

Tue Mar 27 19:17:55 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, March 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6001) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-03-25T21:26:26
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=320070483968
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=309866586624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=10203217920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST3320620AS, S/N:2020202020202020202020205136324739485953, FW:3.AAK
Disk /dev/sdb - 320 GB / 298 GiB - CHS 41345 240 63, sector size=512 - ST3320820AS, S/N:5136344659304147202020202020202020202020, FW:3.CHN

Partition table type (auto): Intel
Disk /dev/sdb - 320 GB / 298 GiB - ST3320820AS
Partition table type: Intel

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 41345 240 63
Geometry from i386 MBR: head=240 sector=63
NTFS at 0/1/1
NTFS at 40027/0/1
heads/cylinder 255 (NTFS) != 240 (HD)
Info: size boot_sector 19928159, partition 19928160
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 * HPFS - NTFS              0   1  1 40026 239 63  605208177
Warning: number of heads/cylinder mismatches 255 (NTFS) != 240 (HD)
 2 P HPFS - NTFS          40027   0  1 41344 239 63   19928160 [FACTORY_IMAGE]
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 41345 240 63
NTFS at 0/1/1
filesystem size           605208177
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               6555461
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 40026 239 63  605208177
     NTFS, 309 GB / 288 GiB
NTFS at 40027/0/1
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size           19928159
sectors_per_cluster       8
mft_lcn                   170152
mftmirr_lcn               255229
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          40027   0  1 41344 239 62   19928159 [FACTORY_IMAGE]
     NTFS, 10203 MB / 9730 MiB
file_pread(5,2,buffer,625143808(41345/117/38)) lseek err Invalid argument
file_pread(5,1,buffer,625143808(41345/117/38)) lseek err Invalid argument
file_pread(5,8,buffer,625142448(41345/96/1)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,625142448(41345/96/1)) ReadFile The drive cannot find the sector requested.

file_pread(5,8,buffer,625142576(41345/98/3)) lseek err Invalid argument
file_pread(5,8,buffer,625142704(41345/100/5)) lseek err Invalid argument
file_pread(5,8,buffer,625142832(41345/102/7)) lseek err Invalid argument
file_pread(5,8,buffer,625142960(41345/104/9)) lseek err Invalid argument
file_pread(5,8,buffer,625143088(41345/106/11)) lseek err Invalid argument
file_pread(5,8,buffer,625143216(41345/108/13)) lseek err Invalid argument
file_pread(5,8,buffer,625143344(41345/110/15)) lseek err Invalid argument
file_pread(5,8,buffer,625143472(41345/112/17)) lseek err Invalid argument
file_pread(5,8,buffer,625143600(41345/114/19)) lseek err Invalid argument
file_pread(5,8,buffer,625143728(41345/116/21)) lseek err Invalid argument
file_pread(5,8,buffer,625143808(41345/117/38)) lseek err Invalid argument
file_pread(5,8,buffer,625143816(41345/117/46)) lseek err Invalid argument
file_pread(5,3,buffer,625143824(41345/117/54)) lseek err Invalid argument
file_pread(5,3,buffer,625143871(41345/118/38)) lseek err Invalid argument
file_pread(5,8,buffer,625143887(41345/118/54)) lseek err Invalid argument
file_pread(5,11,buffer,625143934(41345/119/38)) lseek err Invalid argument
file_pread(5,2,buffer,625145856(41345/150/7)) lseek err Invalid argument
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=1

Results
   * HPFS - NTFS              0   1  1 40026 239 63  605208177
     NTFS, 309 GB / 288 GiB
   P HPFS - NTFS          40027   0  1 41344 239 63   19928160 [FACTORY_IMAGE]
     NTFS, 10203 MB / 9730 MiB

interface_write()
 1 * HPFS - NTFS              0   1  1 40026 239 63  605208177
 2 P HPFS - NTFS          40027   0  1 41344 239 63   19928160 [FACTORY_IMAGE]
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 41345 240 63
NTFS at 0/1/1
filesystem size           605208177
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               6555461
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 40026 239 63  605208177
     NTFS, 309 GB / 288 GiB
NTFS at 40026/239/63
filesystem size           605208177
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               6555461
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 40026 239 63  605208177
     NTFS found using backup sector!, 309 GB / 288 GiB
NTFS at 40027/0/1
heads/cylinder 255 (NTFS) != 240 (HD)
filesystem size           19928159
sectors_per_cluster       8
mft_lcn                   170152
mftmirr_lcn               255229
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          40027   0  1 41344 239 62   19928159 [FACTORY_IMAGE]
     NTFS, 10203 MB / 9730 MiB
file_pread(5,2,buffer,625143808(41345/117/38)) lseek err Invalid argument
file_pread(5,1,buffer,625143808(41345/117/38)) lseek err Invalid argument
file_pread(5,8,buffer,625142448(41345/96/1)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,625142448(41345/96/1)) ReadFile The drive cannot find the sector requested.

file_pread(5,8,buffer,625142576(41345/98/3)) lseek err Invalid argument
file_pread(5,8,buffer,625142704(41345/100/5)) lseek err Invalid argument
file_pread(5,8,buffer,625142832(41345/102/7)) lseek err Invalid argument
file_pread(5,8,buffer,625142960(41345/104/9)) lseek err Invalid argument
file_pread(5,8,buffer,625143088(41345/106/11)) lseek err Invalid argument
file_pread(5,8,buffer,625143216(41345/108/13)) lseek err Invalid argument
file_pread(5,8,buffer,625143344(41345/110/15)) lseek err Invalid argument
file_pread(5,8,buffer,625143472(41345/112/17)) lseek err Invalid argument
file_pread(5,8,buffer,625143600(41345/114/19)) lseek err Invalid argument
file_pread(5,8,buffer,625143728(41345/116/21)) lseek err Invalid argument
file_pread(5,1,buffer,625143807(41345/117/37)) lseek err Invalid argument
file_pread(5,1,buffer,625143808(41345/117/38)) lseek err Invalid argument
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=1

Results
   * HPFS - NTFS              0   1  1 40026 239 63  605208177
     NTFS, 309 GB / 288 GiB
   P HPFS - NTFS          40027   0  1 41344 239 63   19928160 [FACTORY_IMAGE]
     NTFS, 10203 MB / 9730 MiB
Not an exFAT boot sector.

   * HPFS - NTFS              0   1  1 40026 239 63  605208177
     NTFS, 309 GB / 288 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0   1  1 40026 239 63  605208177
 2 P HPFS - NTFS          40027   0  1 41344 239 63   19928160 [FACTORY_IMAGE]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
