need help recovering ntfs partition with findpart / findntfs

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

my problem is described in thread:
http://groups-beta.google.com/group/comp.sys.ibm.pc.hardware.storage/browse_frm/thread/5bf6e9d2876426fb/1166b55907ce64c2?q=usenet_daughter#1166b55907ce64c2

but it spun off into a discussion about firewire chipsets so I am
posting a new thread about recovering the data.

mainly my ntfs partition disappeared, the drive appears in Computer
Management but no volume name or file system is displayed, see
screenshot, drive is F:

http://www.geocities.com/usene­t_daughter/hdd1.jpg

i ran the findpart utility (see
http://www.partitionsupport.com/utilities.htm
)

which gave these results (I assume disk 5 is drive F based on the
numbering 0-4 in Computer Management/Disk Management, which findpart
lists as 1-5:

findpart all fp.txt

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 07 63234436482114470 0 1 1 14592 254 63 B OK

No FATs found.

Partitions according to partition tables on disk 5:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 07 63234436482114470 0 1 1 14592*254 63 OK OK

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

>From the above it looks as if I need to run findntfs to search at
disk 0, cylinder 14592, head 254, sector 63 (unless I am interpreting
this wrong). however the results below don't seem to show any data
(unless I am interpreting these wrong as well)

Any suggestions?

Thanks in advance

----------------------------------------------------------------
findntfs 5 14592 254 63 +fntfs2.txt summary

FindNTFS, version 1.65 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600 Service Pack 1

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 14592/254/63 LBA: 234436544

Directories: 0
Files: 0
Trees: 0
Exe/dll files: 0
Exe/dll files signature: 0
Cluster KB: 4
MFT record used: None

----------------------------------------------------------------
findntfs 5 14592 254 63 +fntfs2.txt dirs

FindNTFS, version 1.65 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600 Service Pack 1

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 14592/254/63 LBA: 234436544

------Date ----Time -------Size ---Flags Name

Directories: 0
Files: 0
Trees: 0
Exe/dll files: 0
Exe/dll files signature: 0
Cluster KB: 4
MFT record used: None

----------------------------------------------------------------
findntfs 5 14592 254 63 +fntfs2.txt files

FindNTFS, version 1.65 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2005.

OS: Windows 5.1.2600 Service Pack 1

Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

CHS 14592/254/63 LBA: 234436544

------Date ----Time -------Size ---Flags Name

Directories: 0
Files: 0
Trees: 0
Exe/dll files: 0
Exe/dll files signature: 0
Cluster KB: 4
MFT record used: None

----------------------------------------------------------------
7 answers Last reply
More about need recovering ntfs partition findpart findntfs
  1. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    You should be using "findpart findntfs 5 0 1 1 ...". Usually it recovers most
    files.

    "Mad Scientist Jr" <usenet_daughter@yahoo.com> wrote in message
    news:1110825199.023909.48740@z14g2000cwz.googlegroups.com...
    findpart all fp.txt

    Disk: 5 Cylinders: 14593 Heads: 255 Sectors: 63 MB: 114470

    --PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
    0 - 07 63234436482114470 0 1 1 14592 254 63 B OK

    No FATs found.

    Partitions according to partition tables on disk 5:

    --PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
    0 1 07 63234436482114470 0 1 1 14592*254 63 OK OK
  2. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Thanks ! It is listing the dirs & files. So it seems not all is lost.

    Now, how do I go about recovering them?

    Do I need to get a 2nd hard drive of the same size and use the copy
    function?

    Or can I use one of his utilities to restore the file system from
    redundant data on the original drive?

    Much appreciated
  3. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    I have been looking through it, and the list doesn't seem to be
    complete.

    For instance certain folders are listed in the root, but there are no
    subdirectories.

    Are there other places I can direct findpart or findntfs to look to
    find more information, other than 5 0 1 1 ?

