LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
LinkBack Search this Thread
Old 11-13-2009, 07:26 PM   #1
katesfb
Member
 
Registered: Nov 2006
Posts: 58

Rep: Reputation: 15
recovering data using testdisk


Hi,
I am not sure if this is the right place for this question so please tell where it should go if not.

Recently i accidentally partially formatted a fat32 file system with NTFS on a usb hard drive (backup drive). After a bit of searching i was told that testdisk (i'm running from linux as i usually use linux) may be the way to go to recover the data. After looking thru the examples there didnt seem to be a way of recovering from this sort of problem. So i thought i would ask first before potentially making things worse. See the outputs below.

Firstly the number of sectors as calculated by testdisk are different from that designated for the particular drive (taken from the back of he drive itself = 16383,16,63 = cyl,hds,sec).

The question is what should i do next. Any help is much appreciated. Also - i couldnt seem to find a forum for testdisk itself.

Cheers.


Output from "analyse" option:
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32
Current partition structure:
Partition Start End Size in sectors

Warning: Incorrect number of heads/cylinder 255 (NTFS) != 64 (HD)
Warning: Incorrect number of sectors per track 63 (NTFS) != 32 (HD)
1 P HPFS - NTFS 0 1 32 33102 43 28 67794237

Warning: Bad ending sector (CHS and LBA don't match)
check_FAT: Bad number of entries in root dir
Invalid FAT boot sector
2 * FAT32 LBA 33102 43 29 38107 19 26 10249470
2 * FAT32 LBA 33102 43 29 38107 19 26 10249470

Warning: Bad starting sector (CHS and LBA don't match)
3 P EFI (FAT-12/16/32) 38107 19 27 38146 33 31 80325

Next
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
[Quick Search] [ Backup ]
Try to locate partition


Output from quick search option:
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32

Warning: the current number of heads per cylinder is 64
but the correct value may be 255.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32
Partition Start End Size in sectors
L HPFS - NTFS 0 1 32 33102 63 32 67794881

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
NTFS, 34 GB / 32 GiB

Disk /dev/sdb - 40 GB / 37 GiB - CHS 38155 64 32

Partition Start End Size in sectors

1 E extended LBA 0 1 1 33102 63 32 67794912
5 L HPFS - NTFS 0 1 32 33102 63 32 67794881

[ Quit ] [Deeper Search] [ Write ] [Extd Part]
Try to find more partitions
 
Old 11-14-2009, 05:04 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,521
Blog Entries: 51

Rep: Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599Reputation: 2599
Quote:
Originally Posted by katesfb View Post
the number of sectors as calculated by testdisk are different from that designated for the particular drive
The answer is listed in the output line "You can use the Geometry menu to change this value.". It's under "options" IIRC. Before writing to the original medium it is strongly suggested to make a backup with 'dd'. Also see the companion application 'photorec' which takes a brute-force approach to recovering information by looking at file header/footer information. Avoid writing recovered information to the same physical disk.


Quote:
Originally Posted by katesfb View Post
i couldnt seem to find a forum for testdisk itself.
AFAIK it has none but Grenier's Cgsecurity.org Wiki lists recovery information and there are multiple threads at LQ on the subject of testdisk / photorec you could look at.
 
Old 11-15-2009, 02:04 AM   #3
katesfb
Member
 
Registered: Nov 2006
Posts: 58

Original Poster
Rep: Reputation: 15
Hi,
Thanks for the reply. I actually tried using the Geometry menu and put in the values written on the drive but this did not work, in fact when using these setting testdisk indicated that there were no partitions at all and the drive capacity was 8.5MB (at least with the wrong geometry it got the disk capacity right) when in fact it is 40 GB so am a little bit reluctant to use these settings however testdisk does indicate that unless i have the write geometry it wont be able to find the correct partitions so i am currently running around in circles a little bit trying to avoid writing anything to the disk till i am sure things are correct.

I may just try some different values and see what happens.

Cheers.
 
Old 11-16-2009, 12:12 PM   #4
Christophe GRENIER
TestDisk & PhotoRec lead developer
 
Registered: Jun 2007
Posts: 12

Rep: Reputation: 2
Quote:
Originally Posted by katesfb View Post
Hi,
Thanks for the reply. I actually tried using the Geometry menu and put in the values written on the drive but this did not work...
You only need to set 255 cylinders as TestDisk told you.
 
