cgsecurity.org

Hello,
I have a problem with logical drive recovery.
I have 2 identical 2TB hard disks in my PC, with former completely different partitions. At the last start one disk seemed to be partial overwritten with the data of the other disk. The first partition is a completely mirror of the first partition of the other disk, and can be used normally (0). Then an area is partial written with the data of the second partition of the other disk(1), inaccesible. This, like all other data, is located in a RAW partition (shown under Windows disk management).

The Quick Search shows me this 2 Partitions:
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Partitions:
0) P HPFS - NTFS 000000 032 33 112659 161 14 1809874944
1) P HPFS - NTFS 121600 150 23 243201 013 12 1953511424

After deep search I find all of my missing partitions (there are also serveral more old Partitioninformations shown). I can display and copy their files, this are the partitions:
2) D HPFS - NTFS 147709 208 20 160768 185 62 0209711104
3) D HPFS - NTFS 160768 185 63 193399 005 14 0524285952
4) D HPFS - NTFS 193399 005 15 206452 237 57 0209711104
5) D HPFS - NTFS 206452 237 58 212979 226 47 0010485552
6) D HPFS - NTFS 212979 226 47 243201 078 13 0485507072

2) should be a primary partition, 3) to 6) are logical partitions.
Now I get problems with the recovery, probably also because of the strange start cylinders and heads. Whenever I sign a Partion as "L" I got the Information "Structure: Bad."
Does anyone have any idea what I can do?
Many thanks for the help
Meinert

The only possibility I see to have 2 identical partitions and files on two disks is if you had enabled RAID 1 (mirroring) by mistake.
As partitions 5 and 6 overlaps, you can recover only one of the 2.
As there is no space between the partitions, they can't be logical partitions, they need to be primary.
Only 4 partition maximum can be coexists when using a PC Intel partition table.
More primary partition can exists when using EFI GPT partition table.

Sorry, the matter with Partition 5 and 6 was my fault, 6 is starting at 212979 226 048 instead of 047.
But actual there where 2 primary partitions, one of them complete destroyed, the other one is partition 2, followed by an extenden Partition, whitch contained the further 4 Partitions as logical.
But usually this locigal Partitions should start at head/sector: 0/0 and end at 254/63 as far as I know, thats what I am wondered about.

Meinert wrote: 15 Dec 2019, 11:48 Sorry, the matter with Partition 5 and 6 was my fault, 6 is starting at 212979 226 048 instead of 047.

Posting the original log file instead of self-written stuff is less error-prone and provides more information.

But actual there where 2 primary partitions, one of them complete destroyed, the other one is partition 2, followed by an extenden Partition, whitch contained the further 4 Partitions as logical.

This description suggests the existence of an old style partition table (but keep in mind the comment of Christophe Grenier).

But usually this locigal Partitions should start at head/sector: 0/0 and end at 254/63 as far as I know, thats what I am wondered about.

This depends on the operation system used. Legacy stuff puts partitions on cylinder boundaries. Gparted p.e. gives you the choice of a MByte-alignment.

Thanks for your information, most likely the extended partition was created with third-party tools, was still MBR. So I will copy the data from the smaller partitions and restore the others as primary.
Thank you again for learning something new. Have a nice evening
Meinert