Wed May 22 11:48:28 2024 Command line: TestDisk TestDisk 7.2, Data Recovery Utility, February 2024 Christophe GRENIER https://www.cgsecurity.org OS: Windows 8 (9200) Compiler: GCC 11.2, Cygwin 3001.4 ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000214679552 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248671895552 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000196853760 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000381018112 filewin32_getfilesize(\\.\O:) GetFileSize err Incorrect function. filewin32_setfilepointer(\\.\O:) SetFilePointer err Incorrect function. Warning: can't get size for \\.\O: disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=524288000 Hard disk list Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 970 EVO Plus 250GB, S/N:0025_3853_91B0_CBCB., FW:2B2QEXM7 Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - KINGSTON SNV2S2000G, S/N:0000_0000_0000_0000_0026_B778_50A0_4455., FW:SBK00105 Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63, sector size=512 - AMD-RAID Array 1, S/N:0cbc24cb56841cf2, FW:9.3 Drive Z: - 524 MB / 500 MiB - CHS 16000 2 32, sector size=512 Partition table type (auto): EFI GPT Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - AMD-RAID Array 1 Partition table type: Intel Analyse Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63 Geometry from i386 MBR: head=255 sector=63 check_part_i386 1 type EE: no test Current partition structure: 1 P EFI GPT 0 0 2 267349 89 4 4294967295 Bad sector count. No partition is bootable search_part() Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63 NTFS at 2/10/9 filesystem size 7812884480 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 2 clusters_per_mft_record -10 clusters_per_index_record 1 HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB Results * HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB dir_partition inode=5 * HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB Directory / 5 dr-xr-xr-x 0 0 0 20-May-2024 23:32 . 5 dr-xr-xr-x 0 0 0 20-May-2024 23:32 .. 44 dr-xr-xr-x 0 0 0 20-May-2024 23:12 $RECYCLE.BIN 41 dr-xr-xr-x 0 0 0 20-May-2024 23:12 My Pictures 36 dr-xr-xr-x 0 0 0 22-May-2024 10:19 System Volume Information 47 dr-xr-xr-x 0 0 0 22-May-2024 10:19 Videos interface_write() 1 * HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] search_part() Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63 NTFS at 2/10/9 filesystem size 7812884480 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 2 clusters_per_mft_record -10 clusters_per_index_record 1 HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB NTFS at 486331/154/31 filesystem size 7812884480 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 2 clusters_per_mft_record -10 clusters_per_index_record 1 HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS found using backup sector, blocksize=4096, 4000 GB / 3725 GiB NTFS at 486331/154/31 filesystem size 7812884480 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 2 clusters_per_mft_record -10 clusters_per_index_record 1 NTFS: Can't read MFT HPFS - NTFS 486331 154 31 972661 43 53 7812884480 NTFS, blocksize=4096, 4000 GB / 3725 GiB This partition ends after the disk limits. (start=7812917247, size=7812884480, end=15625801726, disk end=7812919296) file_win32_pread(592,2,buffer,7812919295(486331/186/63)) read err: read after end of file Search for partition aborted Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63 Check the hard disk size: HD jumper settings, BIOS detection... The hard disk (4000 GB / 3725 GiB) seems too small! (< 8000 GB / 7450 GiB) The following partition can't be recovered: HPFS - NTFS 486331 154 31 972661 43 53 7812884480 NTFS, blocksize=4096, 4000 GB / 3725 GiB Results * HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB dir_partition inode=5 * HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB Directory / 5 dr-xr-xr-x 0 0 0 20-May-2024 23:32 . 