blackillusion
Content Type
Profiles
Forums
Events
Posts posted by blackillusion
-
-
Well here is one for you. I changed sector size on testdisk to 512 ran a quick search it found the partitionas like dmde. I then decided to put in in the laptop and try the recovery disk "automatically repair" and it found the boot and os partitions and repaired them. I am able to boot to windows now no problems.
0 -
NO need to apologize at all, but still we have "only" 4 partitions in this view AND we do have now a "new"[bOOT] partition that has however an "improbable" size.
Try pressing Enter and doing a Deeper scan...
In any case running gdisk seems like a good idea.
jaclaz
Running Testdisk deeper search was taking forever I would have leave it tonight if you think that testdisk will help.
Im a bit clueless on gdisk :
0 -
Hmmm.
Even if DMDE can see the partition structure correctly I seem to remember that it doesn't operate (or doesn't operate fully) on GPT disks.
Time to try gdisk:
http://www.rodsbooks.com/gdisk/repairing.html
I have no experience with it, so I will be of very little help about it's use.
jaclaz
I must apologise I did edit my post but probably too slow: It did read and here we are:
0 -
Then definitely there is a glitch in the TESTDISK (or in the way you used it
) Most likely user error lol
DMDE sees the *same* partitions as the referenced post AND it sees a GPT disk (and not a MBR one ).Maybe it is a "hybrid" partitioning.
Can you try running again testdisk this time selecting the GPT partitioning scheme here:
http://www.cgsecurity.org/wiki/File:Partition_table_type.gif
(and post the log)
Seemingly that @Active tool you are using is also thinking that the thingy is MBR (and possibly has actually no support whatever for GPT).
jaclaz
As far as it will let me go. Clicking quick search does nothing. Seems like it freezes.
edit: Apologies it just took forever to change to searching.
0 -
Here is the initial scans as I wait for the fat and ntfs scans:
Capture9 is drive itself
Capture10 is the image of the disk I took before anything ran on it.
0 -
Ok I have managed to read through I see what your saying. I think we are just missing that one partition.
Laptop is a Inspiron 3520
I read what you said about boot/ boot\BCD and upon browsing the forth partition in Active@ found them (see attachments)
I do apologise if I am missing some of what you are saying or being dumb and not reading properly.
0 -
If you try boot it just says bad sector press any key.
I believe its just dell standard or out the box configuration I've read that it is meant to have 6 partitions. http://en.community.dell.com/support-forums/software-os/f/4677/p/19494111/20312796.aspx
That is a while lot of info you have posted I am having difficulty reading on my mobiles screen and will have to have a proper read throughout the post when I am home late tonight.
I think it looks like 2 fat partitions are missing?
0 -
Understood. I believe I wrote the command wrong while posting but correctly when I was running the program. I managed to start reading the disk with commands but trying to write the image CREATED with ACTIVE PARTITION (*.dim*) creates that error.
Well, I have no idea which format that tool uses, dsfo/dsfi is simply a (very small/compact) dd-like tool and only operates with "RAW images", and as such it is only compatible with "pure" dd-like tools.
The reason I want to get the image back to disk is because I know it is completely untouched. Where as the disk has had some software run, testdisk, active and getdataback...
Well testdisk won't write data, and as well getdataback won't (of course unless you explicitly tell them to write on the disk), cannot say about that other Active tool.
If, by any chance, the .dim image is not a RAW image and the dsfi command "went through" even partially it is very probable (please read as certain
) that the result will be completely "botching" the hard disk.If you want my advice, STOP fiddling with that disk, NOW!
jaclaz
Noted. Strange thing is with getdataback partitions suddenly appeared readable in windows after a quick search which was strange.....
The image is a raw image created by Active@
So as to where to go from here. Obviously I have that Image from 1st usage. I can open it and recover any files there though there is not much data.
The whole purpose is to try and recover the partitions etc and learn. In worst case scenario I can just format and resinstall windows.
I do really appreciate your help no matter which way it goes.
0 -
The issue at first sight (but I have to re-read and understand better the log) seems to me connected to the sector size of the hard disk.
The disk is reporting 4096 bytes/sector (please read as "Advance Fornat"), whilst some data read in the bootsector/PBR BPB is about "normal" 512 bytes/sector data.
OK
Can you post some info on what/how/when happened the issue first time?I can't specifically tell you what happened. Obviously its rather new with windows 8. It had no power when I got it I opened her up and found it to have some contaminants on multiple pins on the QFP chip so cleaned it off and resoldered the legs to clear any excess crap off.
She booted and just gave the message BAD BOOT SECTOR. I imagine it may have come into contact with a liquid source or something that contaminated it and shorted it out, thus hard shutting down the hard drive and corrupted data.
I will stress no liquid or contaminents near the Hard drive as it was the opposite side of the laptop. Im not even sure the contaminents are liquid, may just be Fag ash...
About dsfo/dsfi, they use a "common between them" syntax with "inverted" source/destination, the needed parameters are 4 (four):Generically it is:
dsfo <source> <start> <length> <destination>
dsfi <destination> <start> <length> <source>
A <start> of 0 means "from the beginning".
A <length> of 0 means "the whole size of the source".
So you image a whole disk with:
dsfo \\.\PhysicalDriven 0 0 <some path>\image.dsk
which you can read as:
get out of \\.\PhysicalDriven, starting from the beginning, everything and save it as <some path>\image.dsk
and you restore with:
dsfi \\.\PhysicalDriven 0 0 <some path>\image.dsk
which you can read as:
put in \\.\PhysicalDriven, starting from the beginning, everything coming from <some path>\image.dsk
The two 0's in the command line are separated by a space, in your posted command line they look as "00" and the dsfok tools can only interpret them as a single parameter.
jaclaz
Understood. I believe I wrote the command wrong while posting but correctly when I was running the program. I managed to start reading the disk with commands but trying to write the image CREATED with ACTIVE PARTITION (*.dim*) creates that error.
The reason I want to get the image back to disk is because I know it is completely untouched. Where as the disk has had some software run, testdisk, active and getdataback...
0 -
The screenshot you posted does not provide enough info to provide you with any advice.
Maybe not that, but it does appear that the software is warez.
I understand your problem here. You must have the same edition to be able to spot that straight away. I do however have a license for partition recovery, I do apologise for the screenshot I will change the license to my paid for version and re-snip
To add Jaclaz before I done anything I mage an image with active partition its a dim file how can I write this back to the drive I try
and getdsfi \\.\physicaldrive2 00 *filepath*\\.\physicaldrive2 - The parameter is incorrect0 -
Hi Jaclaz seen you pop up in every thread I came across with similar issues. Lets hope I become a happy bunny too lol
Thanks for your help. I'm not sure if anything has been altered.
0 -
Hey guys I've come across your community after some google searching and have seen some well versed folks in partition recovery.
My issue here is a laptop running windows 8 appears to have had a hard shut down thus messing up the partitions or something. I must note I am a newbie when it comes to in depth. I have imaged the disk, twice actually once with Active partition and once with dsfok.
It appears that the FAT32 partition for the boot is overlapped by two other partitions as shown in the attached pic
Im not sure what I need to do here. I am a novice. Thanks for any help in advance
0
) 
disk (and not a MBR one 
).
Hard Drive Bad Boot Sector Windows 8
in Hard Drive and Removable Media
Posted
Indeed I have no idea of what sorted it. Thanks for your help, maybe this sort of question may come up again.