samedi 17 janvier 2015

Win7 NTFS Partition is empty using Linux LiveCD


my flatmate crashed her windows installation badly. And of course she just had 1 partition C: on it and no backup. And of course there are very important documents on the HDD.


I tried to recover those using GParted and a Ubuntu 14.10 LiveCD.


While mounting an USB HDD works as expected, I can not access the data on the c: partition of the laptops hard disc drive (ntfs). It is just empty and gparted tells me, there is nothing on this HDD at all. I am not buying this, since for example windows starts to boot. I used photorec to have a closer look and could reconstruct several pictures and documents, which should not be possible from an empty hard drive (even though photorec is used for deleted data actually).


As far as I understood the main problem may be the fact that this partition is the one with windows installed on it. Is there way to access it and get to the data? I tried mounting it new several times.


Outputs from parted and gdisk:



Model: ATA WDC WD5000BEVT-2 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 211MB 210MB primary ntfs boot
2 211MB 453GB 453GB primary ntfs
3 453GB 484GB 31,1GB extended lba
5 453GB 484GB 31,1GB logical ntfs
4 484GB 500GB 15,8GB primary ntfs diag


Model: Intenso External USB 3.0 (scsi)
Disk /dev/sdd: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 500GB 500GB primary ntfs


Warning: Unable to open /dev/sr0 read-write (Read-only file system). /dev/sr0
has been opened read-only.
Model: HL-DT-ST DVDRAM GT30N (scsi)
Disk /dev/sr0: 1163MB
Sector size (logical/physical): 2048B/2048B
Partition Table: mac
Disk Flags:

Number Start End Size File system Name Flags
1 2048B 6143B 4096B Apple
2 1152MB 1155MB 2327kB



ubuntu@ubuntu:~$ sudo gdisk /dev/sda2
GPT fdisk (gdisk) version 0.8.8

Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present


***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory. THIS OPERATION IS POTENTIALLY DESTRUCTIVE! Exit by
typing 'q' if you don't want to convert your MBR partitions
to GPT format!
***************************************************************

Exact type match not found for type code 0A00; assigning type code for
'Linux filesystem'
Exact type match not found for type code 6900; assigning type code for
'Linux filesystem'
Exact type match not found for type code 6D00; assigning type code for
'Linux filesystem'
Exact type match not found for type code 6600; assigning type code for
'Linux filesystem'

Warning! Secondary partition table overlaps the last partition by
2804196767 blocks!
You will need to delete this partition or resize it in another utility.


Aucun commentaire:

Enregistrer un commentaire