Harddisk seems to small and Fat boot sector

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
yoemob04
Posts: 2
Joined: 13 Nov 2017, 19:58

Harddisk seems to small and Fat boot sector

#1 Post by yoemob04 »

Hello,

I need help to recover an important folder. Windows 7 was reinstalled on my laptop and OS partition formatted. I need to recover a MySql data folder from the old windows installation.

I followed this steps to recover the old OS partition

1. Started quick search and only actual partitions are showed. After that I selected a deep search trying to find the old partition.

Image

2. After a time, deep search testdisk found the partition that probably I want and and error with fat boot sector.
Image

3. Waiting until the deep search is completed a message "hard disk seems to small and FAT12 partition can't be recovered"
Image

When I press enter to continue, the partition that I want disappear.
How to solve this problem I think message about disk too small is for the bad boot sector showed.

please I need help, the most important folder that I want to recover is the database from a mysql folder in the old windows installation.
thanks
Attachments
Deep3.png
Deep3.png (50.1 KiB) Viewed 1911 times
Deep21.png
Deep21.png (52.77 KiB) Viewed 1911 times
Deep1.png
Deep1.png (41.93 KiB) Viewed 1911 times
Top
User avatar
cgrenier
Site Admin
Posts: 5442
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Harddisk seems to small and Fat boot sector

#2 Post by cgrenier »

You can safely ignore the FAT12.
With the first 2 NTFS partitions, use 'p' to list the files. Do you see your old files ?
Top
yoemob04
Posts: 2
Joined: 13 Nov 2017, 19:58

Re: Harddisk seems to small and Fat boot sector

#3 Post by yoemob04 »

Hello crrenier,

When I press enter to continue, partitions that I want to recover disappear. Only actual partions of my harddisk are shown.

The log file says that partitions it was found using backup sector. I don't know why it disappear when I press enter.
Image


this is the logfile:

Mon Nov 13 09:13:01 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.4.0-53-generic (#74-Ubuntu SMP Fri Dec 2 15:59:10 UTC 2016) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63, sector size=512 - VMware, VMware Virtual S, FW:1.0
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ASMT 2105

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - ASMT 2105
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 24320/69/6
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 24320 69 5 390498304
3 P HPFS - NTFS 24320 69 6 121601 25 24 1562816512

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 390498304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
NTFS at 24320/69/6
filesystem size 1562816512
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
P HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sdb 2048" | dmsetup create test0
echo "0 390498304 linear /dev/sdb 206848" | dmsetup create test1
echo "0 1562816512 linear /dev/sdb 390705152" | dmsetup create test2

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 390498304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
NTFS at 24320/69/5
filesystem size 390498304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS found using backup sector, blocksize=4096, 199 GB / 186 GiB
NTFS at 24320/69/6
filesystem size 1562816512
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB
BAD_RS LBA=2684462347 10280596
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 167100 13 29 256881 29 12 1442332757
This partition ends after the disk limits. (start=2684462347, size=1442332757, end=4126795103, disk end=1953525168)
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2112 GB / 1967 GiB)
The following partition can't be recovered:
FAT12 167100 13 29 256881 29 12 1442332757

Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 24320 69 5 390498304
NTFS, blocksize=4096, 199 GB / 186 GiB
P HPFS - NTFS 24320 69 6 121601 25 24 1562816512
NTFS, blocksize=4096, 800 GB / 745 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sdb 2048" | dmsetup create test0
echo "0 390498304 linear /dev/sdb 206848" | dmsetup create test1
echo "0 1562816512 linear /dev/sdb 390705152" | dmsetup create test2
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.


I hope you can help, thanks
Attachments
log.png
log.png (60.29 KiB) Viewed 1903 times
Top
Locked

Return to “Partition Recovery”