

Thu Jan 01 11:41:51 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, December 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Dec 29 2014 20:56:47
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=155325562880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2147483648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=342256254976
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=1000169537536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=1000202788864
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 155 GB / 144 GiB - CHS 18883 255 63, sector size=512
Drive D: - 2147 MB / 2048 MiB - CHS 261 255 63, sector size=512
Drive E: - 342 GB / 318 GiB - CHS 41610 255 63, sector size=512
Drive X: - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512
Drive Y: - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512

Partition table type (auto): None
Drive X: - 1000 GB / 931 GiB
Partition table type: None

Analyse Drive X: - 1000 GB / 931 GiB - CHS 121597 255 63
NTFS at 0/0/1
filesystem size           1953456128
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122091007
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 0/0/1
Current partition structure:
   P NTFS                     0   0  1 121597   5  8 1953456128

search_part()
Drive X: - 1000 GB / 931 GiB - CHS 121597 255 63
NTFS at 0/0/1
filesystem size           1953456128
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122091007
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB


dir_partition inode=5
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 .
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 ..
  283330 dr-xr-xr-x     0      0         0 18-Sep-2014 13:31 MyTheme
      16 dr-xr-xr-x     0      0         0 31-Dec-2014 21:47 System Volume Information
     138 dr-xr-xr-x     0      0         0 16-Oct-2013 12:52 WD Apps for Windows
   36006 dr-xr-xr-x     0      0         0  6-Feb-2014 17:52 WD SmartWare.swstor
      17 dr-xr-xr-x     0      0         0 12-Sep-2014 15:16 found.000
      23 dr-xr-xr-x     0      0         0 30-Dec-2014 14:07 found.003
     149 -r--r--r--     0      0         0 21-Dec-2014 14:18 $RECYCLE.BIN
  303518 -r--r--r--     0      0        21  1-Jan-1970 02:00 .cm0013
  310337 -r--r--r--     0      0        56 21-Nov-2014 16:26 .dropbox.device
  299451 -r--r--r--     0      0         0  7-Feb-2014 01:54 00 Quraan
    3839 -r--r--r--     0      0         0  8-Dec-2014 10:49 01 My Documents
     152 -r--r--r--     0      0         0 21-Dec-2014 13:19 03 Fun-1
  406319 -r--r--r--     0      0         0 11-Sep-2014 12:52 04 Progs
  229793 -r--r--r--     0      0         0  7-Feb-2014 00:30 05 Content
  277871 -r--r--r--     0      0         0 19-Nov-2014 01:25 06 All Download Clients
  390380 -r--r--r--     0      0         0 28-Sep-2014 16:49 09 VMs
  389332 -r--r--r--     0      0         0 13-Feb-2014 22:09 10 Mobile Backups  nd staff
      41 -r--r--r--     0      0         0 16-Oct-2013 12:52 Extras
  423174 -r--r--r--     0      0         0 12-Jul-2014 23:43 Fujitsu Last Backup 12-7-2014
  283268 -r--r--r--     0      0        60 15-Sep-2014 10:38 Host in Room 2 Details.txt
  389356 -r--r--r--     0      0         0 11-Sep-2014 11:22 Learning
      49 -r--r--r--     0      0         0 16-Oct-2013 12:52 Locale
  298552 -r--r--r--     0      0         0  9-Nov-2014 12:27 Toshiba USB Flash Backup
      89 -r--r--r--     0      0         0 16-Oct-2013 12:52 User Manuals
  419435 -r--r--r--     0      0         0 29-Jun-2014 16:33 VBoxSharedFolder
     147 -r--r--r--     0      0   4232056  2-Apr-2013 00:42 WD Apps Setup.exe
     148 -r--r--r--     0      0 243264388  3-Feb-2014 00:13 WD Orignal.rar
  314030 -r--r--r--     0      0         0 30-Dec-2014 01:41 found.001
  314031 -r--r--r--     0      0         0 30-Dec-2014 01:41 found.002

dir_partition inode=283330
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /MyTheme
  283330 dr-xr-xr-x     0      0         0 18-Sep-2014 13:31 .
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 ..
  283332 -r--r--r--     0      0       924 18-Sep-2014 13:31 BlackTheme.themepack
Directory /
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 .
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 ..
  283330 dr-xr-xr-x     0      0         0 18-Sep-2014 13:31 MyTheme
      16 dr-xr-xr-x     0      0         0 31-Dec-2014 21:47 System Volume Information
     138 dr-xr-xr-x     0      0         0 16-Oct-2013 12:52 WD Apps for Windows
   36006 dr-xr-xr-x     0      0         0  6-Feb-2014 17:52 WD SmartWare.swstor
      17 dr-xr-xr-x     0      0         0 12-Sep-2014 15:16 found.000
      23 dr-xr-xr-x     0      0         0 30-Dec-2014 14:07 found.003
     149 -r--r--r--     0      0         0 21-Dec-2014 14:18 $RECYCLE.BIN
  303518 -r--r--r--     0      0        21  1-Jan-1970 02:00 .cm0013
  310337 -r--r--r--     0      0        56 21-Nov-2014 16:26 .dropbox.device
  299451 -r--r--r--     0      0         0  7-Feb-2014 01:54 00 Quraan
    3839 -r--r--r--     0      0         0  8-Dec-2014 10:49 01 My Documents
     152 -r--r--r--     0      0         0 21-Dec-2014 13:19 03 Fun-1
  406319 -r--r--r--     0      0         0 11-Sep-2014 12:52 04 Progs
  229793 -r--r--r--     0      0         0  7-Feb-2014 00:30 05 Content
  277871 -r--r--r--     0      0         0 19-Nov-2014 01:25 06 All Download Clients
  390380 -r--r--r--     0      0         0 28-Sep-2014 16:49 09 VMs
  389332 -r--r--r--     0      0         0 13-Feb-2014 22:09 10 Mobile Backups  nd staff
      41 -r--r--r--     0      0         0 16-Oct-2013 12:52 Extras
  423174 -r--r--r--     0      0         0 12-Jul-2014 23:43 Fujitsu Last Backup 12-7-2014
  283268 -r--r--r--     0      0        60 15-Sep-2014 10:38 Host in Room 2 Details.txt
  389356 -r--r--r--     0      0         0 11-Sep-2014 11:22 Learning
      49 -r--r--r--     0      0         0 16-Oct-2013 12:52 Locale
  298552 -r--r--r--     0      0         0  9-Nov-2014 12:27 Toshiba USB Flash Backup
      89 -r--r--r--     0      0         0 16-Oct-2013 12:52 User Manuals
  419435 -r--r--r--     0      0         0 29-Jun-2014 16:33 VBoxSharedFolder
     147 -r--r--r--     0      0   4232056  2-Apr-2013 00:42 WD Apps Setup.exe
     148 -r--r--r--     0      0 243264388  3-Feb-2014 00:13 WD Orignal.rar
  314030 -r--r--r--     0      0         0 30-Dec-2014 01:41 found.001
  314031 -r--r--r--     0      0         0 30-Dec-2014 01:41 found.002

