cgsecurity.org

Hello

My computer was powered down by accident and afterwards I was not able to boot into Windows, as well afterwards I could no longer perform a "short S.M.A.R.T" test as it would fail on read errors. I ran TestdDisk and chose the EFI/GPT option to recover partitions, it originally listed 5 partition (quick analyze) and I chose the 3 partition that seemed to be the correct ones but I guess I "wrote" the wrong partitions so now I don't have an EFI and Recovery partitions. I did do a DDRescue on the faulty drive (after the "write") and I have been trying to recover the EFI but no luck so far. So I'm wondering what should be the correct partition type for a Windows 10 UEFI secure boot on? Should I use Intel instead of EFI?
Below is the information after doing a EFI/GPT quick analyze on the rescued drive

Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
Partition Start End Size in sectors

Bad GPT partition, invalid signature
Trying alternative GPT
1 P MS Data 82928 89101 6174 [Boot]
2 P MS Data 1288192 955537407 954249216 [OS]
3 P MS Data 956459008 976773119 20314112 [Image]

Below is the information after doing EFI/GPT Deeper Search (partial search) on the rescued drive

Current partition structure:
Partition Start End Size in sectors
D MS Data 76755 82928 6174
D MS Data 82928 89101 6174 [Boot]
D MS Data 89101 95274 6174
D MS Data 1288192 955537407 954249216 [OS] -------------------------> If I mark this partition as P the error is structure: bad
D EFI System 11437112 11439991 2880 [EFI System Partition] [EFISECTOR]
D MS Data 12948339 12954512 6174
D MS Data 12954512 12960685 6174 [Boot]
D MS Data 936144897 956459008 20314112
D MS Data 954615809 955537408 921600
D MS Data 955537408 956459007 921600
D MS Data 956459008 976773119 20314112 [Image]

I did do a complete Deep search but then I would end up with more than one EFI partition, some EFI partitions had different dates and different Start and End sizes

Being curios I did an Intel analyze and the partition look weird compared to a good Windows disk

Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
Partition Start End Size in sectors
* HPFS - NFTS 80 47 32 59479 115 28 954249216 [OS]
P HPFS - NFTS 59479 115 29 59536 209 1 921600
P HPFS - NFTS 59536 209 2 60801 80 15 20314112 [Image]

Hopefully someone can help me

Have you tried to rewrite the partition as Intel ?
Have you been able to access the data this way ?

No I haven't tried to write it as intel as the partition below doesnt even have the EFI file and I cant event change the HPFS to FAT32.
P HPFS - NFTS 59479 115 29 59536 209 1 921600 *****this is the wrong partition I wrote and it doesn't have an EFI file****

Also for some reason the intel partition marks the C: as the boot
* HPFS - NFTS 80 47 32 59479 115 28 954249216 [OS] ****this is my C: drive"****

I think the correct EFI file is the one below but I can only recover that file with a deep search and under EFI/GPT, and as I said before there is more than one EFI result so I really don't know.
D EFI System 11437112 11439991 2880 [EFI System Partition] [EFISECTOR]
If I do the same deep search under the Intel option none of the EFI partitions shows up as the EFI/GPT option, do you know why?

Yes I can view the data that is marked OS (below), but I was wondering if you can loose files from a folder (document, desktop folders) if I wrote the wrong partition table to begin?
2 P MS Data 1288192 955537407 954249216 [OS]

jlima wrote: 25 Apr 2019, 16:20 No I haven't tried to write it as intel as the partition below doesnt even have the EFI file and I cant event change the HPFS to FAT32.

Testdisk is not a tool for converting file systems. There is no need to modify file systems for recovery purposes anyway.
Run the analyse function of Testdisk on a clean machine just to see how a normal structure looks like.
[/quote]

P HPFS - NFTS 59479 115 29 59536 209 1 921600 *****this is the wrong partition I wrote and it doesn't have an EFI file****

Also for some reason the intel partition marks the C: as the boot
* HPFS - NFTS 80 47 32 59479 115 28 954249216 [OS] ****this is my C: drive"****

Your computer needs a bootable partition when using the old MBR-style partitioning scheme.

I think the correct EFI file is the one below but I can only recover that file with a deep search and under EFI/GPT, and as I said before there is more than one EFI result so I really don't know.

You are problably confusing the terms "file" and "partition" here.

D EFI System 11437112 11439991 2880 [EFI System Partition] [EFISECTOR]
If I do the same deep search under the Intel option none of the EFI partitions shows up as the EFI/GPT option, do you know why?

There is no EFI partition in the old MBR-style partitioning scheme.

Yes I can view the data that is marked OS (below), but I was wondering if you can loose files from a folder (document, desktop folders) if I wrote the wrong partition table to begin?
2 P MS Data 1288192 955537407 954249216 [OS]

This can always happen with old MBR-style partitioning schemes but not with the modern GPT because the table of GPT is written at the start of disk and the partition data follows. Any changes in the table at the start of the disk won't affect the content of the following partitions. MBR-style partitioning contains MBR-structures between partitions. If such an MBR is erroneously written right into a partition you are loosing the information of that sector.

Run the analyse function of Testdisk on a clean machine just to see how a normal structure looks like.

I did, a working drive looks like this
Parition Start End Size in sectors
* HFPS - NTFS 0 32 33 63 188 61 1021952 [Recovery]
P FAT32 63 188 62 76 92 16 202752 [EFI system Parition]
P HPFS - NTFS 78 102 25 29185 61 60 467601408

You are problably confusing the terms "file" and "partition" here.

Yes sorry I meant EFI partition, when I browse the EFI partition from the working drive there is a file named EFI

D EFI System 11437112 11439991 2880 [EFI System Partition] [EFISECTOR]
If I do the same deep search under the Intel option none of the EFI partitions shows up as the EFI/GPT option, do you know why?
There is no EFI partition in the old MBR-style partitioning scheme.

What do you mean there is no EFI partition?

I guess now that I have recovered my data I would like to make my ddrescue drive bootable again, hence why I'm trying to recover the EFI partition

jlima wrote: 26 Apr 2019, 15:48 What do you mean there is no EFI partition?

Depending on the partitioning scheme used an EFI system partition is created by the installation routines of the Microsoft operating system.
The Microsoft installer does not create one if the partitioning scheme is Intel (old school MBR-style partitioning scheme).
If you guess during recovery that the scheme was "Intel" there cannot be an EFI system partition.