NTFS filesystem need to be repaired

Comment utiliser TestDisk pour récupérer une partition perdue
Locked
Message
Author
kaotech
Posts: 1
Joined: 29 Mar 2016, 08:31

NTFS filesystem need to be repaired

#1 Post by kaotech »

Bonjour,

Le DD qui ne fonctionne pas n'est pas reconnu sous windows, il me demande de le formater.

Je viens de faire un testdisk, qui ne trouve pas la partition même après un deep search et j'ai des erreurs de ce type :

Code: Select all

file_win32_pread(576,16,buffer,170110(10/150/11)) read err: read after end of file
Via testdisk, j'arrive à lister les répertoires, mais par contre je ne sais pas quelle manipulation à faire, car mon cas (celui où test disque ne trouve pas de partition), ne semble pas être répertorié.

Merci d'avance

Code: Select all


Tue Mar 29 04:54:23 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=115256748032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=250056704000
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=250057064448
filewin32_getfilesize(\\.\G:) GetFileSize err Fonction incorrecte.


filewin32_setfilepointer(\\.\G:) SetFilePointer err Fonction incorrecte.


Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 115 GB / 107 GiB - CHS 14012 255 63, sector size=512
Drive D: - 250 GB / 232 GiB - CHS 30400 255 63, sector size=512
Drive F: - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Drive H: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616

search_part()
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616

search_part()
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_win32_pread(576,16,buffer,170110(10/150/11)) read err: read after end of file
file_win32_pread(576,1,buffer,170110(10/150/11)) read err: read after end of file
file_win32_pread(576,16,buffer,1140680282(71004/16/15)) read err: read after end of file
file_win32_pread(576,16,buffer,1140760575(71009/15/46)) read err: read after end of file
file_win32_pread(576,16,buffer,1141370896(71047/13/23)) read err: read after end of file
file_win32_pread(576,16,buffer,1144365182(71233/111/45)) read err: read after end of file
file_win32_pread(576,1,buffer,1144365192(71233/111/55)) read err: read after end of file
file_win32_pread(576,2,buffer,1144367104(71233/142/14)) read err: read after end of file
file_win32_pread(576,16,buffer,1144367103(71233/142/13)) read err: read after end of file
file_win32_pread(576,1,buffer,1144367103(71233/142/13)) read err: read after end of file
file_win32_pread(576,14,buffer,1144367106(71233/142/16)) read err: read after end of file
file_win32_pread(576,16,buffer,1144367167(71233/143/14)) read err: read after end of file
file_win32_pread(576,1,buffer,1144367168(71233/143/15)) read err: read after end of file
file_win32_pread(576,16,buffer,1144367230(71233/144/14)) read err: read after end of file
file_win32_pread(576,1,buffer,1144367230(71233/144/14)) read err: read after end of file
file_win32_pread(576,16,buffer,1144371199(71233/207/14)) read err: read after end of file
file_win32_pread(576,1,buffer,1144371199(71233/207/14)) read err: read after end of file
file_win32_pread(576,3,buffer,1144371216(71233/207/31)) read err: read after end of file
file_win32_pread(576,3,buffer,1144371263(71233/208/15)) read err: read after end of file
file_win32_pread(576,16,buffer,1144371326(71233/209/15)) read err: read after end of file
file_win32_pread(576,1,buffer,1144371336(71233/209/25)) read err: read after end of file
file_win32_pread(576,2,buffer,1144373248(71233/239/47)) read err: read after end of file
file_win32_pread(576,16,buffer,1144373247(71233/239/46)) read err: read after end of file
file_win32_pread(576,1,buffer,1144373247(71233/239/46)) read err: read after end of file
file_win32_pread(576,14,buffer,1144373250(71233/239/49)) read err: read after end of file
file_win32_pread(576,3,buffer,1144373264(71233/239/63)) read err: read after end of file
file_win32_pread(576,3,buffer,1144373311(71233/240/47)) read err: read after end of file
file_win32_pread(576,16,buffer,1144375169(71234/15/15)) read err: read after end of file
file_win32_pread(576,1,buffer,1144375169(71234/15/15)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390290(71235/0/16)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390291(71235/0/17)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390338(71235/1/1)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390354(71235/1/17)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390401(71235/2/1)) read err: read after end of file
file_win32_pread(576,1,buffer,1144390401(71235/2/1)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390341(71235/1/4)) read err: read after end of file
file_win32_pread(576,1,buffer,1144390344(71235/1/7)) read err: read after end of file
file_win32_pread(576,8,buffer,1144390346(71235/1/9)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390402(71235/2/2)) read err: read after end of file
file_win32_pread(576,1,buffer,1144390402(71235/2/2)) read err: read after end of file
file_win32_pread(576,8,buffer,1144390417(71235/2/17)) read err: read after end of file
file_win32_pread(576,16,buffer,1144390407(71235/2/7)) read err: read after end of file
fpread: Input/output error
Failed to calculate number of free MFTs: Input/output error.
ile_win32_pread(576,1,buffer,1144390407(71235/2/7)) read err: read after end of file
Search for partition aborted

