

Wed Oct 07 22:16:07 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=32015679488
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=272629760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1545601024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=272629760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=717772292096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=32014073856
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112
Hard disk list
Disk \\.\PhysicalDrive0 - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 32 GB / 29 GiB - CHS 3892 255 63, sector size=512
Drive C: - 272 MB / 260 MiB - CHS 33 255 63, sector size=512
Drive D: - 1545 MB / 1474 MiB - CHS 187 255 63, sector size=512
Drive F: - 717 GB / 668 GiB - CHS 87264 255 63, sector size=512
Drive G: - 32 GB / 29 GiB - CHS 3892 255 63, sector size=512
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive0 - 750 GB / 698 GiB
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive0 - 750 GB / 698 GiB - CHS 91201 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1465149167 (expected 1465149167)
hdr_lba_start=34
hdr_lba_end=1465149134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048     534527     532480 [SONYSYS]
 2 P MS Data                   534528    3553279    3018752
 3 P MS Data                  3553280    4085759     532480 [NO NAME]
 4 P MS Data                  4347904 1406246911 1401899008

search_part()
Disk \\.\PhysicalDrive0 - 750 GB / 698 GiB - CHS 91201 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513

FAT32 at 0/32/33
     MS Data                     2048     534527     532480 [SONYSYS]
     FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 33/69/37
filesystem size           3018752
sectors_per_cluster       8
mft_lcn                   125781
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=273678336, part_size=1545601024, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 33/69/37
filesystem size           3018752
sectors_per_cluster       8
mft_lcn                   125781
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   534528    3553279    3018752
     NTFS, blocksize=4096, 1545 MB / 1474 MiB
FAT32 at 221/46/18
FAT1 : 8318-12350
FAT2 : 12351-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-532479
sectors : 532480
cluster_size : 1
no_of_cluster : 516096 (2 - 516097)
fat_length 4033 calculated 4033
set_FAT_info: name from BS used

FAT32 at 221/46/18
     MS Data                  3553280    4085759     532480 [NO NAME]
     FAT32, blocksize=512, 272 MB / 260 MiB
NTFS at 270/164/23
filesystem size           1401899008
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=2226126848, part_size=717772292096, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 270/164/23
filesystem size           1401899008
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  4347904 1406246911 1401899008
     NTFS, blocksize=4096, 717 GB / 668 GiB
NTFS at 87534/209/36
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1405325313 1406246912     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
NTFS at 87534/209/36
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1406246912 1407168511     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 87592/48/9
filesystem size           57978880
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1349189633 1407168512   57978880
     NTFS found using backup sector, blocksize=4096, 29 GB / 27 GiB
NTFS at 87592/48/9
filesystem size           57978880
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               1407168512 1465147391   57978880
     NTFS, blocksize=4096, 29 GB / 27 GiB
file_win32_pread(128,11,buffer,1465149163(91201/80/59)) read err: read after end of file
file_win32_pread(128,8,buffer,1465149162(91201/80/58)) read err: read after end of file
file_win32_pread(128,8,buffer,1465149166(91201/80/62)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149155(91201/80/51)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149156(91201/80/52)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149157(91201/80/53)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149158(91201/80/54)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149159(91201/80/55)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149160(91201/80/56)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149162(91201/80/58)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149164(91201/80/60)) read err: read after end of file
file_win32_pread(128,14,buffer,1465149166(91201/80/62)) read err: read after end of file

Results
   P MS Data                     2048     534527     532480 [SONYSYS]
     FAT32, blocksize=4096, 272 MB / 260 MiB
   P MS Data                   534528    3553279    3018752
     NTFS, blocksize=4096, 1545 MB / 1474 MiB
   P MS Data                  3553280    4085759     532480 [NO NAME]
     FAT32, blocksize=512, 272 MB / 260 MiB
     MS Data                  4347904 1406246911 1401899008
     NTFS, blocksize=4096, 717 GB / 668 GiB
     MS Data               1349189633 1407168512   57978880
     NTFS found using backup sector, blocksize=4096, 29 GB / 27 GiB
     MS Data               1405325313 1406246912     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
     MS Data               1406246912 1407168511     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
     MS Data               1407168512 1465147391   57978880
     NTFS, blocksize=4096, 29 GB / 27 GiB

interface_write()
 1 P MS Data                     2048     534527     532480 [SONYSYS]
 2 P MS Data                   534528    3553279    3018752
 3 P MS Data                  3553280    4085759     532480 [NO NAME]
 4 P MS Data                  4347904 1406246911 1401899008
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.
