cgsecurity.org

hi fiona,

I did run deep search on both: intel and none partition table. no positive results, yet...

you mentioned this hp format tool... by using this tool data will be deleted and well, actually that is what I want to avoid.

later when I get home I will try PhotoRec.

Below I will post the results from the deep searches so that you can have a look at them. May be you can deduce some useful information.

I will keep my chin up and hope that a solution can still be found.

best regards,

here the logs...

intel deep search...

Sat Jul 7 11:18:27 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP2
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-07-05T08:08:04
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8039300608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8039300608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=87706010112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=120582572544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=32884391936
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=8039300608
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - SAMSUNG HD252HJ, S/N:31534837314a534b303335323035202020202020, FW:1AC01113
Disk /dev/sdb - 8039 MB / 7666 MiB - CHS 977 255 63, sector size=512 - SanDisk Cruzer, FW:7.01

Partition table type default to Intel
Disk /dev/sdb - 8039 MB / 7666 MiB - SanDisk Cruzer
Partition table type: Intel

Analyse Disk /dev/sdb - 8039 MB / 7666 MiB - CHS 977 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 8039 MB / 7666 MiB - CHS 977 255 63
file_pread(5,2,buffer,15702016(977/103/23)) lseek err Invalid argument
file_pread(5,1,buffer,15702016(977/103/23)) lseek err Invalid argument
file_pread(5,7,buffer,15702017(977/103/24)) lseek err Invalid argument
file_pread(5,8,buffer,15702024(977/103/31)) lseek err Invalid argument
file_pread(5,3,buffer,15702032(977/103/39)) lseek err Invalid argument
file_pread(5,3,buffer,15702079(977/104/23)) lseek err Invalid argument
file_pread(5,8,buffer,15702095(977/104/39)) lseek err Invalid argument
file_pread(5,11,buffer,15702142(977/105/23)) lseek err Invalid argument
file_pread(5,2,buffer,15704064(977/135/55)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 8039 MB / 7666 MiB - CHS 977 255 63
file_pread(5,2,buffer,15702016(977/103/23)) lseek err Invalid argument
file_pread(5,1,buffer,15702016(977/103/23)) lseek err Invalid argument
file_pread(5,1,buffer,15702015(977/103/22)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery



none deep search is an attachment...

Unfortuantely there is a read errror;

ReadFile The request could not be performed because of an I/O device error.

It means either file system or thumb drive itself.

You'll probably need datarecovery software.
Please let me, know the result of PhotoRec.

Fiona

Mods delete this post

I had this same problem, exact same one - testdisk could not find any partition table or portion thereof - but a program called Eassos Recovery was able to find one of the partition tables and rebuild it to make the drive "bootable". With that, the files were able to be recovered.

Eassos recovery (no affiliation) was able to find and rebuild the partition table when Testdisk could not even find a fragment of it on deep scan.

Eassos is one of those programs that people complain about that shows you what files can be recovered, but then asks you to register and pay before the files can actually be recovered. It was $40 for a one month license and $65 for a lifetime license. It was totally worth it to me because the files on the flashdrive were the only copies and my only choice would have been to send it out for professional recovery.

After I started Eassos it was clear it was a program people had been paying money for because its real well developed. it found remains of the partition tables right away, rebuilt the boot sectors and I had my files. I had to rename them as the original names were lost, but I had my data and filetypes restored. Slick program.