testdisk interview questions
Top testdisk frequently asked interview questions
After my HDD got broken, Windows says it needs format. So, I'm using TestDisk to fix it.
But a read error always occurs when I execute the Quick Search or the Deep Search process.
To get one progress, it takes about 15min. It means more than 6 years to finish the search process. We can't wait for it.
[Error Detail]
Analyse cylinder */243200: 00%
Read error at **/241/1 (lba=15183)
(the number of ** is * minus 1.)
Could anybody tell me how to get data from the HDD if it's possible?
Or if you can guess what is wrong in HDD, please kindly tell me.
I also tried to use CloneZilla to copy whole HDD data to another one, but failed with an error "Unknown partition table format for ***".
Source: (StackOverflow)
The short story is I received a BSOD from a Windows program. I then couldn't boot Windows. My system is set up with GRUB to dual boot into CentOS, so I booted into CentOS and attempted to fix the MBR using TestDisk. Now I cannot boot into either OS, nor do I see GRUB. I am able to view files using TestDisk from a LiveCD so I can see they are still there. Below is the output from a bootinfoscript and a fdisk -l, running from Fedora LiveCD.
Currently when I boot to the hard drive I get a "Hard Drive Error" prompt, that is all.
sdd is the hard drive that contains the Windows and Linux partitions. It says GRUB is installed but I am not booting to it. I have tried to "Analyse" and a "Deeper Search" using testdisk and I forget the exact error but it could not come up with a table.
The table looks fine though according to the bootinfoscript.
Please, how can I fix this? There must be a way!
edit: I have tried booting the Windows 7 install disk and Repair mode does not see its partition. Additinoally CentOS repair mode does not see its partition.
bootinfoscript:
Boot Info Script 0.61 [1 April 2012]
============================= Boot Info Summary: ===============================
=> Windows is installed in the MBR of /dev/sda.
=> Grub Legacy (v0.97) is installed in the MBR of /dev/sdc and looks on boot
drive #1 in partition #3 for /grub/stage2 and /grub/grub.conf.
=> Testdisk is installed in the MBR of /dev/sdd.
=> Windows is installed in the MBR of /dev/sde.
sda1: __________________________________________________________________________
File system:
Boot sector type: -
Boot sector info:
Mounting failed: mount: unknown filesystem type ''
sdc1: __________________________________________________________________________
File system: ntfs
Boot sector type: Grub Legacy
Boot sector info: Grub Legacy (v0.97) is installed in the boot sector
of sdc1 and looks at sector 1 on boot drive #119 for
the stage2 file. A stage2 file is at this location on
/dev/sdd. Stage2 looks on the same partition for
/grub/stage2. No errors found in the Boot Parameter
Block.
Mounting failed: mount: unknown filesystem type ''
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
sdd1: __________________________________________________________________________
File system: ntfs
Boot sector type: Grub Legacy
Boot sector info: Grub Legacy (v0.97) is installed in the boot sector
of sdd1 and looks at sector 1 on boot drive #119 for
the stage2 file. A stage2 file is at this location on
/dev/sdd. Stage2 looks on the same partition for
/grub/stage2. No errors found in the Boot Parameter
Block.
Operating System:
Boot files: /bootmgr /Boot/BCD
sdd2: __________________________________________________________________________
File system: ntfs
Boot sector type: Grub Legacy
Boot sector info: Grub Legacy (v0.97) is installed in the boot sector
of sdd2 and looks at sector 1 on boot drive #119 for
the stage2 file. A stage2 file is at this location on
/dev/sdd. Stage2 looks on the same partition for
/grub/stage2. No errors found in the Boot Parameter
Block.
Operating System:
Boot files:
sdd3: __________________________________________________________________________
File system: ext4
Boot sector type: Grub Legacy
Boot sector info: Grub Legacy (v) is installed in the boot sector of
sdd3 and looks at sector 977307854 of the same hard
drive for the stage2 file, but no stage2 files can be
found at this location.
Operating System:
Boot files: /grub/menu.lst /grub/grub.conf
sdd4: __________________________________________________________________________
File system: Extended Partition
Boot sector type: Grub Legacy
Boot sector info: Grub Legacy (v0.97) is installed in the boot sector
of sdd4 and looks at sector 977306630 of the same hard
drive for the stage2 file. A stage2 file is at this
location on /dev/sdd. Stage2 looks on partition #3
for /grub/grub.conf.
sdd5: __________________________________________________________________________
File system: LVM2_member
Boot sector type: Grub Legacy
Boot sector info: Grub Legacy (v0.97) is installed in the boot sector
of sdd5 and looks at sector 977307806 of the same hard
drive for the stage2 file. A stage2 file is at this
location on /dev/sdd. Stage2 looks on partition #3
for /grub/grub.conf.
sde1: __________________________________________________________________________
File system: ntfs
Boot sector type: Windows Vista/7: NTFS
Boot sector info: According to the info in the boot sector, sde1 has
625137663 sectors, but according to the info from
fdisk, it has 625151361 sectors.
