By mistake, I deleted all partitions on my data disk (10TB WD with 2TB of actual data) during Windows installation.
Realised it immediately after the fact and made sure to have nothing access it so data is not compromised.
Used TestDisk from a live USB and then from Windows 10 after it was installed (on a different disk).
I recreated the boot sector and MBR.
I tried different other things but couldn't make the partition accessible in Windows (I was not really sure about all steps).
The issue seems to be overlap with another partition.
See attached log file of several attempts.
All my files in the one NTFS partition I care about are there and seem completely intact.
I copied them to a different disk for backup.
I could have called it end of story here but I would really like to simply make the partition accessible as copying all those files takes a long long time.
I feel like I am missing a trivial step to make it work.
I thought of marking the other partition as Deleted and then Write but was afraid of consequences due to overlap (even though I guess the writing is only done into the partition table).
TLDR:
NTFS partition not accessible in Windows
But all files accessible in TestDisk.
Might be due to overlapping partition.
Would like to make the NTFS partition accessible.
Do not care about anything else on the drive.
Would gladly provide any other relevant info.
Would appreciate any ideas or further steps.
Thanks a lot and in advance,
Eyal
Not sure how to attach a file here so pasting the log file below:
Code: Select all
Wed Jul 7 03:14:26 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 E extended LBA 1 232 40 267351 66 42 4294967295
No partition is bootable
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
Space conflict between the following two partitions
1 E extended LBA 1 232 40 267351 66 42 4294967295
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(516,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
interface_write()
1 * HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
interface_write()
1 * HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 E extended LBA 1 232 40 267351 66 42 4294967295
No partition is bootable
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
Space conflict between the following two partitions
1 E extended LBA 1 232 40 267351 66 42 4294967295
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
BAD_RS LBA=8621588288 2920290
check_part_i386 failed for partition type 04
FAT16 <32M 536669 12 48 581885 34 10 726396389
file_win32_pread(516,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
P FAT16 <32M 536669 12 48 581885 34 10 726396389
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
2 P FAT16 <32M 536669 12 48 581885 34 10 726396389
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
You will have to reboot for the change to take effect.
TestDisk exited normally.
Wed Jul 7 19:23:16 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=371914951168
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
test_FAT()
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
sector_size 60785
cluster_size 182
reserved 3898
fats 69
dir_entries 10781
sectors 47740
media C5
fat_length 52122
secs_track 58469
heads 41848
hidden 307546634
total_sect 1029188780
check_part_i386 failed for partition type 04
NTFS at 2/10/9
Current partition structure:
1 E extended LBA 1 232 40 267351 66 42 4294967295
Invalid FAT boot sector
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
No partition is bootable
Space conflict between the following two partitions
1 E extended LBA 1 232 40 267351 66 42 4294967295
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
Space conflict between the following two partitions
1 E extended LBA 1 232 40 267351 66 42 4294967295
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(520,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
test_FAT()
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
sector_size 60785
cluster_size 182
reserved 3898
fats 69
dir_entries 10781
sectors 47740
media C5
fat_length 52122
secs_track 58469
heads 41848
hidden 307546634
total_sect 1029188780
check_part_i386 failed for partition type 04
NTFS at 2/10/9
Current partition structure:
1 E extended LBA 1 232 40 267351 66 42 4294967295
Invalid FAT boot sector
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
No partition is bootable
Space conflict between the following two partitions
1 E extended LBA 1 232 40 267351 66 42 4294967295
2 P FAT16 <32M 267349 89 4 312565 110 29 726396389
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
Space conflict between the following two partitions
1 E extended LBA 1 232 40 267351 66 42 4294967295
5 L HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(520,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
NTFS filesystem needs to be repaired.
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(520,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
interface_write()
1 P HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
TestDisk exited normally.
Wed Jul 7 19:31:32 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
BAD_RS LBA=8621588288 2920290
check_part_i386 failed for partition type 04
FAT16 <32M 536669 12 48 581885 34 10 726396389
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
P FAT16 <32M 536669 12 48 581885 34 10 726396389
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
2 P FAT16 <32M 536669 12 48 581885 34 10 726396389
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
interface_write()
1 * HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Wed Jul 7 21:36:28 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
interface_write()
1 * HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
NTFS at 2/10/9
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
NTFS filesystem needs to be repaired.
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
No partition is bootable
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(524,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
TestDisk exited normally.
Wed Jul 7 22:10:32 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=10000831348736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1999741443072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2199023255040
Hard disk list
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63, sector size=512 - WDC WD102KRYZ-01A5AB0, S/N:VCG5BGGN, FW:01.01H01
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 980 PRO 2TB, S/N:0025_38B1_1150_65DC., FW:3B2QGXA7
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - WDC WD102KRYZ-01A5AB0
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Current partition structure:
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
No partition is bootable
Backup partition structure
partition_save
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(540,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
search_part()
Disk \\.\PhysicalDrive0 - 10000 GB / 9314 GiB - CHS 1215865 255 63
NTFS at 2/10/9
filesystem size 4294967295
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 267351 99 11 4294967295 [Data]
NTFS, blocksize=4096, 2199 GB / 2047 GiB
file_win32_pread(540,2,buffer,19532873727(1215865/39/46)) read err: read after end of file
Search for partition aborted
Results
* HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
NTFS, blocksize=4096, 2199 GB / 2048 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 1 232 40 267351 99 12 4294969344
5 L HPFS - NTFS 2 10 9 267351 99 12 4294967296 [Data]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 1/232/40,lba=30720
TestDisk exited normally.