jaggboy Author

Level 1

0 points

Corrupted Win7 Partition

Can someone help me recover my corrupted Win7 partition please?

Last login: Mon Jan 12 18:37:17 on console

diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 502.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 497.3 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *2.0 GB disk1

1: DOS_FAT_32 UNTITLED 2.0 GB disk1s1

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: GSP1RMCPRXFRER_EN_DVD *3.3 GB disk2

diskutil cs list

No CoreStorage logical volume groups found

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 980461752 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

980871392 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

982140928 971382784 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 980461752] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 980871392 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 982140928 - 971382784] HPFS/QNX/AUX

iMac (27-inch Mid 2010), OS X Yosemite (10.10.1)

Posted on Jan 12, 2015 5:02 PM

57 replies

jaggboy Author

Level 1

0 points

Jan 20, 2015 6:08 PM in response to Loner T

This is what I get?

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Partition Start End Size in sectors

No partition found or selected for recovery

Loner T

Level 9

59,536 points

Jan 20, 2015 6:21 PM in response to jaggboy

Press Esc, which should take you back to the previous screen. The EFI partition itself will not show you any Deeper Search, but selecting the MS Data partition will. (I am running it on my Mac now to post a screen shot).

Loner T

Level 9

59,536 points

Jan 20, 2015 6:33 PM in response to jaggboy

This is what it should look like. The Deeper Search uses 64K chunks.

jaggboy Author

Level 1

0 points

Jan 21, 2015 12:58 PM in response to Loner T

Thanks for the screenshots Loner T! Scanning now...

jaggboy Author

Level 1

0 points

Jan 22, 2015 7:37 PM in response to jaggboy

Well this is what I finally got so whats next at this point?

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

The harddisk (1000 GB / 931 GiB) seems too small! (< 8244231 TB / 7498084 TiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 589197655 2408374607 1819176953

MS Data 608449240 2427626192 1819176953

Mac HFS 980871388 1961333139 980461752

MS Data 1026846776 2846023728 1819176953

Mac HFS 1278484238 1994314511 715830274

Mac HFS 1364515067 4661906751 3297391685

Mac HFS 1364900009 4762958318 3398058310

Mac HFS 1365656154 2733684382 1368028229

MS Data 1533864209 16102014586812747 16102013052948538 [tem: %s

Mac HFS 1653462088 2056279113 402817026

jaggboy Author

Level 1

0 points

Jan 23, 2015 11:40 AM in response to jaggboy

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 589197655 2408374607 1819176953

MS Data 608449240 2427626192 1819176953

Mac HFS 980871388 1961333139 980461752

MS Data 1026846776 2846023728 1819176953

Mac HFS 1278484238 1994314511 715830274

Mac HFS 1364515067 4661906751 3297391685

Mac HFS 1364900009 4762958318 3398058310

Mac HFS 1365656154 2733684382 1368028229

MS Data 1533864209 16102014586812747 16102013052948538 [tem: %s

Mac HFS 1653462088 2056279113 402817026

]

[ Continue ]

NTFS, blocksize=4096, 931 GB / 867 GiB

Loner T

Level 9

59,536 points

Jan 24, 2015 9:30 AM in response to jaggboy

Can you look through each MS Data entry and use 'P - List files' and check for valid Windows files. You should also see a screen similar to to the following. The presence of System Volume Information is very good indicator that you are on the right track. If you see more than one partition have similar information, then it should be investigated further.

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:14 AM in response to Loner T

Will do. So I pressed P on the first MS data entry and got this:

MS Data

134346752 1953523704 1819176953

Can't open filesystem. Filesystem seems damaged.

>[ Quit ]

Is there a way to go back in Testdisk without having to rescan and search?

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:15 AM in response to jaggboy

After same result on several got one to work:

MS Data

1003433513 1013125369

9691857 [NO NAME]

