I try to recover some deleted files on a SSD from yesterday. I quite fast forced power off with switch.
So I'd like to know if I had any chance to recover these files.
One weird thing is that all files share the same inode apparently.
Can I somehow solve that issue?
Code: Select all
Sun Dec 1 17:11:33 2019
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, November 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=510652142592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=119664541696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=367001600
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=8001427603456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=104857600
filewin32_getfilesize(\\.\K:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\K:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\K:
filewin32_getfilesize(\\.\L:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\L:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=449990123520
Hard disk list
Disk /dev/sda - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - ST8000AS0002-1NA17Z, S/N:Z84029XK, FW:AR13
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - USB 3.0 , S/N:2017101901F4, FW:0101
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EFRX-68AX9N0, S/N:WD-WMC1T2337098, FW:80.00A80
Disk /dev/sdd - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - OCZ-VERTEX3 MI, S/N:OCZ-APCC97S3G873IJHG, FW:2.25
Disk /dev/sde - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 950 PRO 512GB, S/N:0025_3853_5B16_3796., FW:2B0QBXX7
Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - USB 3.0
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 18446744073709551615
NTFS at 0/32/33
NTFS at 12/223/20
1 * HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 12 223 20 54721 14 61 878886960 [Windows 7]
NTFS, blocksize=4096, 449 GB / 419 GiB
Files with potentially recoverable content: 65899
2 P HPFS - NTFS 12 223 20 54721 14 61 878886960 [Windows 7]
NTFS, blocksize=4096, 449 GB / 419 GiB
....
list of files
....
ERROR: Couldn't set the file's date and time for inode_910647
ERROR: Couldn't set the file's date and time for inode_910647
ERROR: Couldn't set the file's date and time for inode_910647
....
The recovered file have the correct size and everything. But apparently no content in them, only Hex 00.
Would be nice if somebody had a glue, how to solve that.
I think possibly that was a trim action, does that mean, there is completely no chance any more?
Thank you.
Nubber