1 members found this post helpful.
Old 11-17-2009, 02:35 PM   #5
katesfb
Member
 
Registered: Nov 2006
Posts: 58

Original Poster
Rep: Reputation: 15
Hi Christophe,
Thanks for the reply, its much appreciated, however i am still a bit confused and dont want to make things worse so i was i hoping you might be able to walk me thru the process.

So, using testdisk, i have gone to the analyse section and the results are:

Quote:
Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32
Current partition structure:
Partition Start End Size in sectors

Warning: Incorrect number of heads/cylinder 255 (NTFS) != 64 (HD)
Warning: Incorrect number of sectors per track 63 (NTFS) != 32 (HD)
1 P HPFS - NTFS 0 1 32 33102 43 28 67794237

Warning: Bad ending sector (CHS and LBA don't match)
check_FAT: Bad number of entries in root dir
Invalid FAT boot sector
2 * FAT32 LBA 33102 43 29 38107 19 26 10249470
2 * FAT32 LBA 33102 43 29 38107 19 26 10249470

Warning: Bad starting sector (CHS and LBA don't match)
3 P EFI (FAT-12/16/32) 38107 19 27 38146 33 31 80325

Next
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
[Quick Search] [ Backup ]
Try to locate partition
So, what should i do next, alter the number of cyl, heads etc in the Geometry section (to what)? DO a quick search?

If you could set out the correct approach that would be great. Any help you can give is much appreciated.

Cheers.
 
Old 11-17-2009, 03:02 PM   #6
thorkelljarl
Senior Member
 
Registered: Jun 2008
Posts: 1,711

Rep: Reputation: 190Reputation: 190
A walk is still too much risk...

It might be better if you told us that you had used "dd" or a copy of the Clonezilla live-cd to make a copy of your HDD before you started to work on the original.

Many of us can give you advice, but the files are yours and the responsibility rests with you.

You give yourself more than one chance to get it all right by making a copy.
 
Old 11-18-2009, 02:15 PM   #7
katesfb
Member
 
Registered: Nov 2006
Posts: 58

Original Poster
Rep: Reputation: 15
Hi Thorkelljarl,
Thanks for the reply. I actually used photorec first which seemed to work and retrieved about 22GB of files which is about what was on the drive however none of the files have file names (just numbers and correct extensions) and since there are thousands and thousands of files it is a big task to locate the files i am after but at least they are saved so if the worst comes to the worst i do have them.

So if you cold still walk me thru the process that would be great. Thanks for your help.

Cheers.
 
Old 11-21-2009, 02:38 AM   #8
Christophe GRENIER
TestDisk & PhotoRec lead developer
 
Registered: Jun 2007
Posts: 12

Rep: Reputation: 2
In Geometry, set 255 heads and 63 sectors
In Advanced, select the FAT32, choose Boot, RebuildBS, List. If you can see your files and navigate in the subdirectories, choose Write and confirm. Quit and reboot
 
Old 11-23-2009, 03:22 AM   #9
katesfb
Member
 
Registered: Nov 2006
Posts: 58

Original Poster
Rep: Reputation: 15
Hi Christophe,
And thanks for the reply, it is much appreciated.
OK i did as you suggested and when the "rebuildBS" bit completed i got the following message: "cant find cluster size".

Below is a log of the session although not the complete log as the whole log file was 44MB in size!

Any further help you can give me would be great.

Cheers.

Quote:
TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.28-15-generic (#49-Ubuntu SMP Tue Aug 18 18:40:08 UTC 2009)
Compiler: GCC 4.3 - Nov 7 2008 10:55:40
ext2fs lib: 1.41.4, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
Warning: can't get size for /dev/mapper/control
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - ATA WDC WD800BEVE-00
Disk /dev/sdb - 40 GB / 37 GiB - CHS 38154 64 32, sector size=512 - HTS42404 0M9AT00

Partition table type (auto): Intel
Disk /dev/sdb - 40 GB / 37 GiB - HTS42404 0M9AT00
Partition table type: Intel
New geometry
Disk /dev/sdb - 40 GB / 37 GiB - CHS 4864 255 63 sector_size=512

