partitioning - corrupt patition table - testdisk cant find all partitions

06
2014-04

brpaz

I was resizing a partition when my PC freezed and I had no alternative that shut down manually. Unfortunatly that cause my partition table to became corrupt.

My partition table was like this:

Windows  NTFS, Primary

**Extended**
Data NTFS
Ubuntu (ext4)
MAC OS / iaktos L2 (hfs+) 
Virtual Machines (NTFS)
Temp (NTFS)

Windows partition seems intact. I can boot into windows using the MAC OS Live CD Bootloader). Also Ubuntu Live CD can find it. just cant boot. When I strat my computer, I get "No such partition error" and a grub rescue shell.

I tried to use testdisk utility and this is the results: The Virtual Machines and Temp folder are found by testdisk. They look recovarable. It also founds an NTFS partition which i cant idenify. The size doesnt match my data partition (it misses like 500GB). No signs for the other paritions.

My Data parition is where I have all my files. I dont have recent backups. I was preparing to install CrashPlan and a NAS to start automatic backups when this happened :(0 The strange this is if I run fdisk -l in finds a partition /dev/sda5 which I am almost sure it was my data partition.

I hava also read about gpart tool (not gparted). Anyone have any experience with it?

Any advices? What about my Ubuntu and Mac OS partitions? There are no signs of them.

Edit

Here the result of fdisk -l command using ubuntu live cd

    Warning: ignoring extra data in partition table 5
    Warning: ignoring extra data in partition table 5
    Warning: ignoring extra data in partition table 5
    Warning: invalid flag 0x9093 of partition table 5 will be corrected by w(rite)

    Disk /dev/sda: 1000.2 GB, 1000204886016 bytes
    255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
    Units = sectors of 1 * 512 = 512 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    Disk identifier: 0xe0c5913d

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          65   293620004   146809970    7  HPFS/NTFS/exFAT
/dev/sda2       308640778  1953519615   822439419    f  W95 Ext'd (LBA)
/dev/sda5   ?  3786388151  5617242435   915427142+  c5  Unknown

The result of sfdisk

/dev/sda1 : start=       65, size=293619940, Id= 7, bootable
/dev/sda2 : start=308640778, size=1644878838, Id= f
/dev/sda3 : start=        0, size=        0, Id= 0
/dev/sda4 : start=        0, size=        0, Id= 0

Why fdisk can find sda5 but sfdisk cant? My /dev/sda5 (DATA Parition). As I said thats whwere all my important DATA is. I need to recover this partition. Do you think there is anyway to "mount" it to copy its files or whatever?

I am running gpart right now but it is taking lots of time. I could try to recover the paritions showing with testDisk but I am affraid to make things worse.

Answers

brpaz

I managed to fix this all using testdisk without loosing any data. I have done a deeper search, following by an MTF fix and voila. My DATA partition was still corrupted but scandisk fix it when i started windows.

Now, its time for backups. I dont want to pass for this again.

Related Question

windows xp - Recovering a missing XP NTFS partition when testdisk, chkdsk, mbrtool, mbrfix, fixmbr, fixboot all fail

windows-xp partitioning ntfs recovery-console testdisk

ChrisJ

I have an netbook hard drive that won't boot or be mounted and is refusing to cooperate in my debugging. There were two partitions on the disk, an Acer installed recovery partition and my main XP one.

Summary: Only the 6GB recovery partition is mountable, and appears to be fine. Testdisk recreated the partitions, but can't read from the main one. Hitachi hardware diagnostics check out fine. Nothing I do seems to recognize a file system on the main partition. The master boot record seems to be problematic.

Environment: Acer Aspire One AOD150 netbook in original configuration. XP Home Premium, updated and current. Original Hitachi 5K320-160 hdd. BIOS 1.13. I don't have access to an external drive enclosure for now.

How it started: I was writing in a web form (Chrome) when the netbook locked instantly and completely (no pointer movement; ctr-alt-del did nothing). I held the power button down to reboot, and when it came back up, the BIOS started looping through alternate boot options. It said there was no boot disk, as if the hard drive wasn't connected.

Troubleshooting performed and results: Unseated and reseated the hard drive. No effect.

Booted to a Knoppix 6.4.3 CD. Hard drive was not visable to mount.

Ran testdisk (Intel option; NO to Vista partition question) which originally showed 4 nonsensical, overlapping partitions. The quick search found the 2 real NTFS partitions, and appeared to have the size correct. The deeper search showed the same results. The "p" command allowed me to view files in the recovery partition, but gave an error for the main partition "Can't open filesystem. Filesystem seems damaged." I switch the main drive to primary bootable. Even though it wasn't working completely, I wrote the partitions to disk.

