#1
Posted 11 January 2012 - 04:15 PM
#2
Posted 11 January 2012 - 04:55 PM
- the partition or volume is OK, BUT the pointers to it in the MBR or EBPR are "wrong"
- the partition or volume is OK, BUT the pointers to it's filesytem structure in the PBR/VPR are "wrong"
- the partitition or volume is actually (partially or totally) corrupted
If #1 or #2 it is generally trivial to recover and there is no need whatsoever to re-format.
If #3 in some cases, once recovered the volume a CHKDSK is enough, but if the partition/volume cannot be recovered, and you get (hopefully) the data back with file-based approach then you need to re-format.
First thing you should check if any of #1 or #2 is true, then attempt recovering the partition and only if this is not possible go ahead with file-based recovery attempts.
Preliminary questions:
- Which OS are you currenty running (or which Os can you use to access that disk/partition)?
- Are you familiar with command line?
- Are you familiar with a disk editor ?
- Have you available another disk to copy the thingy (possibly the WHOLE disk, but also the partition might do, once verified it is NOT #1 may be enough) to (dd-like copy)?
Wonko
#3
Posted 11 January 2012 - 04:59 PM
It helps in some cases which windows won't be able
#4
Posted 11 January 2012 - 05:22 PM
Just for the record the "Also" is EXACTLY #2.Also try to recover the PBR with Testdisk.
It helps in some cases which windows won't be able
Running *any* recovery tool, expecially if you are not familiar with it and until you haven't a "forensic sound" copy of the disk, is IMNSHO "playing with odds".
Example:
http://www.msfn.org/...-after-bsy-fix/
Wonko
#5
Posted 11 January 2012 - 09:14 PM
2 a little i know enough to know when to stop before i get into trouble
3 gparted or acorns are the two i know about off hand
4 no i would need to use more then 1 HDD to back up the disk as i do not have one that is big enough to just copy the whole partition
#6
Posted 12 January 2012 - 09:41 AM
You have to be particularly careful.
Ideally, if you have another system, it would be easier to connect the hard disk to this "other" system, as to have a "full" OS working as opposed to a Live CD.
You can use dd (or a similar program) to backup "chunks" of the hard disk, something similar to what was explained here (though the issue was the unreadability status of the disk, something that you should NOT suffer by):
http://reboot.pro/15040/
that app automatically names the chunks with start address/length, you can do the same with dd or similar, but as said you have to be careful.
The suggested LiveCD is parted magic, as it contains by default testdisk.
Even before doing the imagiing, if you promise you won't write anything you can have a quick look at the partition with testdisk, maybe it is one of those "easy to solve" issues.
Remember that drive was partitioned under Windows 7 (I presume) so you have to go to advanced and set to not respect Cylinder boundaries.
Run testdisk with a log and post the log (or upload it somewhere and post a link to the file).
Follow what has been done in this thread:
http://www.msfn.org/...ith-value-data/
Before anything make sure you have read and got familiar with these:
http://www.cgsecurit...sk_Step_By_Step
http://www.cgsecurit...sector_recovery
If you have any doubt, ask before doing something you may later regret.
Wonko
#7
Posted 12 January 2012 - 01:16 PM
Alternatively, you can try PartitionGuru or Paragon Hard Disk Manager to easily and safely recover a lost partition in 1-2 clicks, if you prefer EasyButton®.my problem is that my computers data drive is showing as raw
#8
Posted 14 January 2012 - 03:23 AM
Fri Jan 13 11:44:51 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, January 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2012-01-10T08:17:59
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1031798784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.PhysicalDrive1)=640135028736
filewin32_getfilesize(.PhysicalDrive2) GetFileSize err Incorrect function.
filewin32_setfilepointer(.PhysicalDrive2) SetFilePointer err Incorrect function.
Warning: can't get size for .PhysicalDrive2
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.PhysicalDrive3)=1031798784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.C:)=414102585344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.D:)=640132383744
filewin32_getfilesize(.E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(.E:) SetFilePointer err Incorrect function.