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
BAD_RS LBA=67794300 16434494
FAT32 at 4220/0/1
check_FAT: Bad number of entries in root dir


test_FAT()
2 * FAT32 LBA 4220 0 1 4857 254 63 10249470
sector_size 512
cluster_size 4
reserved 1
fats 2
dir_entries 512
sectors 0
media F8
fat_length 1274
secs_track 63
heads 255
hidden 67794300
total_sect 4237422466
check_part_i386 failed for partition type 0C
BAD_RS LBA=78043770 16434494
check_part_i386 3 type EF: no test
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
1 P HPFS - NTFS 0 1 1 4219 254 63 67794237
NTFS, 34 GB / 32 GiB
2 * FAT32 LBA 4220 0 1 4857 254 63 10249470
3 P EFI (FAT-12/16/32) 4858 0 1 4862 254 63 80325

fat32_boot_sector
2 * FAT32 LBA 4220 0 1 4857 254 63 10249470
FAT32 at 4220/0/1
check_FAT: Bad number of entries in root dir
Boot sector
check_FAT: Bad number of entries in root dir
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

2 * FAT32 LBA 4220 0 1 4857 254 63 10249470
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=80137, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
FAT32 at 36(4220/0/37), nbr=1
FAT32 at 10092(4220/160/13), nbr=1
FAT32 at 10093(4220/160/14), nbr=1
FAT32 at 10094(4220/160/15), nbr=1
FAT32 at 10144(4220/161/2), nbr=1
FAT32 at 10145(4220/161/3), nbr=1
*
*
*
file_read(5,16,buffer,78043697(4857/253/54)) read err: Input/output error
file_read(5,16,buffer,78043713(4857/254/7)) read err: Input/output error
file_read(5,16,buffer,78043729(4857/254/23)) read err: Input/output error
file_read(5,16,buffer,78043745(4857/254/39)) read err: Input/output error
file_read(5,16,buffer,78043761(4857/254/55)) read err: Input/output error
Can't find cluster size

fat32_boot_sector
2 * FAT32 LBA 4220 0 1 4857 254 63 10249470
file_read(5,16,buffer,67794300(4220/0/1)) read err: Input/output error
file_read(5,1,buffer,67794300(4220/0/1)) read err: Input/output error
file_read(5,1,buffer,67794301(4220/0/2)) read err: Input/output error
file_read(5,1,buffer,67794302(4220/0/3)) read err: Input/output error
file_read(5,16,buffer,67794306(4220/0/7)) read err: Input/output error
file_read(5,1,buffer,67794306(4220/0/7)) read err: Input/output error
file_read(5,1,buffer,67794307(4220/0/8)) read err: Input/output error
file_read(5,1,buffer,67794308(4220/0/9)) read err: Input/output error
Boot sector
fat32_boot_sector: Can't read boot sector.
Bad

Backup boot sector
fat32_boot_sector: Can't read backup boot sector.
Bad

Sectors are identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.
 
Old 11-24-2009, 01:43 PM   #10
Christophe GRENIER
TestDisk & PhotoRec lead developer
 
Registered: Jun 2007
Posts: 12

Rep: Reputation: 2
There are a lot of read errors due to bad sectors. The problem is worst than expected. Try PhotoRec 6.11.3 or 6.12-WIP to recover some data. Note that it will recover most files but not the directory structure.

Last edited by Christophe GRENIER; 11-24-2009 at 01:45 PM.
 
Old 01-06-2010, 09:20 PM   #11
Ratbarf
LQ Newbie
 
Registered: Jan 2010
Posts: 5

Rep: Reputation: 0
You could also use hard drive regenerator to fix the bad sectors on your hard disk. It won't affect the data on it and it will repair all of your bad sectors. I was getting bad sector results on the smart self test and the surface scan test than I used the boot disk that you can create and it completely fixed the hardware problems on my dead windows system... It costs 60 dollars though so you might want to look for a cheaper solution.
 
  


Reply

Tags
photorec


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Data recovery - photorec vs. testdisk vs. ddrescue? JStevenson Linux - Newbie 7 09-01-2009 03:27 PM
How to use TestDisk for recovering my USB thumb drive WillingToLikeLinux Linux - Software 16 07-06-2009 02:57 AM
Data rescue with testdisk J_Szucs Linux - Software 2 06-17-2009 02:34 PM
recovering data yusufs Linux - Newbie 4 10-06-2008 11:58 PM
Recovering Data KrazyKanuk Linux - Newbie 4 10-25-2007 02:43 PM


All times are GMT -5. The time now is 02:13 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration