Thu Jun 22 01:34:32 2017
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <
grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=60022480896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=7862353920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=60022480896
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=7862353920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=59914584064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=80681739264
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=7855110144
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500418AS, S/N:2020202020202020202020205636454d4650454a, FW:CC49
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - OCZ-AGILITY3, S/N:434f2d5a41394e44533954363236393543353350, FW:2.25
Disk /dev/sdg - 7862 MB / 7498 MiB - CHS 955 255 63, sector size=512 - Kingston DT Micro, FW:PMAP
Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ST3500418AS
Partition table type: Intel
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
Info: size boot_sector 157581521, partition 157581522
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 9808 254 63 157581522 [OLD_WINDOWS]
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 9808 254 62 157581521 [OLD_WINDOWS]
NTFS, blocksize=4096, 80 GB / 75 GiB
NTFS at 9808/254/63
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 9808 254 63 157581521
NTFS found using backup sector, blocksize=4096, 80 GB / 75 GiB
NTFS at 9808/254/63
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
file_pread(4,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(4,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(4,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(4,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 1 1 9808 254 63 157581522 [OLD_WINDOWS]
NTFS, blocksize=4096, 80 GB / 75 GiB
HPFS - NTFS 0 1 2 9808 254 63 157581521
NTFS found using backup sector, blocksize=4096, 80 GB / 75 GiB
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Not an exFAT boot sector.
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
P HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P HPFS - NTFS 0 1 1 9808 254 63 157581522 [OLD_WINDOWS]
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 9808 254 62 157581521 [OLD_WINDOWS]
NTFS, blocksize=4096, 80 GB / 75 GiB
BAD_RS LBA=91971327 589556
check_part_i386 failed for partition type 04
FAT16 <32M 5724 242 22 118555 236 22 1812629638
This partition ends after the disk limits. (start=91971327, size=1812629638, end=1904600964, disk end=976773168)
NTFS at 9808/250/42
filesystem size 976765744
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=80681631232, part_size=500104060928, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 9808/254/63
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 9808 254 63 157581521
NTFS found using backup sector, blocksize=4096, 80 GB / 75 GiB
NTFS at 9808/254/63
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
NTFS at 9809/0/1
filesystem size 976765744
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 9809 0 1 70609 218 10 976765744 [DATAS]
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=157581585, size=976765744, end=1134347328, disk end=976773168)
file_pread(4,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(4,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(4,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(4,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(4,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(4,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(4,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(4,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(4,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
NTFS at 0/1/1
filesystem size 157581521
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 524288
clusters_per_mft_record -10
clusters_per_index_record 1
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 975 GB / 908 GiB)
The following partitions can't be recovered:
FAT16 <32M 5724 242 22 118555 236 22 1812629638
HPFS - NTFS 9809 0 1 70609 218 10 976765744 [DATAS]
NTFS, blocksize=4096, 500 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 1 1 9808 254 63 157581522 [OLD_WINDOWS]
NTFS, blocksize=4096, 80 GB / 75 GiB
HPFS - NTFS 0 1 2 9808 254 63 157581521
NTFS found using backup sector, blocksize=4096, 80 GB / 75 GiB
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
dir_partition inode=5
HPFS - NTFS 0 1 1 9808 254 63 157581522 [OLD_WINDOWS]
NTFS, blocksize=4096, 80 GB / 75 GiB
Directory /
5 dr-xr-xr-x 0 0 0 19-Jun-2017 22:59 .
5 dr-xr-xr-x 0 0 0 19-Jun-2017 22:59 ..
10347 dr-xr-xr-x 0 0 0 21-Jun-2017 21:15 $RECYCLE.BIN
116245 dr-xr-xr-x 0 0 0 16-Jun-2017 22:58 OLD
50100 dr-xr-xr-x 0 0 0 5-Apr-2012 16:23 RECYCLER
3944 dr-xr-xr-x 0 0 0 24-Sep-2010 20:19 System Volume Information
74390 dr-xr-xr-x 0 0 0 15-Jun-2017 22:36 TEST
7973 -r--r--r-- 0 0 0 24-Sep-2010 19:53 AUTOEXEC.BAT
7972 -r--r--r-- 0 0 0 24-Sep-2010 19:53 CONFIG.SYS
132070 -r--r--r-- 0 0 4260511744 16-Jun-2017 18:56 pagefile.sys
Not an exFAT boot sector.