Directory /

>dr-xr-xr-x	0	0 50734384 16-Feb-2021 09:58 Corporat.ion
drwxr-xr-x	0	0 925712706 21-Sep-2002 09:25 U^D^K^S^^nCi.phe
-r-xr-xr-x	0	0 1635013421 20-Oct-2032 05:03 C911%0#^F.^**^D
-rwxr-xr-x	0	0 25297664 1-Aug-1980 02:47 mp.ce0
-rwxr-xr-x	0	0 3532909800 30-Oct-2017 08:03 =Ζ }~Z
-rwxr-xr-x	0	0 390348469 3-May-1983 02:51 g?Z儵^A&.~Px~I
dr-xr-xr-x	0	0 637690949 25-Oct-1945 15:06 ~@~Y~H~I~\ ^O. 9
-rwxr-xr-x	0	0 68033877 16-Sep-1994 01:40 ; 9 <^B z^]
dr-xr-xr-x	0	0 402924317 31-Jan-1983 06:00 ^V^D^T ^TU^P. k
-r-xr-xr-x	0	0 1211124272 1-Aug-1980 01:56 meStampP.CA.
drwxr-xr-x	0	0 1835103315 20-Oct-2032 15:35 .com/pki./ce
-r-xr-xr-x	0	0 101527560 5-Aug-1982 01:08 pPCA.crt.0^S^F
^A.^A^E^E-x	0	0 3939456680 5-Mar-2032 20:56	*~FH~F
dr-xr-xr-x	0	0 3349859911 16-Apr-2027 21:04 U^PT .o
	Next

Use Right to change directory, h to hide deleted files

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:16 AM in response to jaggboy

MS Data

1055842568 1055858951

16384

Directory /

>-rwxr-xr-x

0 1-Jan-2012 00:00 k~8v HN. ^D

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:17 AM in response to jaggboy

MS Data

1064812040 1064828423

16384

Directory /

>-rwxr-xr-x	0	0 6619191 19-Jan-1980 00:03 _
-rwxr-xr-x	0	0 3014702 19-Mar-1980 00:03 d
-rwxr-xr-x	0	0 3801137 26-Jan-1980 00:01
-rwxr-xr-x	0	0 6881390 6-Feb-1980 00:01 1
-rwxr-xr-x	0	0 7536741 15-Mar-1980 00:03 s
-rwxr-xr-x	0	0 6094963 31-Dec-1979 00:01 s
-rwxr-xr-x	0	0 3211316 18-Jan-1980 00:01 .
-rwxr-xr-x	0	0 7209065 19-Mar-1980 00:03 :
-rwxr-xr-x	0	0 6029427 5-Mar-1980 00:03 g
-rwxr-xr-x	0	0 6488165 28-Feb-1980 00:03 W
-rwxr-xr-x	0	0 3014702 11-Mar-1980 00:03 e
-rwxr-xr-x	0	0 3801137 26-Jan-1980 00:01
-rwxr-xr-x	0	0 6881390 6-Feb-1980 00:01 1
-rwxr-xr-x	0	0 7536741 15-Mar-1980 00:03 s
	Next

Use Right to change directory, h to hide deleted files

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:17 AM in response to jaggboy

MS Data

1069393832 1069410215

16384

Directory /

>-r-xr-xr-x	0	1912 8-Jan-1980 00:00 INDX(
-rwxr-xr-x	0	0 1-Jan-1980 00:00 ^O
-rwxr-xr-x	0 30353361 25-Aug-1931 18:31 F~
-r-xr-xr-x	0	0 1-Jan-1980 00:14 G '^A. G

Use Right to change directory, h to hide deleted files

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:18 AM in response to jaggboy

MS Data

1078378027 1078380906

2880 [NO NAME]

Directory /

>-rwxr-xr-x	0 1073742918 10-Jun-1981 17:40 :V
drwxr-xr-x	0 4236247686 5-Jun-2011 07:48 ^Uw^^D^_..f~KF
drwxr-xr-x	0 33129229 22-Feb-1970 18:00 ^At^C^A. .F^G~@
-r-xr-xr-x	0 21296665 31-Mar-2010 01:29 ^D
-rwxr-xr-x	0 60557046 17-Jul-1902 01:07 ^C~@uR ^P^D Ș
drwxr-xr-x	0 915105326 18-Dec-1933 01:29 .~N^F ^C.~KF.
-r-xr-xr-x	0	0 31-Jul-2003 06:48 ^C.~N^^ ^C..f ~P

Use Right to change directory, h to hide deleted files

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

jaggboy Author

Level 1

0 points

Jan 24, 2015 10:27 AM in response to jaggboy

MS Data

982140928 1953523711 971382784

Can't open filesystem. Filesystem seems damaged.

Loner T

Level 9

59,536 points

Jan 24, 2015 12:42 PM in response to jaggboy

The chances of recovery get slimmer, as each of these partitions starts showing corruption or garbage, because the MFTs are corrupted.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Corrupted Win7 Partition