Tuesday, 30 October 2018

NTFS partition is lost, but data (should be) there, how to recover?

Shortly: I've got troubles with a lost partition and Testdisk is not able to solve my problem. Everything makes me think that files are on the disk, but I don't know how to get them back. Also, I'm not an english native speaker, so I apologize for eventually doing some mistakes.


Details


I tried to resize a NTFS partition on my drive with gparted (linux was running), but the operation failed and I lost the filesystem.


This was the disk BEFORE:


125 GB - primary - NTFS (windows)
3 GB - primary - linux swap
21 GB - primary - ext4 (linux)

This is what I meant to do: shrink the NTFS partition FROM THE LEFT in order to make free space at the beginning of the disk. In gparted I edited the partitions like this:


60 (more or less) GB - unallocated
60 (more or less) GB - primary - NTFS (windows) (shrink)
swap and ext4 same as before (unchanged)

and clicked "Apply". During the process I was reading what was going on: it was transferring 30 GB of data from the first part of HD to the new smaller NTFS partition. This part was succesful (you know, shrinking process is made of several parts, and this files transfer was ok). Then I guess gparted tried to create the new MFT and update MBR but it failed. My biggest mistake of the day was that I didn't save the logs (does gparted automatically save logs?) but as far as I remember the error was something like "free clusters more than expected". Well, the result is the following:


67 GB - primary - NTFS (gparted says: "Failed to load runlist for $MFT/$DATA. highest_vcn = 0xc747, last_vcn - 1 = 0x1633b . Failed to load $MFT: Input/output error . NTFS is inconsistent")
57 GB - unallocated
swap and linux are unchanged

I run Testdisk from a bootable USB, I did quick scan but it didn't find anything new. With deep scan it found an additional NTFS partition:


NTFS 0 32 48 16305 55 6 261941233

but when I type "enter" or "p" to view files it says "partition is corrupt".


Some notes:


1) it's strange that my instructions were to create free space BEFORE NTFS, but what gparted sees now is unallocated space AFTER NTFS. And NTFS is inconsistent. Maybe gparted created the new MFT in the first partition and failed to copy to the second?


2) from what I read during the operation, the files should be all in the unallocated space.. how can I find them? I would try to recover them in an ordered way, since if I use PhotoRec I would loose any directory structure.


What should I do? please help or my girlfriend will kill me! (it's her computer.. :O )

No comments:

Post a Comment

Where does Skype save my contact's avatars in Linux?

I'm using Skype on Linux. Where can I find images cached by skype of my contact's avatars? Answer I wanted to get those Skype avat...