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
P HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Can't open filesystem. Filesystem seems damaged.
Change partition type:
HPFS - NTFS 9809 0 1 60800 218 10 819184159
Not an exFAT boot sector.
P HPFS - NTFS 9808 254 63 19617 253 61 157581521
NTFS, blocksize=4096, 80 GB / 75 GiB
Can't open filesystem. Filesystem seems damaged.
dir_partition inode=5
HPFS - NTFS 9809 0 1 60800 218 10 819184159
Directory /
5 dr-xr-xr-x 0 0 0 21-Jun-2017 18:51 .
5 dr-xr-xr-x 0 0 0 21-Jun-2017 18:51 ..
45913 dr-xr-xr-x 0 0 0 21-Jun-2017 18:52 $RECYCLE.BIN
17730 dr-xr-xr-x 0 0 0 1-Apr-2016 01:21 0cedc05044cb4fc89a897c1924
45921 dr-xr-xr-x 0 0 0 4-Apr-2012 22:25 ANCIEN_C
(.....)
176693 dr-xr-xr-x 0 0 0 1-Nov-2015 09:38 testdisk-7.0.win64
175738 -r--r--r-- 0 0 162 10-Mar-2014 19:40 ~$rmat10.1.docx
175793 -r--r--r-- 0 0 146668 10-Mar-2014 19:40 ~WRL2382.tmp
dir_partition inode=176693
HPFS - NTFS 9809 0 1 60800 218 10 819184159
Directory /testdisk-7.0.win64
176693 dr-xr-xr-x 0 0 0 1-Nov-2015 09:38 .
5 dr-xr-xr-x 0 0 0 21-Jun-2017 18:51 ..
228959 dr-xr-xr-x 0 0 0 2-Nov-2015 18:09 testdisk-7.0
dir_partition inode=228959
HPFS - NTFS 9809 0 1 60800 218 10 819184159
Directory /testdisk-7.0.win64/testdisk-7.0
228959 dr-xr-xr-x 0 0 0 2-Nov-2015 18:09 .
176693 dr-xr-xr-x 0 0 0 1-Nov-2015 09:38 ..
228977 -r--r--r-- 0 0 220 18-Apr-2015 14:02 AUTHORS.txt
228975 -r--r--r-- 0 0 18326 18-Apr-2015 14:02 COPYING.txt
228967 -r--r--r-- 0 0 117 18-Apr-2015 12:55 INFO
(...)
17087 -r--r--r-- 0 0 7208 21-Jun-2017 21:14 testdisk.log
228965 -r--r--r-- 0 0 1264128 18-Apr-2015 14:02 testdisk_win.exe
228972 -r--r--r-- 0 0 90697 7-Jun-2014 16:03 zlib1.dll
Directory /testdisk-7.0.win64
176693 dr-xr-xr-x 0 0 0 1-Nov-2015 09:38 .
5 dr-xr-xr-x 0 0 0 21-Jun-2017 18:51 ..
228959 dr-xr-xr-x 0 0 0 2-Nov-2015 18:09 testdisk-7.0
Directory /
5 dr-xr-xr-x 0 0 0 21-Jun-2017 18:51 .
5 dr-xr-xr-x 0 0 0 21-Jun-2017 18:51 ..
45913 dr-xr-xr-x 0 0 0 21-Jun-2017 18:52 $RECYCLE.BIN
17730 dr-xr-xr-x 0 0 0 1-Apr-2016 01:21 0cedc05044cb4fc89a897c1924
45921 dr-xr-xr-x 0 0 0 4-Apr-2012 22:25 ANCIEN_C
(.....)
176693 dr-xr-xr-x 0 0 0 1-Nov-2015 09:38 testdisk-7.0.win64
175738 -r--r--r-- 0 0 162 10-Mar-2014 19:40 ~$rmat10.1.docx
175793 -r--r--r-- 0 0 146668 10-Mar-2014 19:40 ~WRL2382.tmp
interface_write()
1 P HPFS - NTFS 0 1 1 9808 254 63 157581522 [OLD_WINDOWS]
2 P HPFS - NTFS 9809 0 1 60800 218 10 819184159
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.