Hello. I have a 2gig external Fantom Drive Greendrive. The drive was accidentally used when testing some Dell backup software which wrote out a couple of partitions and nothing more. When I do a deeper search with Intel, I see a 3rd partition. I get a message that says "The harddisk seems too small!" Then shows "The following partition can't be recovered" as seen in the attached log.
The partitions Recovery and OS are the ones the Dell backup utility wrote out.
Any guidance is appreciated. I'm hoping to avoid data carving as there are a lot of jpegs and mp3s on this drive.
Log file:
Mon May 25 18:48:58 2020
Command line: TestDisk
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1024209543168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1024209543168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1023549636608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=786432000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1999610314752
Hard disk list
Disk /dev/sda - 1024 GB / 953 GiB - CHS 124519 255 63, sector size=512 - NVMe THNSN51T02DUK NV, S/N:0008_0D02_0013_297F., FW:4101
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - FANTOM ST32000542AS, S/N:5XW149W6, FW:2.10
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - FANTOM ST32000542AS
Partition table type: Intel
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 95/188/30
Current partition structure:
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
2 P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 1536000
sectors_per_cluster 8
mft_lcn 64000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
NTFS at 95/188/30
filesystem size 3905488896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(5,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(5,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
2 P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 1536000
sectors_per_cluster 8
mft_lcn 64000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
NTFS at 95/188/29
filesystem size 1536000
sectors_per_cluster 8
mft_lcn 64000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS found using backup sector, blocksize=4096, 786 MB / 750 MiB
NTFS at 95/188/30
filesystem size 3905488896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
NTFS at 243200/254/63
filesystem size 3907024002
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 244189000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 243200 254 63 3907024002
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907024002
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 244189000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 243200 254 63 486401 253 62 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024002, end=7814048065, disk end=3907029168)
NTFS at 243201/45/44
filesystem size 3905488896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS found using backup sector, blocksize=4096, 1999 GB / 1862 GiB
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029183(243201/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029311(243201/83/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029439(243201/85/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029567(243201/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029695(243201/89/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029823(243201/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907029951(243201/93/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030079(243201/95/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030207(243201/97/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030335(243201/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030463(243201/101/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030591(243201/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030719(243201/105/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030847(243201/107/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(5,8,buffer,3907030975(243201/109/44)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 243200 254 63 486401 253 62 3907024002
NTFS, blocksize=4096, 2000 GB / 1863 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 1 1 243200 254 63 3907024002
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.
HPFS - NTFS 0 1 1 243200 254 63 3907024002
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 95/188/30
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
2 P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1536000
sectors_per_cluster 8
mft_lcn 64000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Directory /
5 dr-xr-xr-x 0 0 0 25-May-2020 16:55 .
5 dr-xr-xr-x 0 0 0 25-May-2020 16:55 ..
37 dr-xr-xr-x 0 0 0 27-Nov-2013 02:44 $RECYCLE.BIN
42 dr-xr-xr-x 0 0 0 25-May-2020 16:55 System Volume Information
35 dr-xr-xr-x 0 0 0 25-Nov-2013 20:21 recovery
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1536000
sectors_per_cluster 8
mft_lcn 64000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 95/188/30
Current partition structure:
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
2 P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 1536000
sectors_per_cluster 8
mft_lcn 64000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
NTFS at 95/188/30
filesystem size 3905488896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(5,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(5,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
NTFS, blocksize=4096, 786 MB / 750 MiB
P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
NTFS, blocksize=4096, 1999 GB / 1862 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 95 188 29 1536000 [RECOVERY]
2 P HPFS - NTFS 95 188 30 243201 45 44 3905488896 [OS]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Trying to recover a partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Trying to recover a partition
Unfortunately data carving seems to be the only way to recover your data.
If most files are missing, enable the Expert mode in PhotoRec, after starting the recovery, force the blocksize to 512 bytes, use the defaut options otherwise (no need to unformat a FAT32 or to create an image remaining file)
If most files are missing, enable the Expert mode in PhotoRec, after starting the recovery, force the blocksize to 512 bytes, use the defaut options otherwise (no need to unformat a FAT32 or to create an image remaining file)