Operating System: Windows 7
Boot files: /Windows/System32/winload.exe
vg_mikenix-lv_root': ___________________________________________________________
File system:
Boot sector type: Unknown
Boot sector info:
Mounting failed: mount: unknown filesystem type ''
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800010004) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800010004) of index buffer is different from expected VCN (0x0).
mount: unknown filesystem type ''
vg_mikenix-lv_home': ___________________________________________________________
File system:
Boot sector type: Unknown
Boot sector info:
Mounting failed: mount: unknown filesystem type ''
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800010004) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800010004) of index buffer is different from expected VCN (0x0).
mount: unknown filesystem type ''
mount: unknown filesystem type ''
vg_mikenix-lv_swap': ___________________________________________________________
File system:
Boot sector type: Unknown
Boot sector info:
Mounting failed: mount: unknown filesystem type ''
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Failed to read last sector (1953534081): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/sdc1': Invalid argument
The device '/dev/sdc1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800010004) of index buffer is different from expected VCN (0x0).
ntfs_mst_post_read_fixup_warn: magic: 0x454c4946 size: 4096 usa_ofs: 48 usa_count: 2: Invalid argument
Actual VCN (0x1003800010004) of index buffer is different from expected VCN (0x0).
mount: unknown filesystem type ''
mount: unknown filesystem type ''
mount: unknown filesystem type ''
============================ Drive/Partition Info: =============================
Drive: sda _____________________________________________________________________
Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
Partition Boot Start Sector End Sector # of Sectors Id System
/dev/sda1 63 625,140,399 625,140,337 42 SFS
Drive: sdc _____________________________________________________________________
Disk /dev/sdc: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
Partition Boot Start Sector End Sector # of Sectors Id System
/dev/sdc1 2,048 1,953,536,129 1,953,534,082 7 NTFS / exFAT / HPFS
/dev/sdc1 ends after the last sector of /dev/sdc
Drive: sdd _____________________________________________________________________
Disk /dev/sdd: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
Partition Boot Start Sector End Sector # of Sectors Id System
/dev/sdd1 * 2,048 211,679 209,632 7 NTFS / exFAT / HPFS
/dev/sdd2 206,848 976,767,119 976,560,272 7 NTFS / exFAT / HPFS
/dev/sdd3 976,764,928 977,788,927 1,024,000 83 Linux
/dev/sdd4 977,788,928 1,953,525,167 975,736,240 5 Extended
/dev/sdd5 977,790,976 1,953,523,711 975,732,736 8e Linux LVM
/dev/sdd1 overlaps with /dev/sdd2
/dev/sdd2 overlaps with /dev/sdd3
Drive: sde _____________________________________________________________________
Disk /dev/sde: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
Partition Boot Start Sector End Sector # of Sectors Id System
/dev/sde1 * 2,048 625,153,409 625,151,362 7 NTFS / exFAT / HPFS
/dev/sde1 ends after the last sector of /dev/sde
"blkid" output: ________________________________________________________________
Device UUID TYPE LABEL
/dev/loop0 squashfs
/dev/loop1 DM_snapshot_cow
/dev/loop2 squashfs
/dev/loop3 b39d6418-8f98-4350-a48a-e70b0dd203f9 ext4 _Fedora-17-x86_6
/dev/mapper/live-osimg-min b39d6418-8f98-4350-a48a-e70b0dd203f9 ext4 _Fedora-17-x86_6
/dev/mapper/live-rw b39d6418-8f98-4350-a48a-e70b0dd203f9 ext4 _Fedora-17-x86_6
/dev/mapper/vg_mikenix-lv_home 52e59386-1ea4-4dd0-b94b-6b8dbe389358 ext4
/dev/mapper/vg_mikenix-lv_root 563ab476-602e-4c05-abb7-33b44a12d9fb ext4
/dev/mapper/vg_mikenix-lv_swap 342be5e7-dd8b-44e5-9e9f-c705e385ad4e swap
/dev/sdc1 80C2F69090FA0800 ntfs New Volume
/dev/sdd1 80C2F69090FA0800 ntfs System Reserved
/dev/sdd2 80C2F69090FA0800 ntfs
/dev/sdd3 34bfd48b-c8ca-41f3-a5cb-aa9991e98f2d ext4
/dev/sdd5 GxpmvW-powX-BiJ1-qaXB-SH9r-fuV3-WUeBef LVM2_member
/dev/sde1 EE524F21524EEDC1 ntfs
/dev/sr0 iso9660 Fedora-17-x86_64-Live-Desktop.is
========================= "ls -R /dev/mapper/" output: =========================
/dev/mapper:
control
live-osimg-min
live-rw
vg_mikenix-lv_home
vg_mikenix-lv_root
vg_mikenix-lv_swap
================================ Mount points: =================================
Device Mount_Point Type Options
/dev/mapper/live-rw / ext4 (rw,noatime,seclabel,user_xattr,barrier=1,data=ordered)
/dev/sr0 /run/initramfs/live iso9660 (ro,relatime)
============================= sdd3/grub/grub.conf: =============================
--------------------------------------------------------------------------------
# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You have a /boot partition. This means that
