 MB / 3001 MiB
interface_write()
1 * Linux 29989 134 34 38530 146 16 137211904
2 P Linux Swap 38530 178 49 38913 70 5 6146048
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
New options :
Dump : No
Align partition: Yes
Expert mode : No
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 29989/102/1
filesystem size 481572864
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 29989 102 1 481572864
NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB
recover_EXT2: s_block_group_nr=0/523, s_mnt_count=366/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 17151488
recover_EXT2: part_size 137211904
Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
Linux Swap 38530 178 49 38913 69 52 6146032
SWAP2 version 1, pagesize=4096, 3146 MB / 3000 MiB
Results
* HPFS - NTFS 12 223 20 29989 102 1 481572864
NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB
P Linux 29989 134 34 38530 146 16 137211904
ext4 blocksize=4096 Large file Sparse superblock, 70 GB / 65 GiB
P Linux Swap 38530 178 49 38913 70 5 6146048
SWAP2 version 1, pagesize=4096, 3146 MB / 3001 MiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 12 190 51 29989 102 1 481574912
2 P Linux 29989 134 34 38530 146 16 137211904
3 P Linux Swap 38530 178 49 38913 70 5 6146048
5 L HPFS - NTFS 12 223 20 29989 102 1 481572864
add_ext_part_i386: max
interface_write()
1 E extended LBA 0 32 33 29989 102 1 481777664
2 P Linux 29989 134 34 38530 146 16 137211904
3 P Linux Swap 38530 178 49 38913 70 5 6146048
5 L HPFS - NTFS 12 223 20 29989 102 1 481572864
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/32/33,lba=2048
TestDisk exited normally.
Wed Jan 1 15:06:00 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
TestDisk exited normally.
Wed Jan 1 15:06:03 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Wed Jan 1 15:17:55 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
TestDisk exited normally.
Wed Jan 1 15:17:57 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
TestDisk exited normally.
Wed Jan 1 15:26:58 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
User is not root!
Hard disk list
TestDisk exited normally.
Wed Jan 1 15:27:00 2003
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.16.0-4-amd64 (#1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)) x86_64
Compiler: GCC 4.9
Compilation date: 2014-10-19T15:35:24
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
Disk /dev/sdf - 1998 MB / 1906 MiB - CHS 1718 71 32, sector size=512 - Kingston DataTraveler 2.0, FW:PMAP
Partition table type default to Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD3200BEVT-22ZCT0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Interface Advanced
New options :
Dump : No
Align partition: Yes
Expert mode : No
TestDisk exited normally.
-
cgrenier
- Site Admin
- Posts: 5440
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Converting CHS to LBA
Use testdisk 7.1-WIP instead of this old version. Read https://www.cgsecurity.org/testdisk.pdf if necessary on how to install it.
Why didn't you let TestDisk rewrote the partition table with the partitions found ?
Why didn't you let TestDisk rewrote the partition table with the partitions found ?
-
ApproximateIdentity
- Posts: 3
- Joined: 11 May 2017, 19:22
Re: Converting CHS to LBA
Thanks so much for the help! Apparently I had the information I needed all along and it was listed in the original log.
I didn't realize that I needed to use 255 as my HPC value in the equation I posted. Once I used that value instead of 16, everything worked fine. I ended up using that offset to just mount the partition directly and everything worked perfectly.
So as to why I did it this way instead of using the program directly...mainly just to make things hard for myself. I got curious as to the partition data structures themselves and wanted to understand what was going on. (In fact, originally I was about to write a little program to scan the drive for the byte signatures for the ext4 file system, but then I saw your software and decided to try it out...)
In any case, thanks so much for the software! I'm going to recover the data the intelligent way now (i.e. letting testdisk do it for me) so that I get a bit of experience with that in case I do something stupid like prematurely dd a drive again in the future. Thanks for all the help!
edit: Alright it was trivially easy to get things running again usting testdisk the right way. I'm happy I went through the exercise to understand things a little more, but I'll definitely use testdisk itself in the future. Thanks so much for the great software!
Code: Select all
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200BEVT-22ZCT0, S/N:WD-WXV0A49N1695, FW:11.01A11
So as to why I did it this way instead of using the program directly...mainly just to make things hard for myself. I got curious as to the partition data structures themselves and wanted to understand what was going on. (In fact, originally I was about to write a little program to scan the drive for the byte signatures for the ext4 file system, but then I saw your software and decided to try it out...)
In any case, thanks so much for the software! I'm going to recover the data the intelligent way now (i.e. letting testdisk do it for me) so that I get a bit of experience with that in case I do something stupid like prematurely dd a drive again in the future. Thanks for all the help!
edit: Alright it was trivially easy to get things running again usting testdisk the right way. I'm happy I went through the exercise to understand things a little more, but I'll definitely use testdisk itself in the future. Thanks so much for the great software!