    Thanks
  4. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Best way is rebuild partition!
    I suggest you use partition table doctor.It provides very useful
    functions: Backup partition table, Restore partition table, Rebuild
    partition table, undelete partition,Fixboot.
    May be it can help you!
    see more:http://www.ptdd.com
  5. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    The problem I am having with FindNTFS is I have it output a list of
    folders and files, but it is incomplete. For instance, "findpart all"
    listed cylinder/head/sector 0, 1, 7, so I did
    findntfs 5 0 1 7 file5017.txt files

    which created a file that lists certain folders/files:

    2005-02-27 23:50:58 <DIR> 10000000 myfolder1
    2005-02-28 14:02:31 <DIR> 10000000 myfolder2
    2005-03-07 23:50:18 <DIR> 10000000 myfolder3
    2005-02-28 11:45:30 <DIR> 10000000 myfolder4
    2005-02-28 12:44:19 <DIR> 10000000 myfolder5
    2005-03-02 22:46:43 <DIR> 10000000 myfolder6
    2005-02-28 13:37:47 <DIR> 10000000 myfolder7
    2005-03-07 23:41:44 <DIR> 10000000 myfolder8

    97691 mydata\myfolder1\
    2004-11-22 20:47:50 8368128 00000020 file1.doc
    2004-11-22 20:47:50 8368128 00000020 file2.doc
    2004-11-22 20:48:22 8368128 00000020 file3.avi
    2004-11-22 20:48:22 8368128 00000020 file4.doc

    97685 mydata\myfolder2\
    2004-12-05 00:41:09 28344 00000020 file5.doc
    2002-11-10 11:14:44 14483456 00000020 file6.doc
    2002-11-10 11:14:44 14483456 00000020 file7.doc
    2002-11-10 11:14:44 14483456 00000020 file8.doc
    2002-11-10 11:14:44 14483456 00000020 file9.doc

    97680 mydata\myfolder7\
    2004-11-22 19:55:37 8687616 00000020 file10.avi
    2004-11-22 19:55:37 8687616 00000020 file11.wav
    2004-11-22 19:55:59 8687616 00000020 file12.wav
    2004-11-22 19:55:59 8687616 00000020 file13.wav

    etc.

    But while myfolder4, myfolder5 and myfolder6 appear in the list above,
    they do not appear below broken out with files. And if I try generating
    a dir list with

    findntfs 5 0 1 7 dirs5017.txt dirs

    those folders don't appear at all.

    I tried searching sector 1 instead
    findntfs 5 0 1 1 file5011.txt files
    findntfs 5 0 1 1 dirs 5011.txt dirs

    and the output files are about 1/2 the size of the sector 7 ones, and
    are also missing the folders.

    Also, when I try to do findpart copy, for some of the folders it
    doesn't restore all the files, and for some it restores none,
    outputting "no info":

    Searching ... .

    ------Date ----Time -------Size ---Flags Name

    61732 mydata\myfolder9\
    2005-02-19 09:09:22 2498604 00000020 myfile14.wav No info
    2005-02-19 09:11:30 2762796 00000020 myfile15.wav No info
    2005-02-19 09:13:58 3203116 00000020 myfile16.avi No info
    2005-02-19 09:19:00 2555948 00000020 myfile17.wav No info
    2005-03-01 00:37:38 1552428 00000020 myfile18.aif No info
    2005-03-03 15:01:52 1651756 00000020 myfile19.wav No info

    Directories: 7650
    Files: 134380
    Trees: 25
    Exe/dll files: 1963
    Exe/dll files signature: 1952
    Copied files: 0
    Cluster KB: 4
    MFT record used: None
    Listed files MB: 102530

    So it seems the folders I am trying to recover only exist in the files
    list of sector 7. They are listed, so hopefully I am using findntfs
    wrong or another tool can recover them. Maybe there is more information
    stored elsewhere that can locate the particular directories.

    Any more detailed help appreciated.

    Would TestDisk (http://www.cgsecurity.org) be able to rebuild the
    partition table including the directories I can't see to locate in
    findpart?
  6. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Here you can find answer:

    How to Recover Lost or Deleted Partition
    http://www.ptdd.com/recoverylostpartition.htm
  7. Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

    Thanks for the suggestion - actually I ended up going with
    http://www.ontrack.com/easyrecoveryprofessional/
    which worked and got my data back. Thanks again

    wemaole@yahoo.com wrote:
    > Here you can find answer:
    >
    > How to Recover Lost or Deleted Partition
    > http://www.ptdd.com/recoverylostpartition.htm
Ask a new question

Read More

Partition Storage