# all kernel and initrd paths are relative to /boot/, eg.
# root (hd0,2)
# kernel /vmlinuz-version ro root=/dev/mapper/vg_mikenix-lv_root
# initrd /initrd-[generic-]version.img
#boot=/dev/sdd
default=2
timeout=5
splashimage=(hd0,2)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.32-279.1.1.el6.x86_64)
root (hd0,2)
kernel /vmlinuz-2.6.32-279.1.1.el6.x86_64 ro root=/dev/mapper/vg_mikenix-lv_root rd_NO_LUKS LANG=en_US.UTF-8 rd_LVM_LV=vg_mikenix/lv_swap rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_LVM_LV=vg_mikenix/lv_root KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet
initrd /initramfs-2.6.32-279.1.1.el6.x86_64.img
title CentOS (2.6.32-279.el6.x86_64)
root (hd0,2)
kernel /vmlinuz-2.6.32-279.el6.x86_64 ro root=/dev/mapper/vg_mikenix-lv_root rd_NO_LUKS LANG=en_US.UTF-8 rd_LVM_LV=vg_mikenix/lv_swap rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_LVM_LV=vg_mikenix/lv_root KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet
initrd /initramfs-2.6.32-279.el6.x86_64.img
title Windows 7
rootnoverify (hd0,0)
chainloader +1
--------------------------------------------------------------------------------
=================== sdd3: Location of files loaded by Grub: ====================
GiB - GB File Fragment(s)
466.016604424 = 500.381518848 grub/grub.conf 1
466.016604424 = 500.381518848 grub/menu.lst 1
466.016795158 = 500.381723648 grub/stage2 1
465.821786880 = 500.172335104 initramfs-2.6.32-279.1.1.el6.x86_64.img 2
465.790484428 = 500.138724352 initramfs-2.6.32-279.el6.x86_64.img 2
465.826546669 = 500.177445888 initrd-2.6.32-279.1.1.el6.x86_64kdump.img 1
465.795757294 = 500.144386048 initrd-2.6.32-279.el6.x86_64kdump.img 1
465.804494858 = 500.153767936 vmlinuz-2.6.32-279.1.1.el6.x86_64 1
465.773245811 = 500.120214528 vmlinuz-2.6.32-279.el6.x86_64 1
======================== Unknown MBRs/Boot Sectors/etc: ========================
Unknown BootLoader on vg_mikenix-lv_root'
Unknown BootLoader on vg_mikenix-lv_home'
Unknown BootLoader on vg_mikenix-lv_swap'
========= Devices which don't seem to have a corresponding hard drive: =========
sdb
=============================== StdErr Messages: ===============================
ls: reading directory sdd2/: Input/output error
One or more specified logical volume(s) not found.
One or more specified logical volume(s) not found.
One or more specified logical volume(s) not found.
hexdump: /dev/mapper/vg_mikenix-lv_root': No such file or directory
hexdump: stdin: Bad file descriptor
hexdump: /dev/mapper/vg_mikenix-lv_root': No such file or directory
hexdump: /dev/mapper/vg_mikenix-lv_root': Bad file descriptor
One or more specified logical volume(s) not found.
One or more specified logical volume(s) not found.
One or more specified logical volume(s) not found.
hexdump: /dev/mapper/vg_mikenix-lv_home': No such file or directory
hexdump: stdin: Bad file descriptor
hexdump: /dev/mapper/vg_mikenix-lv_home': No such file or directory
hexdump: /dev/mapper/vg_mikenix-lv_home': Bad file descriptor
One or more specified logical volume(s) not found.
One or more specified logical volume(s) not found.
One or more specified logical volume(s) not found.
hexdump: /dev/mapper/vg_mikenix-lv_swap': No such file or directory
hexdump: stdin: Bad file descriptor
hexdump: /dev/mapper/vg_mikenix-lv_swap': No such file or directory
hexdump: /dev/mapper/vg_mikenix-lv_swap': Bad file descriptor
mdadm: No arrays found in config file or automatically
fdisk -l:
Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x48c044ea
Device Boot Start End Blocks Id System
/dev/sda1 63 625140399 312570168+ 42 SFS
Disk /dev/sdc: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x75f7e06d
Device Boot Start End Blocks Id System
/dev/sdc1 2048 1953536129 976767041 7 HPFS/NTFS/exFAT
Disk /dev/sdd: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x812f5830
Device Boot Start End Blocks Id System
/dev/sdd1 * 2048 211679 104816 7 HPFS/NTFS/exFAT
/dev/sdd2 206848 976767119 488280136 7 HPFS/NTFS/exFAT
/dev/sdd3 976764928 977788927 512000 83 Linux
/dev/sdd4 977788928 1953525167 487868120 5 Extended
/dev/sdd5 977790976 1953523711 487866368 8e Linux LVM
Disk /dev/sde: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x14a014a0
Device Boot Start End Blocks Id System
/dev/sde1 * 2048 625153409 312575681 7 HPFS/NTFS/exFAT
Disk /dev/mapper/live-rw: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders, total 8388608 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk /dev/mapper/live-osimg-min: 4294 MB, 4294967296 bytes
255 heads, 63 sectors/track, 522 cylinders, total 8388608 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk /dev/mapper/vg_mikenix-lv_root: 53.7 GB, 53687091200 bytes
255 heads, 63 sectors/track, 6527 cylinders, total 104857600 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk /dev/mapper/vg_mikenix-lv_home: 439.6 GB, 439609196544 bytes
255 heads, 63 sectors/track, 53446 cylinders, total 858611712 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk /dev/mapper/vg_mikenix-lv_swap: 6274 MB, 6274678784 bytes
255 heads, 63 sectors/track, 762 cylinders, total 12255232 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Source: (StackOverflow)
Due to a freezing problem I've had on Ubuntu, I want to test the GPU in detail because I think it is connected to my problem.
