

Fri Nov 22 09:23:39 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=107373997568
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=230294859264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=217551520768
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=32217956352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=8003256320
filewin32_getfilesize(\\.\K:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\K:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1911891259904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=88471079424
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10JPVX-16JC3T0, S/N:WD-XXXXXXXXXXXX, FW:01.01A01
Disk /dev/sdb - 8004 MB / 7633 MiB - CHS 973 255 63, sector size=512 - SanDisk Cruzer Edge, S/N:XXXXXXXXXXXXXXXXXXXX, FW:1.03
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Book 1140, S/N:XXXXXXXXXXXX, FW:1022

Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10JPVX-16JC3T0
Partition table type: Intel

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1529/232/48
Info: size boot_sector 204793, partition 210247
NTFS at 10680/147/28
heads/cylinder 16 (NTFS) != 255 (HD)
Info: size boot_sector 449794041, partition 449794647
NTFS at 41048/218/3
Info: size boot_sector 209713145, partition 209714839
NTFS at 62864/221/14
Info: size boot_sector 424902649, partition 424905314
NTFS at 115763/14/28
Info: size boot_sector 62912505, partition 62925696
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Current partition structure:
 1 * HPFS - NTFS           1529 232 48  1542 254 63     210247 [SYSTEM RESERVED]
 2 E extended LBA         10680 147  1 119679 254 63 1751075739
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
 5 L HPFS - NTFS          10680 147 28 38678 254 63  449794647 [Miscellaneous]
   X extended             41048 217  1 54102 254 63  209714904
 6 L HPFS - NTFS          41048 218  3 54102 254 63  209714839 [RootWin8]
   X extended             62864 220  1 89313 254 63  424905390
 7 L HPFS - NTFS          62864 221 14 89313 254 63  424905314 [Music and Other Stuff]
   X extended             115763  13  1 119679 254 63   62925786
 8 L HPFS - NTFS          115763  14 28 119679 254 63   62925696 [Stuff]
Backup partition structure
partition_save

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           24575993
sectors_per_cluster       8
mft_lcn                   769953
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33  1529 232 40   24575993 [PQSERVICE]
     NTFS, blocksize=4096, 12 GB / 11 GiB
NTFS at 1529/232/48
filesystem size           204793
sectors_per_cluster       8
mft_lcn                   7312
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS           1529 232 48  1542 168 27     204793 [SYSTEM RESERVED]
     NTFS, blocksize=4096, 104 MB / 99 MiB
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 10680/147/28
heads/cylinder 16 (NTFS) != 255 (HD)
filesystem size           449794041
sectors_per_cluster       8
mft_lcn                   3
mftmirr_lcn               49
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          10680 147 28 38678 245 24  449794041 [Miscellaneous]
     NTFS, blocksize=4096, 230 GB / 214 GiB
NTFS at 41048/218/3
filesystem size           209713145
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               10535199
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          41048 218  3 54102 228  7  209713145 [RootWin8]
     NTFS, blocksize=4096, 107 GB / 99 GiB
NTFS at 62864/221/14
filesystem size           424902649
sectors_per_cluster       8
mft_lcn                   769201
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          62864 221 14 89313 212 44  424902649 [Music and Other Stuff]
     NTFS, blocksize=4096, 217 GB / 202 GiB
NTFS at 89313/245/21
filesystem size           424902649
sectors_per_cluster       8
mft_lcn                   769204
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          89313 245 21 115762 236 51  424902649 [Movies and TV Shows]
     NTFS, blocksize=4096, 217 GB / 202 GiB
NTFS at 115763/14/28
filesystem size           62912505
sectors_per_cluster       8
mft_lcn                   767746
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          115763  14 28 119679  45 39   62912505 [Stuff]
     NTFS, blocksize=4096, 32 GB / 29 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33  1529 232 47   24576000 [PQSERVICE]
     NTFS, blocksize=4096, 12 GB / 11 GiB
   P HPFS - NTFS           1529 232 48  1542 168 34     204800 [SYSTEM RESERVED]
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P HPFS - NTFS          10680 147 28 38678 245 31  449794048 [Miscellaneous]
     NTFS, blocksize=4096, 230 GB / 214 GiB
   L HPFS - NTFS          41048 218  3 54102 228 14  209713152 [RootWin8]
     NTFS, blocksize=4096, 107 GB / 99 GiB
   L HPFS - NTFS          62864 221 14 89313 212 51  424902656 [Music and Other Stuff]
     NTFS, blocksize=4096, 217 GB / 202 GiB
   L HPFS - NTFS          89313 245 21 115762 236 58  424902656 [Movies and TV Shows]
     NTFS, blocksize=4096, 217 GB / 202 GiB
   L HPFS - NTFS          115763  14 28 119679  45 46   62912512 [Stuff]
     NTFS, blocksize=4096, 32 GB / 29 GiB
add_ext_part_i386: max
add_ext_part_i386: max

interface_write()
 1 * HPFS - NTFS              0  32 33  1529 232 47   24576000 [PQSERVICE]
 2 P HPFS - NTFS           1529 232 48  1542 168 34     204800 [SYSTEM RESERVED]
 3 P HPFS - NTFS          10680 147 28 38678 245 31  449794048 [Miscellaneous]
 4 E extended LBA         38678 245 32 121601  57 56 1332146176
 5 L HPFS - NTFS          41048 218  3 54102 228 14  209713152 [RootWin8]
 6 L HPFS - NTFS          62864 221 14 89313 212 51  424902656 [Music and Other Stuff]
 7 L HPFS - NTFS          89313 245 21 115762 236 58  424902656 [Movies and TV Shows]
 8 L HPFS - NTFS          115763  14 28 119679  45 46   62912512 [Stuff]
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to open ntfs attribute: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open ntfs attribute: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open ntfs attribute: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open ntfs attribute: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