5 dr-xr-xr-x 0 0 0 20-May-2024 23:32 .. 44 dr-xr-xr-x 0 0 0 20-May-2024 23:12 $RECYCLE.BIN 41 dr-xr-xr-x 0 0 0 22-May-2024 12:34 My Pictures 36 dr-xr-xr-x 0 0 0 22-May-2024 10:19 System Volume Information 47 dr-xr-xr-x 0 0 0 22-May-2024 10:19 Videos interface_write() 1 P HPFS - NTFS 2 10 9 486331 154 31 7812884480 [BACKUP] simulate write! write_mbr_i386: starting... write_all_log_i386: starting... No extended partition Interface Advanced Geometry from i386 MBR: head=255 sector=63 check_part_i386 1 type EE: no test 1 P EFI GPT 0 0 2 267349 89 4 4294967295 New options : Dump : No Align partition: Yes Expert mode : No Partition table type (auto): EFI GPT Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - AMD-RAID Array 1 Partition table type: EFI GPT Interface Advanced hdr_size=92 hdr_lba_self=1 hdr_lba_alt=7812919295 (expected 7812919295) hdr_lba_start=34 hdr_lba_end=7812919262 hdr_lba_table=2 hdr_entries=128 hdr_entsz=128 check_part_gpt failed for partition 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] 2 P MS Data 32768 7812917247 7812884480 [Basic data partition] [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB dir_partition inode=5 2 P MS Data 32768 7812917247 7812884480 [Basic data partition] [BACKUP] NTFS, blocksize=4096, 4000 GB / 3725 GiB Directory / 5 dr-xr-xr-x 0 0 0 20-May-2024 23:32 . 5 dr-xr-xr-x 0 0 0 20-May-2024 23:32 .. 44 dr-xr-xr-x 0 0 0 20-May-2024 23:12 $RECYCLE.BIN 41 dr-xr-xr-x 0 0 0 22-May-2024 12:34 My Pictures 36 dr-xr-xr-x 0 0 0 22-May-2024 10:19 System Volume Information 47 dr-xr-xr-x 0 0 0 22-May-2024 10:19 Videos Analyse Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63 hdr_size=92 hdr_lba_self=1 hdr_lba_alt=7812919295 (expected 7812919295) hdr_lba_start=34 hdr_lba_end=7812919262 hdr_lba_table=2 hdr_entries=128 hdr_entsz=128 check_part_gpt failed for partition 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] Current partition structure: No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] 2 P MS Data 32768 7812917247 7812884480 [Basic data partition] [BACKUP] Wed May 22 13:15:47 2024 Command line: TestDisk TestDisk 7.2, Data Recovery Utility, February 2024 Christophe GRENIER https://www.cgsecurity.org OS: Windows 8 (9200) Compiler: GCC 11.2, Cygwin 3001.4 ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000214679552 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248671895552 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000196853760 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000381018112 filewin32_getfilesize(\\.\O:) GetFileSize err Incorrect function. filewin32_setfilepointer(\\.\O:) SetFilePointer err Incorrect function. Warning: can't get size for \\.\O: disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=524288000 Hard disk list Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 970 EVO Plus 250GB, S/N:0025_3853_91B0_CBCB., FW:2B2QEXM7 Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - KINGSTON SNV2S2000G, S/N:0000_0000_0000_0000_0026_B778_50A0_4455., FW:SBK00105 Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63, sector size=512 - AMD-RAID Array 1, S/N:0cbc24cb56841cf2, FW:9.3 Drive Z: - 524 MB / 500 MiB - CHS 16000 2 32, sector size=512 Partition table type (auto): EFI GPT Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - AMD-RAID Array 1 Partition table type: EFI GPT Analyse Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 486331 255 63 hdr_size=92 hdr_lba_self=1 hdr_lba_alt=7812919295 (expected 7812919295) hdr_lba_start=34 hdr_lba_end=7812919262 hdr_lba_table=2 hdr_entries=128 hdr_entsz=128 check_part_gpt failed for partition 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] Current partition structure: No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] 1 P MS Reserved 34 32767 32734 [Microsoft reserved partition] 2 P MS Data 32768 7812917247 7812884480 [Basic data partition] [BACKUP]