need help recovering ntfs partition with findpart / findntfs

  • Thread starter Thread starter Mad Scientist Jr
  • Start date Start date
M

Mad Scientist Jr

my problem is described in thread:
http://groups-beta.google.com/group...5907ce64c2?q=usenet_daughter#1166b55907ce64c2

but it spun off into a discussion about firewire chipsets so I am
posting a new thread about recovering the data.

mainly my ntfs partition disappeared, the drive appears in Computer
Management but no volume name or file system is displayed, see
screenshot, drive is F:

http://www.geocities.com/usene­t_daughter/hdd1.jpg

i ran the findpart utility (see
http://www.partitionsupport.com/utilities.htm
)

which gave these results (I assume disk 5 is drive F based on the
numbering 0-4 in Computer Management/Disk Management, which findpart
lists as 1-5:

findpart all fp.txt

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 07 63234436482114470 0 1 1 14592 254 63 B OK

No FATs found.

Partitions according to partition tables on disk 5:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 07 63234436482114470 0 1 1 14592*254 63 OK OK

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
From the above it looks as if I need to run findntfs to search at
Click to expand...
disk 0, cylinder 14592, head 254, sector 63 (unless I am interpreting
this wrong). however the results below don't seem to show any data
(unless I am interpreting these wrong as well)

Any suggestions?

Thanks in advance

----------------------------------------------------------------
findntfs 5 14592 254 63 +fntfs2.txt summary

FindNTFS, version 1.65 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600 Service Pack 1

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 14592/254/63 LBA: 234436544

Directories: 0
Files: 0
Trees: 0
Exe/dll files: 0
Exe/dll files signature: 0
Cluster KB: 4
MFT record used: None

----------------------------------------------------------------
findntfs 5 14592 254 63 +fntfs2.txt dirs

FindNTFS, version 1.65 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600 Service Pack 1

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 14592/254/63 LBA: 234436544

------Date ----Time -------Size ---Flags Name

Directories: 0
Files: 0
Trees: 0
Exe/dll files: 0
Exe/dll files signature: 0
Cluster KB: 4
MFT record used: None

----------------------------------------------------------------
findntfs 5 14592 254 63 +fntfs2.txt files

FindNTFS, version 1.65 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600 Service Pack 1

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 14592/254/63 LBA: 234436544

------Date ----Time -------Size ---Flags Name

Directories: 0
Files: 0
Trees: 0
Exe/dll files: 0
Exe/dll files signature: 0
Cluster KB: 4
MFT record used: None

----------------------------------------------------------------
 
You should be using "findpart findntfs 5 0 1 1 ...". Usually it recovers most
files.

findpart all fp.txt

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 07 63234436482114470 0 1 1 14592 254 63 B OK

No FATs found.

Partitions according to partition tables on disk 5:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 07 63234436482114470 0 1 1 14592*254 63 OK OK
 
Thanks ! It is listing the dirs & files. So it seems not all is lost.

Now, how do I go about recovering them?

Do I need to get a 2nd hard drive of the same size and use the copy
function?

Or can I use one of his utilities to restore the file system from
redundant data on the original drive?

Much appreciated
 
I have been looking through it, and the list doesn't seem to be
complete.

For instance certain folders are listed in the root, but there are no
subdirectories.

Are there other places I can direct findpart or findntfs to look to
find more information, other than 5 0 1 1 ?

Thanks
 
Best way is rebuild partition!
I suggest you use partition table doctor.It provides very useful
functions: Backup partition table, Restore partition table, Rebuild
partition table, undelete partition,Fixboot.
May be it can help you!
see more:http://www.ptdd.com
 
The problem I am having with FindNTFS is I have it output a list of
folders and files, but it is incomplete. For instance, "findpart all"
listed cylinder/head/sector 0, 1, 7, so I did
findntfs 5 0 1 7 file5017.txt files

which created a file that lists certain folders/files:

2005-02-27 23:50:58 <DIR> 10000000 myfolder1
2005-02-28 14:02:31 <DIR> 10000000 myfolder2
2005-03-07 23:50:18 <DIR> 10000000 myfolder3
2005-02-28 11:45:30 <DIR> 10000000 myfolder4
2005-02-28 12:44:19 <DIR> 10000000 myfolder5
2005-03-02 22:46:43 <DIR> 10000000 myfolder6
2005-02-28 13:37:47 <DIR> 10000000 myfolder7
2005-03-07 23:41:44 <DIR> 10000000 myfolder8

97691 mydata\myfolder1\
2004-11-22 20:47:50 8368128 00000020 file1.doc
2004-11-22 20:47:50 8368128 00000020 file2.doc
2004-11-22 20:48:22 8368128 00000020 file3.avi
2004-11-22 20:48:22 8368128 00000020 file4.doc

97685 mydata\myfolder2\
2004-12-05 00:41:09 28344 00000020 file5.doc
2002-11-10 11:14:44 14483456 00000020 file6.doc
2002-11-10 11:14:44 14483456 00000020 file7.doc
2002-11-10 11:14:44 14483456 00000020 file8.doc
2002-11-10 11:14:44 14483456 00000020 file9.doc

97680 mydata\myfolder7\
2004-11-22 19:55:37 8687616 00000020 file10.avi
2004-11-22 19:55:37 8687616 00000020 file11.wav
2004-11-22 19:55:59 8687616 00000020 file12.wav
2004-11-22 19:55:59 8687616 00000020 file13.wav

etc.

But while myfolder4, myfolder5 and myfolder6 appear in the list above,
they do not appear below broken out with files. And if I try generating
a dir list with

findntfs 5 0 1 7 dirs5017.txt dirs

those folders don't appear at all.

I tried searching sector 1 instead
findntfs 5 0 1 1 file5011.txt files
findntfs 5 0 1 1 dirs 5011.txt dirs

and the output files are about 1/2 the size of the sector 7 ones, and
are also missing the folders.

Also, when I try to do findpart copy, for some of the folders it
doesn't restore all the files, and for some it restores none,
outputting "no info":

Searching ... .

------Date ----Time -------Size ---Flags Name

61732 mydata\myfolder9\
2005-02-19 09:09:22 2498604 00000020 myfile14.wav No info
2005-02-19 09:11:30 2762796 00000020 myfile15.wav No info
2005-02-19 09:13:58 3203116 00000020 myfile16.avi No info
2005-02-19 09:19:00 2555948 00000020 myfile17.wav No info
2005-03-01 00:37:38 1552428 00000020 myfile18.aif No info
2005-03-03 15:01:52 1651756 00000020 myfile19.wav No info

Directories: 7650
Files: 134380
Trees: 25
Exe/dll files: 1963
Exe/dll files signature: 1952
Copied files: 0
Cluster KB: 4
MFT record used: None
Listed files MB: 102530

So it seems the folders I am trying to recover only exist in the files
list of sector 7. They are listed, so hopefully I am using findntfs
wrong or another tool can recover them. Maybe there is more information
stored elsewhere that can locate the particular directories.

Any more detailed help appreciated.

Would TestDisk (http://www.cgsecurity.org) be able to rebuild the
partition table including the directories I can't see to locate in
findpart?
 
Back
Top