Results
   * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_win32_pread(576,16,buffer,250483448(15591/222/48)) read err: read after end of file
file_win32_pread(576,1,buffer,250483448(15591/222/48)) read err: read after end of file
NTFS filesystem need to be repaired.


dir_partition inode=5
   * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Mar-2016 21:59 .
       5 dr-xr-xr-x     0      0         0 20-Mar-2016 21:59 ..
    1261 dr-xr-xr-x     0      0         0 13-Mar-2016 00:41 $RECYCLE.BIN
   21625 dr-xr-xr-x     0      0         0 28-Sep-2015 21:12 System Volume Information
   18871 dr-xr-xr-x     0      0         0 28-Mar-2016 02:20 docs
   17844 dr-xr-xr-x     0      0         0 28-Mar-2016 03:45 films
     319 dr-xr-xr-x     0      0         0 18-Jan-2016 00:16 found.000
   17843 dr-xr-xr-x     0      0         0 16-Mar-2016 15:45 photos
     511 dr-xr-xr-x     0      0         0 28-Mar-2016 23:26 telechargement
   18986 dr-xr-xr-x     0      0         0 15-Apr-2013 16:53 video
     282 -r--r--r--     0      0     16022 27-Jan-2012 14:28 Software Offer.hta
     283 -r--r--r--     0      0      9518 16-May-2011 14:40 TMP.ico
     285 -r--r--r--     0      0   5599808 15-Sep-2011 10:20 TOSHIBA STOR.E BASICS.pdf
     284 -r--r--r--     0      0      1244 16-May-2011 14:40 Toshiba Places.html
      35 -r--r--r--     0      0        80 15-Sep-2011 12:12 autorun.inf


interface_write()
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
pread: Input/output error
Failed to calculate number of free MFTs: Input/output error.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_win32_pread(576,16,buffer,250483448(15591/222/48)) read err: read after end of file
file_win32_pread(576,1,buffer,250483448(15591/222/48)) read err: read after end of file
NTFS filesystem need to be repaired.


dir_partition inode=5
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Mar-2016 21:59 .
       5 dr-xr-xr-x     0      0         0 20-Mar-2016 21:59 ..
    1261 dr-xr-xr-x     0      0         0 13-Mar-2016 00:41 $RECYCLE.BIN
   21625 dr-xr-xr-x     0      0         0 28-Sep-2015 21:12 System Volume Information
   18871 dr-xr-xr-x     0      0         0 28-Mar-2016 02:20 docs
   17844 dr-xr-xr-x     0      0         0 28-Mar-2016 03:45 films
     319 dr-xr-xr-x     0      0         0 18-Jan-2016 00:16 found.000
   17843 dr-xr-xr-x     0      0         0 16-Mar-2016 15:45 photos
     511 dr-xr-xr-x     0      0         0 28-Mar-2016 23:26 telechargement
   18986 dr-xr-xr-x     0      0         0 15-Apr-2013 16:53 video
     282 -r--r--r--     0      0     16022 27-Jan-2012 14:28 Software Offer.hta
     283 -r--r--r--     0      0      9518 16-May-2011 14:40 TMP.ico
     285 -r--r--r--     0      0   5599808 15-Sep-2011 10:20 TOSHIBA STOR.E BASICS.pdf
     284 -r--r--r--     0      0      1244 16-May-2011 14:40 Toshiba Places.html
      35 -r--r--r--     0      0        80 15-Sep-2011 12:12 autorun.inf

TestDisk exited normally.



Tue Mar 29 07:14:17 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=115256748032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=250056704000
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=250057064448
filewin32_getfilesize(\\.\G:) GetFileSize err Fonction incorrecte.


filewin32_setfilepointer(\\.\G:) SetFilePointer err Fonction incorrecte.


Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 115 GB / 107 GiB - CHS 14012 255 63, sector size=512
Drive D: - 250 GB / 232 GiB - CHS 30400 255 63, sector size=512
Drive F: - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Drive H: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB

ntfs_boot_sector
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: NTFS filesystem need to be repaired

#2 Post by cgrenier »

Il faut cloner le disque vers un disque vierge de taille identique ou supérieure en utilisant gnu ddrescue.
Voici un tutoriel un peu ancien https://www.cgsecurity.org/wiki/Damaged_Hard_Disk
Une fois la copie réalisée, retirer le disque d'origine et retenter l'accès sur la copie.

Locked