I've tried the Phoronix Test Suite but I don't think that the three benchmark tests on the DVD are intended to find hardware errors with my graphics card. I don't care about benchmark tests but I want to find possible hardware errors.
Which tests can be recommended for my intent?
Source: (StackOverflow)
I tested the micro SD card of my phone with testdisk, and it says somethings about heads/cylinder mismatch. What is that? SD card should not have heads...
Source: (StackOverflow)
Primarily I'm looking for:
Details of what TestDisk means by "Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)"
Analysis or suggestions regarding what probably went wrong and how to best undo/recover from it.
Suggestions on good (preferably free) software tools for partition / disk editing and recovery
But any ideas, information or suggestions on how to best deal with this would be appreciated.
Responses that boil down to giving up (hire a data recovery company, restore from backups, you can't recover from this, etc) are not going to be productive. I just started this process and have recovered data under much worse conditions in the past so I'm not going to give up on this after only a couple hours. The circumstances are different and I'm very unfamiliar with current tools though which is why I'm seeking advice.
Quick Summary
I have a 6 TB drive using GUID partition structure that contained 1 small reserved and 1 large NTFS partition. Windows stopped recognizing these and was displaying the entire disk as RAW in Disk Management. TestDisk could see the partitions (it displayed the reserved one twice) and could even list the files on the NTFS partition.
After having TestDisk write the partition data the NTFS partition is now displayed as Unallocated in Disk Management and even TestDisk can not display the file contents! I think it wrote the wrong partition data for the NTFS partition (see the before & after backup logs below).
Decided its best to stop making changes and seek advice before proceeding.
Complete Details
I've got a 6 TB RAID 5 disk in my home server that's using HighPoint RocketRAID card. The power supply on the system died and it was off-line for awhile. Just replaced the power supply and everything seems fine except the 6TB drive now appears as RAW in Windows Disk Management instead of containing my NTFS data volume. The OS (Windows Server 2012 Standard) was on a different drive and boots fine.
Tried several recovery software tools to get the partition and/or data back. Both TestDisk (open source) and Active Partition Recovery (commercial) could see the partitions (1 small reserved, 1 large data) and could list my files. I paid for Active Partition Recovery and tried it since it seemed the most straight forward to use. Unfortunately it stopped during the restore partition process one prompt after where it requires a commercial license saying it can't recover the partition because its already active or live or something. Completely bogus, I'll be seeking a refund or a charge back (FYI).
TestDisk after running Analyze over night displayed a list of my files then allowed me to perform data recovery. I've discovered that you can "stop" the Analyze once it displays the partitions (which is almost immediate) instead of leaving it to run multiple hours which doesn't seem to change its results. I'm guessing / hoping that's fine to do because I updated to version 7 of TestDisk (was running 6.12), ran analyze again and stopped it to proceed.
TestDisk could have copied the data to a different location. Unfortunately I don't have 6 TB of disk space available to copy the data off so I tried writing the partitions and fixing it in-place. When I got to the repair partition options I had it "Write" the partition data to disk. It completed and said I needed to reboot to see the changes.
After rebooting Windows Disk Management now displays 2 small partitions and 1 big chunk of unallocated space. This is obviously wrong and the NTFS data is not accessible at all. Even TestDisk can't display the file contents and now shows "Can't open filesystem. Filesystem seems damaged." after performing Analyze.
Below is all of the relevant information I can think of which might help resolve this issue. I'm very experienced with system administration and such but have no experience with TestDisk and haven't had to manipulate / recover partitions in 10+ years so I'm stale and my memory is fuzzy on the topic.
Any advice or help would be greatly appreciated. If there are other tools that would help me recover the data I'm open to that (as long as they aren't expensive, though free would be preferred).
TestDisk Backup.log (before)
1406052104 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
1 : start= 34, size= 262144, Id=00, P
2 : start= 264192, size=3130388480, Id=00, P
TestDisk Backup.log (after)
1406053772 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
1 : start= 2048, size= 204800, Id=00, P
2 : start= 206848, size=125829120, Id=00, P
Windows Disk Management (before)
I didn't write it down but the entire drive showed as a single RAW entry
Windows Disk Management (after)
Disk 3, Basic, 5588.81 GB, Online
100 MB RAW, Healthy (Primary Partition)
60 GB RAW, Healthy (Primary Partition)
5528.71 GB, Unallocated
TestDisk Analyze display output (before) *
I didn't save this. I believe it displayed the 1st reserved partition twice (with identical start and stop positions) and then the NTFS partition once. It also displayed number of bytes per sector mismatches warnings and I believe the numbers were the same before and after.
TestDisk Analyze display output (after) *
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
Current partition structure:
Partition Start End Size in sectors
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
Hardware RAID
This is a RAID 5 disk implemented in hardware using a HighPoint RocketRAID card. RAID is configured using the card, not in Windows Disk Management. So Windows just sees this as a single large 6 TB drive and the fact that its a hardware RAID should be irrelevant.
TestDisk log file
Note that this is the complete log containing multiple runs. The run that performed the write begins with Tue Jul 22 11:27:07 2014 or just search for "write!"
Tue Jul 22 11:26:54 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00
SIGINT detected! TestDisk has been killed.
Tue Jul 22 11:27:07 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00
Partition table type (auto): EFI GPT
Disk /dev/sdd - 6000 GB / 5588 GiB - HPT DISK 0_0
Partition table type: EFI GPT
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Backup partition structure
partition_save
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
gpt_change_part_type
Change partition type:
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Change partition type:
P NTFS 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_load
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63 Tue Jul 22 11:29:32 2014
1 P Unknown 2048 206847 204800
2 P Unknown 206848 126035967 125829120
interface_write()
1 P MS Data 2048 206847 204800
2 P MS Data 206848 126035967 125829120
write!
No extended partition
You will have to reboot for the change to take effect.
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720589311)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
gpt_change_part_type
Change partition type:
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Change partition type:
P NTFS 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
interface_write()
1 P MS Data 2048 206847 204800
2 P MS Data 206848 126035967 125829120
simulate write!
New geometry
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63 sector_size=2048
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
file_pread(7,4,buffer,3130703844(729575/254/60)) lseek err Invalid argument
Bad GPT partition, invalid signature.
Trying alternate GPT
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
NTFS at 0/8/9
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 512 51711 51200
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 3/55/53
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 51712 31508991 31457280
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 512 51711 51200
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 51712 31508991 31457280
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 51712 31508991 31457280
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P MS Data 512 51711 51200
2 P MS Data 51712 31508991 31457280
simulate write!
New geometry
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63 sector_size=512
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720638439)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 51200
sectors_per_cluster 2
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
NTFS part_offset=105906176, part_size=64424509440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/223/20
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
filesystem size 31457280
sectors_per_cluster 2
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -11
clusters_per_index_record 1
MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Search for partition aborted
Results
P MS Data 2048 206847 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
P MS Data 206848 126035967 125829120
NTFS, blocksize=4096, 64 GB / 60 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P MS Data 2048 206847 204800
2 P MS Data 206848 126035967 125829120
simulate write!
Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11720589311 (expected 11720638439)
hdr_lba_start=34
hdr_lba_end=11720589278
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
1 P MS Data 2048 206847 204800
Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
2 P MS Data 206848 126035967 125829120
Source: (StackOverflow)
I have an SD card with pictures and video which malfunctioned. I was able to recover the files with Photorec. The pictures are OK, but wen I try to open the vide files (*.mov extension) in get the following errors when I try to open them in the following programs
- Windows Media player: "Windows Media Player encountered a problem while playing the file"
- Quicktime: "Error -2048: Couldn't open the file because it is not a file that QuickTime understands"
- VLC: it shows the first frame of the video and the sound is just white noise
The filesizes look correct so I presume the data is still in there. Is there any way to fix these recovered video files?
Source: (StackOverflow)
I'm trying to recover data from a 1TB drive removed from my NAS, but when I run fdisk -lu /dev/sdb I get a message saying that there's no valid partition table.
From what I understand the partition table resides within the first 512 bytes on the disk, so as there's no partition table there at the moment, will I do any damage by writing a new one?
Testdisk has found three partitions, I assume by scanning the sectors on the drive, surely if I write this partition table to disk it will only affect the first 512 bytes? If it turns out they aren't correct, I've lost nothing, all my data is still in tact on the rest of the disk isn't it?
Can I not re-write the partition table as much as I want so long as I don't change anything else on the disk? If I keep blatting the first 512 bytes and then run Testdisk again, it's scan should still find the three original partitions in their original locations on the disk?
I'm reluctant to continue by writing that partition table to disk if it's going to affect the actual data on the disk outside of those first 512 bytes.
Any guidance would be appreciated.
Regards
Rich
Source: (StackOverflow)
It's a real messed situation, but I'm quite at the end of my options.
It's my personal hardrive, so it's very important for me, and yes, I have no backup =(
The short story:
I have two discs. One with Windows, and another where I had a bit of empty space at the front of the disk, so i could install Linux. The rest was occupied by a 1.8TB NTFS partition filled with data.
I installed Linux, and after a while realized there was not enough space for everything, so I tried using Gparted, and told it to re-size the NTFS partition, to a lesser size.
The system jammed. I had to reboot and broke the Resizing operation.
Here's what I did to fix it:
Rebooted into Linux Live, and used Testdisk,to deep analyze the disk, and recover the possible partitions. It found several versions of the NTFS partitions, probably made during the resizing. I told Testdisk to open every one of them, and only one could list its files. When trying to open the other options on Testdisk, it showed an error message. I assumed the one without errors, to be the correct one, and I told Testdisk to recover the partition, and write a new MBR.
The partition had errors, and Linux has a NTFS fixing tool, used it, but the system still had errors.
So I booted into windows and use chkdsk to correct all errors in the partition.
Everything seems fine, but now, back in Windows, when I open one file, it opens another file, or part of another file. As in, some files took up the position of other files.
What I think happened is that I recovered an old tree, and not the most current one. And that one just happened to be intact, while the most recent one was damaged. As such, the files that were moved during the failed resizing, were now, during the automatic correction, assumed wrongly to be in their correct places.
So when I open a file, it tries to open another one. Radiohead - Creep.mp3 will open and it will actually be a bit from another song, or even code from a jpg. Some files seem to be all right, but others have seemed to have had their position taken by others.
Anyone knows of something really powerful that can help me solve this?
Source: (StackOverflow)
I used TestDisk to recover files from an internal hard drive which I connected externally to another PC. With PhotoRec all the file names are wrong and the original folder structure doesn't exist.
What can be done?
Source: (StackOverflow)
I have an netbook hard drive that won't boot or be mounted and is refusing to cooperate in my debugging. There were two partitions on the disk, an Acer installed recovery partition and my main XP one.
Summary:
Only the 6GB recovery partition is mountable, and appears to be fine. Testdisk recreated the partitions, but can't read from the main one. Hitachi hardware diagnostics check out fine. Nothing I do seems to recognize a file system on the main partition. The master boot record seems to be problematic.
Environment:
Acer Aspire One AOD150 netbook in original configuration.
XP Home Premium, updated and current.
Original Hitachi 5K320-160 hdd.
BIOS 1.13.
I don't have access to an external drive enclosure for now.
How it started:
I was writing in a web form (Chrome) when the netbook locked instantly and completely (no pointer movement; ctr-alt-del did nothing). I held the power button down to reboot, and when it came back up, the BIOS started looping through alternate boot options. It said there was no boot disk, as if the hard drive wasn't connected.
Troubleshooting performed and results:
Unseated and reseated the hard drive. No effect.
Booted to a Knoppix 6.4.3 CD. Hard drive was not visable to mount.
Ran testdisk (Intel option; NO to Vista partition question) which originally showed 4 nonsensical, overlapping partitions. The quick search found the 2 real NTFS partitions, and appeared to have the size correct. The deeper search showed the same results. The "p" command allowed me to view files in the recovery partition, but gave an error for the main partition "Can't open filesystem. Filesystem seems damaged." I switch the main drive to primary bootable. Even though it wasn't working completely, I wrote the partitions to disk.
Rebooted to Knoppix. It can now see and mount the PQSERVICE recovery partition. I can't browse to the main partition, but fdsik -l shows both partitions. The Disk Utility shows the 160GB drive as healthy, but only finds the one 6.4GB partition.
GParted shows both partitions plus 2.49 MiB unallocated, but gives a bunch of warnings for the main: "$MFT had invalid magic. ntfs_mft_load():Failed. Failed to load $MFT: Input/output error. Failed to startup volume: Input/output error. Failed to mount '/dev/sda2': Input/output error. NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!" I then tried "Check and repair filesystem (ntfs)..." in GParted. Same error as above.
Booted to Ultimate Boot CD UBCD 5.0.3. Ran the Diagnosis Drive Fitness Test v4.16 for the Hitachi drive. Both the quick and full scans completed without error.
Used Smart BootManager to boot to the PQSERVICE recovery partition (Alt+F10 isn't working). It loads fine. I'm not yet willing to try to recover to factory defaults and sacrifice my data.
Ran MBRtool and MBRWork, rebooting after each. Now the BIOS says "A disk read error occurred press Ctrl+Alt+Del to restart".
Booted to UBCD4Win 3.60. Ran chkdsk /r on the recovery partition, without error. chkdsk would not run on the main partition.
Originally I couldn't boot to a Windows Recovery Console CD. It blue-screened giving a STOP 0x0000007B error that the drive wasn't accessable. I went into the BIOS and changed the hard drive interface from AHCI to IDE. I can now boot to the Recovery Console.
Ran chkdsk again, same results as before.
Ran fixboot and rebooted, no change.
Ran fixmbr and rebooted, no change.
But in IDE mode, I can't see the recovery partition anywhere. I have to switch it back to AHCI to view it in Knoppix or get testdisk to recognize the drive.
Plea for help:
I would really like to know what's going on. Is it a hardware problem that isn't detected by SMART or the Hitachi diagnostics? Or is it just a bad MBR that I can't seem to get right? Is my best bet to give up on the data, reformat, and reinstall? Or is there something more I can try?
Thanks much!
UPDATE:
On a hunch, I went back and reran testdisk, choosing to search for Vista partitions even though it's an XP install. The quick search showed no improvement, but the deeper search uncovered the deleted ACER partition. After writing to disk, the computer rebooted into XP as if nothing had ever happened.
I'm running chkdsk now just to be safe, but it seems to be back to normal. Hooray!
Source: (StackOverflow)
My Western-Digital hard drive (WDC WD3200BEVT-80A0RT1) got broken yesterday. I don't care about the data on it, but I want to reuse this disk. As long as I do not have Windows installation DVD anymore (to use it's repair feature) I want to install Linux Mint. I thought it is possible reformat and reuse the disk. But installing the Linux with reformatting failed (some kind of disk error, I haven't captured it, but the disk got formatted as ext4). So I'm trying to fix bad sectors. e2fsck fails with:
mint@mint:~ >sudo e2fsck -cpfv /dev/sda
e2fsck: Bad magic number in super-block while trying to open /dev/sda
/dev/sda:
The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem. If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>
or
e2fsck -b 32768 <device>
Using -b 8193 and -b 32768 gives the same result. I also executed sudo swapoff -a and retried, to be clear, with no luck. I've googled for mke2fs -n and executed it:
mint@mint:~ >sudo mke2fs -n /dev/sda
mke2fs 1.42.9 (4-Feb-2014)
/dev/sda is entire device, not just one partition!
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
19537920 inodes, 78142806 blocks
3907140 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=4294967296
2385 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616
None of that superblocks resulted in sudo e2fsck -b <...> -cpfv /dev/sda to succeed.
Finally, I've run a testdisk (took ~1 day), which gave me a list with ~20 partitions:
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Warning: the current number of heads per cylinder is 255
but the correct value may be 32.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Partition Start End Size in sectors
FAT32 LBA 0 1 1 30687 254 63 493002657 [FD_BETA9SR2]
Linux 0 32 33 3647 67 4 58591232
HPFS - NTFS 0 32 40 12 223 19 204793
> HPFS - NTFS 12 223 19 25 158 61 204793
HPFS - NTFS 12 223 20 9787 241 54 157036544
HPFS - NTFS 12 223 27 9787 241 54 157036537
Linux 3647 99 37 5471 5 38 29296640
Linux 5471 5 39 37940 182 2 521625600
Linux 6527 21 23 7179 201 62 10485760
Linux 6527 183 57 7180 109 33 10485760
Linux 6528 123 60 7181 49 36 10485760
Linux 6529 129 1 7182 54 40 10485760
Linux 9339 248 62 9992 174 38 10485760
Linux 9341 96 36 9994 22 12 10485760
Linux 9342 166 41 9995 92 17 10485760
Linux 9577 218 50 10230 144 26 10485760
Linux 9602 52 51 10254 233 27 10485760
HPFS - NTFS 9787 241 54 19563 5 18 157036537
HPFS - NTFS 9787 241 55 38913 70 5 467898368
HPFS - NTFS 9787 241 62 38913 70 5 467898361
Linux 29792 47 16 30902 206 24 17842176 [_CentOS-6.5-x86_]
Linux 29794 89 56 30904 249 1 17842176 [_CentOS-6.5-x86_]
Linux Swap 37940 214 35 38913 37 36 15620096
I tried changing heads per cylinder, but testdisk complained: Warning: the current number of heads per cylinder is 32 but the correct value may be 255.
And then I stuck because I do not understand this output, and how can I repair disk from here.
Are there any commands that can repair my disk and prepare it for new installation?
Source: (StackOverflow)
I have a total of 4 operating systems installed on my notebook. I use a WD Blue 1TB 2.5" internal HDD. The installed OSes are Win XP, Win 7, Win 8 and Ubuntu.
Of these, Windows XP only boots when I change my HDD operation mode from AHCI to IDE because I couldn't find the right SATA driver for it during installation.
A few days ago, due to a power outage and failed notebook batteries, my computer shut down improperly. At the time, it was connected to a 2TB WD external HDD. Since then, my computer wouldn't boot and spit out the following error code :
0x0000225 ("Windows failed to start. A recent hardware or software change might be the cause")
I read on a forum somewhere that other people have also experienced the same problem when they've left an external USB HDD connected to the computer while it shut down.
I tried all the regular methods (startup repair, bcdboot, bcdedit, etc.) but nothing worked so I booted from a GParted Live CD and ran testdisk, read the instructions and after quite a bit of trial and error, got Windows 8 to boot again.
After booting to Win 8, I was missing several partitions so I ran testdisk again, performed a Deeper Search for partitions and this is what I got:
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
> HPFS - NTFS 0 32 33 1529 232 47 24576000 [PQSERVICE]
HPFS - NTFS 0 32 40 1529 232 47 24575993
HPFS - NTFS 1529 232 47 3059 177 54 24575993
HPFS - NTFS 1529 232 48 1542 168 34 204800 [SYSTEM RESERVED]
HPFS - NTFS 1529 232 55 1542 168 34 204793
HPFS - NTFS 1530 64 21 1542 254 63 204793
HPFS - NTFS 1542 168 27 1555 104 6 204793
HPFS - NTFS 1542 168 34 1555 104 13 204793
HPFS - NTFS 1542 168 42 10680 147 27 146800633
HPFS - NTFS 10680 147 28 38678 245 31 449794048 [Miscellaneous]
HPFS - NTFS 10680 157 4 38678 254 63 449794041
HPFS - NTFS 20176 216 9 33230 226 20 209713152 [RootWin7]
HPFS - NTFS 20176 216 16 33230 226 20 209713145
HPFS - NTFS 20176 216 16 41048 185 33 335306745
HPFS - NTFS 41048 218 3 54102 228 14 209713152 [RootWin8]
HPFS - NTFS 41048 218 10 54102 228 14 209713145
HPFS - NTFS 41048 218 10 62864 188 44 350472185
HPFS - NTFS 41048 244 59 54102 254 63 209713145
HPFS - NTFS 62864 221 14 89313 212 51 424902656 [Music and Other St
HPFS - NTFS 62864 221 21 89313 212 51 424902649
HPFS - NTFS 62865 8 33 89313 254 63 424902649
HPFS - NTFS 87764 171 31 115763 14 27 449794041
HPFS - NTFS 89313 245 21 115762 236 58 424902656 [Movies and TV Sho
HPFS - NTFS 89313 245 28 115762 236 58 424902649
Linux 100907 14 36 102404 52 48 24051712
Linux 100914 115 2 102411 153 14 24051712
HPFS - NTFS 115763 14 28 119679 45 46 62912512 [Stuff]
HPFS - NTFS 115763 14 35 119679 45 46 62912505
HPFS - NTFS 115763 223 52 119679 254 63 62912505
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
I can't see the Windows XP partiton in the list (probably because my HDD is currently set to AHCI mode?)
