Page 1 of 1

Dateisystem wiederherstellen

Posted: 14 Jan 2016, 21:51
by diefeder
"Du kennst dich doch aus mit IT. Da sind ganz wichtige Daten drauf, ich brauch sie wieder."

Mit diesen Sätzen hab ich eine Festplatte in die Handgedrückt bekommen, deren Daten ich retten soll. Ich habe schon einiges an Tools ausprobiert finde aber keins (keine kostenloses), die mir sicher alle Daten wiederherstellt. Daher liegt meine Hoffnung nun im Testdisk und dem wiederherstellen des Dateisystems.

Die Festplatte wird im Windows als RAW angezeigt. Könnt Ihr mir helfen?

Hier die testdisk.log

Code: Select all



Thu Jan 14 10:31:28 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750121910272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239215837184
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=750120861696
Hard disk list
Disk \\.\PhysicalDrive0 - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 750 GB / 698 GiB - CHS 91197 255 63, sector size=512
Drive C: - 239 GB / 222 GiB - CHS 29083 255 63, sector size=512
Drive E: - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63, sector size=512

Partition table type (auto): None
Drive F: - 750 GB / 698 GiB
Partition table type: Intel

Analyse Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
 1 * Sys=72               13577 238 11 119521 238 60 1701990410

Bad relative sector.
 2 * Sys=74               45381  70  3 79242  34 29  543974724

Bad relative sector.
 3 * NetWare 3.11+        10498  56 41 10498  56 40          0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 1 * Sys=72               13577 238 11 119521 238 60 1701990410
 2 * Sys=74               45381  70  3 79242  34 29  543974724

search_part()
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
file_win32_pread(216,16,buffer,6291456(391/159/25)) read err: read after end of file
file_win32_pread(216,1,buffer,6291456(391/159/25)) read err: read after end of file
file_win32_pread(216,1,buffer,6291457(391/159/26)) read err: read after end of file
file_win32_pread(216,14,buffer,6291458(391/159/27)) read err: read after end of file
BAD_RS LBA=2101997762 10298798
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            130843  78 54 156569 147 56  413292540
This partition ends after the disk limits. (start=2101997762, size=413292540, end=2515290301, disk end=1465079808)
file_win32_pread(216,14,buffer,1465079806(91197/0/2)) read err: read after end of file
NTFS at 91197/0/3
filesystem size           1465079808
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               91567487
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   0  1 91197   0  3 1465079808
     NTFS found using backup sector, blocksize=4096, 750 GB / 698 GiB
Partition not added.
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (750 GB / 698 GiB) seems too small! (< 1287 GB / 1199 GiB)
The following partition can't be recovered:
     FAT16 LBA            130843  78 54 156569 147 56  413292540

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
 1 * Sys=72               13577 238 11 119521 238 60 1701990410

Bad relative sector.
 2 * Sys=74               45381  70  3 79242  34 29  543974724

Bad relative sector.
 3 * NetWare 3.11+        10498  56 41 10498  56 40          0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 1 * Sys=72               13577 238 11 119521 238 60 1701990410
 2 * Sys=74               45381  70  3 79242  34 29  543974724
Backup partition structure
partition_save

search_part()
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
file_win32_pread(216,16,buffer,6291456(391/159/25)) read err: read after end of file
file_win32_pread(216,1,buffer,6291456(391/159/25)) read err: read after end of file
file_win32_pread(216,1,buffer,6291457(391/159/26)) read err: read after end of file
file_win32_pread(216,14,buffer,6291458(391/159/27)) read err: read after end of file
file_win32_pread(216,14,buffer,1465079806(91197/0/2)) read err: read after end of file
NTFS at 91197/0/3
filesystem size           1465079808
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               91567487
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   0  1 91197   0  3 1465079808
     NTFS found using backup sector, blocksize=4096, 750 GB / 698 GiB
Partition not added.
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
 1 * Sys=72               13577 238 11 119521 238 60 1701990410

Bad relative sector.
 2 * Sys=74               45381  70  3 79242  34 29  543974724

Bad relative sector.
 3 * NetWare 3.11+        10498  56 41 10498  56 40          0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 1 * Sys=72               13577 238 11 119521 238 60 1701990410
 2 * Sys=74               45381  70  3 79242  34 29  543974724

search_part()
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
file_win32_pread(216,16,buffer,6291456(391/159/25)) read err: read after end of file
file_win32_pread(216,1,buffer,6291456(391/159/25)) read err: read after end of file
file_win32_pread(216,1,buffer,6291457(391/159/26)) read err: read after end of file
file_win32_pread(216,14,buffer,6291458(391/159/27)) read err: read after end of file
BAD_RS LBA=2101997762 10298798
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA            130843  78 54 156569 147 56  413292540
This partition ends after the disk limits. (start=2101997762, size=413292540, end=2515290301, disk end=1465079808)
file_win32_pread(216,14,buffer,1465079806(91197/0/2)) read err: read after end of file
NTFS at 91197/0/3
filesystem size           1465079808
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               91567487
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   0  1 91197   0  3 1465079808
     NTFS found using backup sector, blocksize=4096, 750 GB / 698 GiB
Partition not added.
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (750 GB / 698 GiB) seems too small! (< 1287 GB / 1199 GiB)
The following partition can't be recovered:
     FAT16 LBA            130843  78 54 156569 147 56  413292540

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
 1 * Sys=72               13577 238 11 119521 238 60 1701990410

Bad relative sector.
 2 * Sys=74               45381  70  3 79242  34 29  543974724

Bad relative sector.
 3 * NetWare 3.11+        10498  56 41 10498  56 40          0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
 1 * Sys=72               13577 238 11 119521 238 60 1701990410
 2 * Sys=74               45381  70  3 79242  34 29  543974724

search_part()
Drive F: - 750 GB / 698 GiB - CHS 91197 255 63
file_win32_pread(216,14,buffer,1465079806(91197/0/2)) read err: read after end of file
NTFS at 91197/0/3
filesystem size           1465079808
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               91567487
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   0  1 91197   0  3 1465079808
     NTFS found using backup sector, blocksize=4096, 750 GB / 698 GiB
Partition not added.
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
 3 * NetWare 3.11+        10498  56 41 10498  56 40          0
 1 * Sys=72               13577 238 11 119521 238 60 1701990410
 2 * Sys=74               45381  70  3 79242  34 29  543974724
Change partition type:
 2 * Sys=74               45381  70  3 79242  34 29  543974724
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

TestDisk exited normally.


Re: Dateisystem wiederherstellen

Posted: 15 Jan 2016, 09:27
by Fiona
Hattest du TestDisk 64bit genommen?
Steht explizit dabei ist nur für reine 64bit Betriebssystem wenn eine 32bikt Emulation wie WoW64 nicht vorhanden ist und es fehlen auch einige Features.
Ansonsten ist TestDisk 7.1WIP 32bit gegenwärtig empfohlen.

Unter Plattenauswahl sollte dann Disk /dev/sd* (*=a, b, c, etc..) gewählt werden.
Drive ist wie eine Partition und eine Partition hat keine Partitionstabelle.
Diese liegt im MBR oder GPT.
Somit gibt es genauere Ergebnisse.

Fiona