Rebooted to Knoppix. It can now see and mount the PQSERVICE recovery partition. I can't browse to the main partition, but fdsik -l shows both partitions. The Disk Utility shows the 160GB drive as healthy, but only finds the one 6.4GB partition.

GParted shows both partitions plus 2.49 MiB unallocated, but gives a bunch of warnings for the main: "$MFT had invalid magic. ntfs_mft_load():Failed. Failed to load $MFT: Input/output error. Failed to startup volume: Input/output error. Failed to mount '/dev/sda2': Input/output error. NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!" I then tried "Check and repair filesystem (ntfs)..." in GParted. Same error as above.

Booted to Ultimate Boot CD UBCD 5.0.3. Ran the Diagnosis Drive Fitness Test v4.16 for the Hitachi drive. Both the quick and full scans completed without error.

Used Smart BootManager to boot to the PQSERVICE recovery partition (Alt+F10 isn't working). It loads fine. I'm not yet willing to try to recover to factory defaults and sacrifice my data.

Ran MBRtool and MBRWork, rebooting after each. Now the BIOS says "A disk read error occurred press Ctrl+Alt+Del to restart".

Booted to UBCD4Win 3.60. Ran chkdsk /r on the recovery partition, without error. chkdsk would not run on the main partition.

Originally I couldn't boot to a Windows Recovery Console CD. It blue-screened giving a STOP 0x0000007B error that the drive wasn't accessable. I went into the BIOS and changed the hard drive interface from AHCI to IDE. I can now boot to the Recovery Console.

Ran chkdsk again, same results as before.

Ran fixboot and rebooted, no change.

Ran fixmbr and rebooted, no change.

But in IDE mode, I can't see the recovery partition anywhere. I have to switch it back to AHCI to view it in Knoppix or get testdisk to recognize the drive.

Plea for help: I would really like to know what's going on. Is it a hardware problem that isn't detected by SMART or the Hitachi diagnostics? Or is it just a bad MBR that I can't seem to get right? Is my best bet to give up on the data, reformat, and reinstall? Or is there something more I can try?

Thanks much!

UPDATE:

On a hunch, I went back and reran testdisk, choosing to search for Vista partitions even though it's an XP install. The quick search showed no improvement, but the deeper search uncovered the deleted ACER partition. After writing to disk, the computer rebooted into XP as if nothing had ever happened.

I'm running chkdsk now just to be safe, but it seems to be back to normal. Hooray!

Related Answers

Tim McMahon

A friend dropped her Acer Aspire One KAV10 on the ground while it was still powered on and it restarted with "No boot device found" "PXE-M0F" etc. Your problem seems similar but your solution wasn't really that intuitive so I'd like to elaborate on what I did to fix it.

I burnt a copy of UBCD511, booted into Parted Magic (using defaults), opened xterm and used TestDisk to:

Recovering an NTFS Boot Sector from an NTFS Partition using its backup

From TestDisk:

[No log]
Select disk
[Intel]
[Advanced]
If "Sectors are not identical." appears then:
[BackupBS]

[q] to return to the previous menu

Recovering the ACER partition table

From TestDisk:

[No log]
Select disk
[Intel]
[Analyse]
[Quick Search]
[Y] for Vista (just default it to Y)

It should have something like:

* HPFS - NTFS [PQSERVICE]

P HPFS - NTFS

Use [up]/[down] arrows to select the non-PQSERVICE partition
[p] to list the files
If the list of files looks complete messed up then go back to the list of partitions by pressing [q]
[Enter]
[Deep search]
After about 1,000 cylinders have been searched you should have about 3-4 partitions listed. If so, press [Stop]
Use the [up]/[down] arrows to select the PQSERVICE partition
Use the [left]/[right] arrows to change the type from * (boot) to P (primary)
Use the [up]/[down] arrows to select the ACER partition
[p] to list the files
If the files don't look ok then go back with [q] and look at another partition
If the files look ok then [C] copy the files to an external hard drive if you want to
Use the [left]/[right] arrows to change it from D (deleted) to * (boot)
[Enter]
Confirm and reboot

Windows XP should now load.

I'm posting this for the benefit of others if they find themselves in a similar situation, and as a reminder if I've to do this again.

Tim.

Computer repairs Perth

Knoppix 6.4 has useful new features for the mirror MBR and partition table recovery without stopping and starting a damaged drive.

Steve

Have you considered SpinRite by GRC?

It allows low level access to almost all types of hard drive partition.

The cost is $89.