All the partitions without a label are corrupt but the partitions with labels are fine and I can access their files using the "P: list files" option of Testdisk.
Currently, the SYSTEM RESERVED partition is set as primary bootable and I have made no changes to the partition table since booting into Windows 8 for fear of screwing something up.
I ran Easy BCD and here's what I got:
There are a total of 4 entries listed in the bootloader.
Default: Windows 7
Timeout: 30 seconds
EasyBCD Boot Device: C:\
Entry #1
Name: Earlier Version of Windows
BCD ID: {ntldr}
Device: \Device\HarddiskVolume1
Bootloader Path: \ntldr
Entry #2
Name: Windows 8
BCD ID: {current}
Drive: C:\
Bootloader Path: \Windows\system32\winload.exe
Entry #3
Name: Windows 7
BCD ID: {default}
Device: unknown
Bootloader Path: \Windows\system32\winload.exe
Entry #4
Name: Ubuntu
BCD ID: {04e5904e-05ff-11e2-a3bd-9cf748453e70}
Device: unknown
Bootloader Path: \ubuntu\winboot\wubildr.mbr
How can I recover all my partitions and get all the OSes booting again?
Could you help me set the correct attribute (primary, logical, primary bootable, etc.) to each of the partions that Testdisk recovers?
Also, here's a link to the complete Testdisk Log after the Deeper Scan stage: https://db.tt/LPmoGWn0
Source: (StackOverflow)
My desktop's motherboard recently died and I decided to salvage its 2 500GB HDDs while I save up for a new mobo. I bought a docking station to use with my laptop. One HDD works flawlessly; however the other won't. It showed up in Disk Management as "invalid" but it wouldn't show up at all in My Computer. I did a bit of research and I found out you could trick Windows into recognizing the drive by using HXD (a hex editor) to change the HDD's status from dynamic to basic.
It worked. Somewhat. It showed up in My Computer but it said it needed to be formatted. Of course I declined, I really need the data on the broken HDD. (Years worth of pics and videos, my bad for not having a backup) I used testdisk to check if I could recover the partitions. it said it could recover all the partitions EXCEPT for the one with the photos on it.
Is there anyway to recover the data, short of going to a data recovery service?
Many thanks! :D
Source: (StackOverflow)
My situation:
I have an older 80GB IDE internal hdd, with a few files on it that I would like very much to recover:
- some word documents
- some latex documents (text files) and pictures (png, jpg, eps files)
- some other text documents and visual studio project files
I had backed them (not the latex ones though) up using svn, but have not committed lately, and would lose a lot of work if I can't recover.
The HDD seems to have lost its filesystem, I have no idea how it came about.
I know it has/had 3 NTFS partitions, I know the files I want are on the second or third partition.
I read http://superuser.com/questions/81877/recover-hard-disk-data
Partition Find and Mount did not see all the partitions using intelligent scan
TestDisk does (I think), I followed the step by step instructions here, but when I try to list the files it says:
"Can't open filesystem, filesystem seems damaged."
I'm not sure how to proceed here, as TestDisks wiki does not contain this error message afaik.
I don't know if the HDD is going to fail, or some program has caused the filesystem to be corrupt, the HDD doesn't make a sound, so I guess that's good.
I would like some guidance so I don't accidentally cause more damage. (eg. is it ok to let testdisk write the filesystem to disk? I'm pretty sure the partitions are listed ok, but not 100%)
EDIT: running photorec atm
Source: (StackOverflow)
I have several (around 10) Seagate drives, some older and smaller (80GB, 160GB) some newer and larger (1.5 TB, etc). I wanted to check which one is still in good health - and I installed SeaTools for Windows.
When I choose Long Test, which should work by reading all sectors, all drives check out. If I choose "Long Test and Fix All", sometimes the result is that drive is ok, sometimes (mostly) it says that that disk is unrecoverable - this happens randomly with all tested disks, Long Test is ok, "Long Test and Fix All" sometimes fail, sometimes disk appears ok (with the same drive).
In the system (drive manager), drives are disabled, so they are accessed only by SeaTools. I thought that this kind of diagnostics should be quite consistent, and what's more, now I don't know how to realistically determine state of the drive. When I use Data Life Guard from WD, all tests are OK, SMART events are not tripped, but random behavior of SeaTools puzzles me.
I also tried SeaTools for DOS, where there is only option Long test and Full Erase. Again, all disks check out, but sometimes when I perform full erase (thus writing to all sectors), the software crashes with some drives.
Do you have similar experience? Or how how would you realistically determine state of the drive?
Source: (StackOverflow)