2

I am trying to recover partitioning information using TestDisk. To try things out I copied all data from the original harddisc to another physical drive using dd as follows:

$ dd if=/dev/sda of=/dev/sdb bs=4096 conv=notrunc,noerror,sync

Running TestDisk on the original drive shows up like this:

Disc /dev/sda - 500 GB / 465 GiB - CHS 969021 16 63

Warning: the current number of heads per cylinder is 16
but the correct value may be 255
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlaps.

And after continuing without changing anything "Quick analyze" outputs:

Disk /dev/sda - 500 GB / 465 GiB - CHS 969021 16 63
     Partition             Start        End    Size in sectors
 * HPFS - NTFS               2   0 33    205   3 19     204800 [System-reserviert]
 P HPFS - NTFS             205   3 20 203174   9 41  204593152 [W764]
 P Linux                203176  10 11 305359   3 51  103000064
 L Linux                313112   6  7 373707   2 50   61079552
   HPFS - NTFS          373707   2 51 969022  15 47  600078336 [DATA]
   HPFS - NTFS          373707   2 58 969020  15 63  600076329

Running TestDisk "Quick analyze" on the test drive show up like this:

Disk /dev/sdb - 500 GB / 465 GiB - CHS 969021 255 63
     Partition             Start        End    Size in sectors
   HPFS - NTFS               0  32 33     12 223 19     204800 [System-reserviert]
   HPFS - NTFS              12 223 20  12748  53 41  204593152 [W764]
   Linux                 12748  86 11  19159 202 51  103000064
   Linux                 19646  68  7  23448  74 50   61079552
   HPFS - NTFS           23448  74 51  60801 112 47  600078336 [DATA]

The discs are not by the same brand. The test drive is a SSD. It seems as if the partitioning information is not copied to the test drive. Why?

The output of sfdisk is the same for both discs. Here for /dev/sda:

$ sudo sfdisk -d /dev/sda
# partition table of /dev/sda
unit: sectors

/dev/sda1 : start=376696782, size=600076386, Id= 7, bootable
/dev/sda2 : start=        0, size=        0, Id= 0, bootable
/dev/sda3 : start=        0, size=        0, Id= 0, bootable
/dev/sda4 : start=        0, size=        0, Id= 0, bootable

Here is the output of parted. The disc model differs - the other data is the same:

$ sudo parted /dev/sda print
Model: Disk Name (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start  End    Size    Type     File systems  Flags
 1      193GB  500GB  307GB  primary  ntfs          boot

The geometry (as seen by the kernel) for the S-ATA disc ...

$ sudo sfdisk -g /dev/sda
/dev/sda: 969021 cyclinders, 16 heads, 63 sectors/track

... and for the SSD disc

$ sudo sfdisk -g /dev/sdb
/dev/sdb: 60801 cyclinders, 255 heads, 63 sectors/track
JJD
  • 577
  • 3
  • 10
  • 27
  • 1
    The output is in both cases `Disk /dev/sdb`. Is that correct? – Hauke Laging May 06 '14 at 10:17
  • @HaukeLaging A typo. I will post the original output as soon as I am back home. But the major difference is the partioning information: `P` and `L` missing at the beginning of the lines. – JJD May 06 '14 at 11:27
  • I don't know TestDisk. it would be interesting to see the output of other partitioning tools. I assume that `P` and `L` stand for primary and logical partitions. I claim that it is impossible that `dd` changes this type of partition. It seems probable to me that TestDisk is the problem, not `dd`. – Hauke Laging May 06 '14 at 11:36
  • Yes, the [letters indicate the partion type](http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step). Though [`dd` offers to clone *everything*](https://wiki.archlinux.org/index.php/Disk_Cloning). Which other tool do you have in mind? – JJD May 06 '14 at 12:02
  • 1
    Partition information is usually shown with `sfdisk -d /dev/sda` or (for GPT drives) `parted /dev/sda print` – Hauke Laging May 06 '14 at 12:07
  • Thx. I will try these commands in a few hours. – JJD May 06 '14 at 12:16
  • You did copy the partitioning information. Testdisk is making some connection between the disk geometry and the partition table that I don't understand. – Gilles 'SO- stop being evil' May 06 '14 at 22:22
  • @Gilles I am still afraid to **write** the partition information to the original disc. That is why I want to test it with the copy. Do you know if **changing the number of cylinders** will be reversible once I applied it to the original disc? – JJD May 06 '14 at 22:34
  • @JJD I'm not familiar with Testdisk, but I suspect that “changing the number of cylinders” is something you tell to Testdisk for its analysis, not something that will be written to the disk (because I can't see where it would write it). Check the Testdisk documentation. – Gilles 'SO- stop being evil' May 06 '14 at 22:41
  • 1
    The added output is quite strange. Have you truncated it? TestDisk shows a lot of partitions, the other tools just one? Parted claims the drive is 500GB in size but the partition **3007** GB? You can check the geometry (as seen by the kernel) with `sfdisk -g /dev/sda`. And you can set it, see http://www.win.tue.nl/~aeb/linux/Large-Disk-9.html – Hauke Laging May 07 '14 at 08:38
  • @HaukeLaging It is the output of TestDisk of the "Quick analyze" step. I had to manually type the output into another computer - I check tonight for a typo. Thx for the command. – JJD May 07 '14 at 09:13
  • @HaukeLaging I added the geometries. I fixed the typo for the disc size. // Have fun at droidcon :) – JJD May 10 '14 at 13:23

1 Answers1

1

Finally, I was able to reproduce the output of TestDisk on the second drive. I simply changed the geometry settings to the ones of the original drive. I did the following:

Lookup the geometry settings of the original drive:

$ sudo sfdisk -g /dev/sda
/dev/sda: 969021 cyclinders, 16 heads, 63 sectors/track

Open TestDisk, select the "test disc" and apply the above settings in the Geometry menu. Do not be afraid - the setting are not permanent.

Then choose Quick analyze and the result should show the same as it did for the original drive. This time it recognized the desired Linux partitions like the original drive. This time I could savely write the partition table since it only applied the "test disc".

Further reading, very helpful: How to mount an encryped home partition?

Community
  • 1
JJD
  • 577
  • 3
  • 10
  • 27