interface_write()
   P NTFS                     0   0  1 121597   5  8 1953456128
 
Write isn't available because the partition table type "None" has been selected.

Interface Advanced
NTFS at 0/0/1
filesystem size           1953456128
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122091007
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 0/0/1
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB

ntfs_boot_sector
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/0/1
file_win32_pread(156,1,buffer,1953456127(121597/5/8)) read err: read after end of file
filesystem size           1953456128 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               122091007 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy original boot sector over backup boot
file_win32_pwrite(156,1,buffer,1953456127(121597/5/8)) write err
Write error: Can't overwrite NTFS backup boot sector

ntfs_boot_sector
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/0/1
file_win32_pread(156,1,buffer,1953456127(121597/5/8)) read err: read after end of file
filesystem size           1953456128 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               122091007 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Directory /
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 .
       5 dr-xr-xr-x     0      0         0 31-Dec-2014 20:47 ..
  283330 dr-xr-xr-x     0      0         0 18-Sep-2014 13:31 MyTheme
      16 dr-xr-xr-x     0      0         0 31-Dec-2014 21:47 System Volume Information
     138 dr-xr-xr-x     0      0         0 16-Oct-2013 12:52 WD Apps for Windows
   36006 dr-xr-xr-x     0      0         0  6-Feb-2014 17:52 WD SmartWare.swstor
      17 dr-xr-xr-x     0      0         0 12-Sep-2014 15:16 found.000
      23 dr-xr-xr-x     0      0         0 30-Dec-2014 14:07 found.003
     149 -r--r--r--     0      0         0 21-Dec-2014 14:18 $RECYCLE.BIN
  303518 -r--r--r--     0      0        21  1-Jan-1970 02:00 .cm0013
  310337 -r--r--r--     0      0        56 21-Nov-2014 16:26 .dropbox.device
  299451 -r--r--r--     0      0         0  7-Feb-2014 01:54 00 Quraan
    3839 -r--r--r--     0      0         0  8-Dec-2014 10:49 01 My Documents
     152 -r--r--r--     0      0         0 21-Dec-2014 13:19 03 Fun-1
  406319 -r--r--r--     0      0         0 11-Sep-2014 12:52 04 Progs
  229793 -r--r--r--     0      0         0  7-Feb-2014 00:30 05 Content
  277871 -r--r--r--     0      0         0 19-Nov-2014 01:25 06 All Download Clients
  390380 -r--r--r--     0      0         0 28-Sep-2014 16:49 09 VMs
  389332 -r--r--r--     0      0         0 13-Feb-2014 22:09 10 Mobile Backups  nd staff
      41 -r--r--r--     0      0         0 16-Oct-2013 12:52 Extras
  423174 -r--r--r--     0      0         0 12-Jul-2014 23:43 Fujitsu Last Backup 12-7-2014
  283268 -r--r--r--     0      0        60 15-Sep-2014 10:38 Host in Room 2 Details.txt
  389356 -r--r--r--     0      0         0 11-Sep-2014 11:22 Learning
      49 -r--r--r--     0      0         0 16-Oct-2013 12:52 Locale
  298552 -r--r--r--     0      0         0  9-Nov-2014 12:27 Toshiba USB Flash Backup
      89 -r--r--r--     0      0         0 16-Oct-2013 12:52 User Manuals
  419435 -r--r--r--     0      0         0 29-Jun-2014 16:33 VBoxSharedFolder
     147 -r--r--r--     0      0   4232056  2-Apr-2013 00:42 WD Apps Setup.exe
     148 -r--r--r--     0      0 243264388  3-Feb-2014 00:13 WD Orignal.rar
  314030 -r--r--r--     0      0         0 30-Dec-2014 01:41 found.001
  314031 -r--r--r--     0      0         0 30-Dec-2014 01:41 found.002

ntfs_boot_sector
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/0/1
file_win32_pread(156,1,buffer,1953456127(121597/5/8)) read err: read after end of file
filesystem size           1953456128 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               122091007 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
   P NTFS                     0   0  1 121597   5  8 1953456128
     NTFS, blocksize=4096, 1000 GB / 931 GiB

TestDisk exited normally.