Warning: can't get size for .E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.F:)=0
Warning: can't get size for .F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(.G:)=1031766528
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A364, S/N:091104PCE400VLG29AGC, FW:PC4O
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - TOSHIBA MK6465GSX, S/N:Y0J8S1LHS, FW:GJ00
Disk /dev/sdd - 1031 MB / 984 MiB - CHS 125 255 63, sector size=512 - Memorex TD Classic 003C, FW:5.00
Partition table type (auto): Intel
Disk /dev/sdb - 640 GB / 596 GiB - TOSHIBA MK6465GSX
Partition table type: Intel
Analyse Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
recover_EXT2: s_block_group_nr=0/415, s_mnt_count=1/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13605632
recover_EXT2: part_size 108845056
Linux 10981 176 12 17756 250 30 108845056
EXT4 Large file Sparse superblock Recover, 55 GB / 51 GiB
recover_EXT2: s_block_group_nr=0/427, s_mnt_count=1/21, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13998592
recover_EXT2: part_size 111988736
Linux 18436 20 17 25407 14 15 111988736
EXT4 Large file Sparse superblock Recover, 57 GB / 53 GiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35581/5/9
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35581/5/9
FAT12 35581 5 9 35581 50 53 2880 [EFISECTOR]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35592/125/54
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35592/125/54
FAT12 35592 125 54 35592 171 35 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35592/171/36
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35592/171/36
FAT12 35592 171 36 35592 217 17 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35592/217/18
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35592/217/18
FAT12 35592 217 18 35593 7 62 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/7/63
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35593/7/63
FAT12 35593 7 63 35593 53 44 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/53/45
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35593/53/45
FAT12 35593 53 45 35593 99 26 2880 [SEAGATE]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/99/27
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35593/99/27
FAT12 35593 99 27 35593 145 8 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/145/9
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35593/145/9
FAT12 35593 145 9 35593 190 53 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 35593/190/54
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 35593/190/54
FAT12 35593 190 54 35593 236 35 2880 [EUROSOFT]
FAT12, 1474 KB / 1440 KiB
file_pread(5,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,7,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(5,8,buffer,1250265096(77825/102/46)) lseek err Invalid argument
file_pread(5,3,buffer,1250265104(77825/102/54)) lseek err Invalid argument
file_pread(5,3,buffer,1250265151(77825/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,1250265167(77825/103/54)) lseek err Invalid argument
file_pread(5,11,buffer,1250265214(77825/104/38)) lseek err Invalid argument
file_pread(5,2,buffer,1250267136(77825/135/7)) lseek err Invalid argument
Results
Linux 10981 176 12 17756 250 30 108845056
EXT4 Large file Sparse superblock Recover, 55 GB / 51 GiB
Linux 18436 20 17 25407 14 15 111988736
EXT4 Large file Sparse superblock Recover, 57 GB / 53 GiB
FAT12 35581 5 9 35581 70 9 4096 [EFISECTOR]
FAT12, 2097 KB / 2048 KiB
FAT12 35592 125 54 35592 190 54 4096 [NO NAME]
FAT12, 2097 KB / 2048 KiB
FAT12 35592 171 36 35592 217 17 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
FAT12 35592 217 18 35593 7 62 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 7 63 35593 53 44 2880 [NO NAME]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 53 45 35593 99 26 2880 [SEAGATE]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 99 27 35593 145 8 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 145 9 35593 190 53 2880 [DR-DOS]
FAT12, 1474 KB / 1440 KiB
FAT12 35593 190 54 35593 236 35 2880 [EUROSOFT]
FAT12, 1474 KB / 1440 KiB
interface_write()
No partition found or selected for recovery
#9
Posted 14 January 2012 - 11:15 AM
The log shows three disks:
The issue should be the TOSHIBA one:Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HTS725050A9A364, S/N:091104PCE400VLG29AGC, FW:PC4O
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - TOSHIBA MK6465GSX, S/N:Y0J8S1LHS, FW:GJ00
Disk /dev/sdd - 1031 MB / 984 MiB - CHS 125 255 63, sector size=512 - Memorex TD Classic 003C, FW:5.00
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
TESTDISK can find two Linux partitions and a number of floppy disk images, but it has found this:
1 P HPFS - NTFS 0 1 1 77824 254 63 1250258562
which does look as a primary partition, NTFS, on a disk partitioned with 2k/XP (old cylinder boundary scheme) with size:
1,250,258,562*512=640,132,383,744 bytes
Since the Toshiba disk is 77825*255*63=1,250,258,625*512=640,132,416,000 it should mean that the disk was previously partiioned in a single huge 640 Gb NTFS partition.
Can you confirm this?
If yes, you can try doing what is explained here:
http://www.cgsecurit..._for_partitions
highlight that partition and press p to see if the files are there.
then do like here and ONLY verify that the backup bootsector is OK:
http://www.cgsecurit...sector_recovery
It woud be a very good idea to backup:
- current MBR/partition table (even if invalid)
- current PBR/bootsector of that partition (even if invalid)
From a Linux you could dd the first 100 sectors of the disk to a file (on another disk), or do the same from Windows 7 (though windows 7 has some problems with letting programs access the MBR, so if using the latter you should put the disk offline first):
http://reboot.pro/8200/page__st__39
(it depends on the tool you have handy, some may work allright, as they do the same automatically)
Wonko
#10
Posted 14 January 2012 - 02:12 PM
#11
Posted 14 January 2012 - 02:26 PM
good, then you can proceed with the given steps.... and yes the drive was one big partition
Once you have the backup of the mentioned bunch of sectors (just in case), IF when pressing p you can see your files, THEN you can go on and try fixing the bootsector by using the backup one (IF TESTDISK says that the backup one is OK)
Wonko
#12
Posted 18 May 2012 - 06:41 PM
I don't normaly comment but that just annoyed me
#13
Posted 19 May 2012 - 02:06 PM
If you like "happy endings", here there is a good example :I don't normaly comment but that just annoyed me
http://reboot.pro/3833/
(and of course also a few peeps that simply disappeared. that's how life is )
Wonko
#14
Posted 19 May 2012 - 04:33 PM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users