recovering data using testdisk
 

Hi,
I am not sure if this is the right place for this question so please tell where it should go if not.

Recently i accidentally partially formatted a fat32 file system with NTFS on a usb hard drive (backup drive). After a bit of searching i was told that testdisk (i'm running from linux as i usually use linux) may be the way to go to recover the data. After looking thru the examples there didnt seem to be a way of recovering from this sort of problem. So i thought i would ask first before potentially making things worse. See the outputs below.

Firstly the number of sectors as calculated by testdisk are different from that designated for the particular drive (taken from the back of he drive itself = 16383,16,63 = cyl,hds,sec).

The question is what should i do next. Any help is much appreciated. Also - i couldnt seem to find a forum for testdisk itself.

Cheers.


Output from "analyse" option:
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32
Current partition structure:
Partition Start End Size in sectors

Warning: Incorrect number of heads/cylinder 255 (NTFS) != 64 (HD)
Warning: Incorrect number of sectors per track 63 (NTFS) != 32 (HD)
1 P HPFS - NTFS 0 1 32 33102 43 28 67794237

Warning: Bad ending sector (CHS and LBA don't match)
check_FAT: Bad number of entries in root dir
Invalid FAT boot sector
2 * FAT32 LBA 33102 43 29 38107 19 26 10249470
2 * FAT32 LBA 33102 43 29 38107 19 26 10249470

Warning: Bad starting sector (CHS and LBA don't match)
3 P EFI (FAT-12/16/32) 38107 19 27 38146 33 31 80325

Next
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
[Quick Search] [ Backup ]
Try to locate partition


Output from quick search option:
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32

Warning: the current number of heads per cylinder is 64
but the correct value may be 255.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32
Partition Start End Size in sectors
L HPFS - NTFS 0 1 32 33102 63 32 67794881

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, 34 GB / 32 GiB

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38155 64 32

Partition Start End Size in sectors

1 E extended LBA 0 1 1 33102 63 32 67794912
5 L HPFS - NTFS 0 1 32 33102 63 32 67794881

[ Quit ] [Deeper Search] [ Write ] [Extd Part]
Try to find more partitions

The answer is listed in the output line "You can use the Geometry menu to change this value.". It's under "options" IIRC. Before writing to the original medium it is strongly suggested to make a backup with 'dd'. Also see the companion application 'photorec' which takes a brute-force approach to recovering information by looking at file header/footer information. Avoid writing recovered information to the same physical disk.


AFAIK it has none but Grenier's Cgsecurity.org Wiki lists recovery information and there are multiple threads at LQ on the subject of testdisk / photorec you could look at.

Hi,
Thanks for the reply. I actually tried using the Geometry menu and put in the values written on the drive but this did not work, in fact when using these setting testdisk indicated that there were no partitions at all and the drive capacity was 8.5MB (at least with the wrong geometry it got the disk capacity right) when in fact it is 40 GB so am a little bit reluctant to use these settings however testdisk does indicate that unless i have the write geometry it wont be able to find the correct partitions so i am currently running around in circles a little bit trying to avoid writing anything to the disk till i am sure things are correct.

I may just try some different values and see what happens.

Cheers.

You only need to set 255 cylinders as TestDisk told you.

Hi Christophe,
Thanks for the reply, its much appreciated, however i am still a bit confused and dont want to make things worse so i was i hoping you might be able to walk me thru the process.

So, using testdisk, i have gone to the analyse section and the results are:

So, what should i do next, alter the number of cyl, heads etc in the Geometry section (to what)? DO a quick search?

If you could set out the correct approach that would be great. Any help you can give is much appreciated.

Cheers.

A walk is still too much risk...

It might be better if you told us that you had used "dd" or a copy of the Clonezilla live-cd to make a copy of your HDD before you started to work on the original.

Many of us can give you advice, but the files are yours and the responsibility rests with you.

You give yourself more than one chance to get it all right by making a copy.

Hi Thorkelljarl,
Thanks for the reply. I actually used photorec first which seemed to work and retrieved about 22GB of files which is about what was on the drive however none of the files have file names (just numbers and correct extensions) and since there are thousands and thousands of files it is a big task to locate the files i am after but at least they are saved so if the worst comes to the worst i do have them.

So if you cold still walk me thru the process that would be great. Thanks for your help.

Cheers.

In Geometry, set 255 heads and 63 sectors
In Advanced, select the FAT32, choose Boot, RebuildBS, List. If you can see your files and navigate in the subdirectories, choose Write and confirm. Quit and reboot

Hi Christophe,
And thanks for the reply, it is much appreciated.
OK i did as you suggested and when the "rebuildBS" bit completed i got the following message: "cant find cluster size".

Below is a log of the session although not the complete log as the whole log file was 44MB in size!

Any further help you can give me would be great.

Cheers.

There are a lot of read errors due to bad sectors. The problem is worst than expected. Try PhotoRec 6.11.3 or 6.12-WIP to recover some data. Note that it will recover most files but not the directory structure.

You could also use hard drive regenerator to fix the bad sectors on your hard disk. It won't affect the data on it and it will repair all of your bad sectors. I was getting bad sector results on the smart self test and the surface scan test than I used the boot disk that you can create and it completely fixed the hardware problems on my dead windows system... It costs 60 dollars though so you might want to look for a cheaper solution.