26 Reply by mfleetwo

  • mfleetwo
  • Developer
  • Offline
  • Registered: 2012-05-18
  • Posts: 477

Re: [SOLVED] Unallocated space and corrupted NTFS after resize

Assuming you've got a new partition on a new drive of size 1341728768 512-byte sectors (or larger) of type HPFS/NTFS/exFAT.
Lets call it:
/dev/$NEWPTN

From this:

mfleetwo wrote:

0 - 207631 MiB  - Start of FS, single copy
207632 - 227524 MiB - More of FS, first copy of duplicate section
227525 - 247417 MiB - More of FS, second copy of duplicate section
247417 - 748452 MiB - End of FS, single copy

We want to copy:
1. From the start to ~1/2 way through "More of FS, first copy of duplicate section" and
2. From ~1/2 way through "More of FS, second copy of duplicate section" to the end
just skipping 19893 MiB in the middle.

Copy first 220000 MiB
Skip next 19893 MiB
Copy 239893 MiB onwards

dd if=/dev/sdb6 bs=1M count=220000 of=/dev/$NEWPTN
dd if=/dev/sdb6 bs=1M skip=239893 seek=220000 of=/dev/$NEWPTN

27 Reply by mfleetwo

  • mfleetwo
  • Developer
  • Offline
  • Registered: 2012-05-18
  • Posts: 477

Re: [SOLVED] Unallocated space and corrupted NTFS after resize

[Apparently I had become confused because my post was put onto page 2 by the forum!]

28 Reply by imperia

  • imperia
  • Member
  • Offline
  • Registered: 2022-10-12
  • Posts: 14

Re: [SOLVED] Unallocated space and corrupted NTFS after resize

So I run HDD regenerator on this sector 630005007 and it managed to recover it.
Now the access to this specific sector is a little slow (expected), but doesn't throw error. It is readable and writable.

I ran 

dd if=/dev/sdc4 bs=512 skip=$((0x32B03A1E00 / 512)) count=1 2> /dev/null | hexdump -C

but the result was only zeroes.

I ran the above commands directly from original bad hard drive to new one.

dd if=/dev/sdc4 bs=1M count=220000 of=/dev/$NEWPTN
dd if=/dev/sdc4 bs=1M skip=239893 seek=220000 of=/dev/$NEWPTN

After than I run windows installation disk and ran chkdsk:
https://i.postimg.cc/W14stYqB/20221025-230953.jpg
There are some errors and I haven't checked those files yet to see if they are alright.
I will check the recovered orphaned files and some random ones and will report later.

I consider this great success.
Thank you very very much for your help. For the time you spend on my problem and the knowledge you shared.

The little scripts you created proved to be great and maybe you should create a tool to help other people with similar problems (crash during moving partition). Combining matching-blocks.py and analyze-matches.sh. The solution you came up with finding duplicate sectors without waiting a million years was genial.

BTW Actually I am surprised that there are errors. I expected after combining the two parts, the disk to be in the original state without errors. I wonder why these errors appeared. I think there should be a flawless recovery solution.

Anyway. Thank you very much again.

29 Reply by mfleetwo

  • mfleetwo
  • Developer
  • Offline
  • Registered: 2012-05-18
  • Posts: 477

Re: [SOLVED] Unallocated space and corrupted NTFS after resize

The file system should have been put back together in the state it was after the shrink by 19G step and before the copy by 19G to the right.  Because of all the history with this file system and the chkdsk errors above I suggest you copy all the files to a new NTFS file system.  This will read all files and confirm everything is accessable and remove any lingering doubt about logical errors in that NTFS file system after all the issues it has just had.

Since you have got all your data back I am marking this thread as [SOLVED].

Please have tested backups of data you care about.

30 Reply by mfleetwo

  • mfleetwo
  • Developer
  • Offline
  • Registered: 2012-05-18
  • Posts: 477

Re: [SOLVED] Unallocated space and corrupted NTFS after resize

This is belated announcement that I wrote and published find-overlap.py.  It reads the partition, reports the overlapping region and how to put the two pieces back together.

It works by computing the MD5 hash of every block and finding blocks with a duplicate copy to identify the overlap size and location. Takes as long to run as reading the named device.

# find-overlap.py --dump-hashes /tmp/hashes.txt -- /dev/sdb1
Block size: 1048576 bytes

Overlap of size 4096 blocks found.
Range [4321:8417) overlaps [8417:12513).
Original file system size was 16384 blocks.
Restore original file system with:
    dd if=INPUT bs=1048576 count=6369 of=OUTPUT
    dd if=INPUT bs=1048576 skip=10465 seek=6369 of=OUTPUT

* GitHub repo find-overlap
* Direct to find-overlap.py

31 Reply by gedakc

  • gedakc
  • Developer
  • Offline
  • Registered: 2007-11-30
  • Posts: 4,593

Re: [SOLVED] Unallocated space and corrupted NTFS after resize

The find-overlap script you developed sounds very useful to people finding themselves in the unenviable position of having a partition move fail.  This script might be a good candidate to create a sticky post or a page on the website should you find the time.