ran testdisk as admin in win7 and was able to change the CHS values.
displaying MBR shows some data in the boot sector, and no values in backup boot sector. so copying from backkup doesnt make sense, and copying boot sector to backup doesnt work.
after restart the chs values are back to the incorrect values. log bellow.
Code: Select all
scroll]{
Tue Oct 2 20:34:08 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-22T12:26:25
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=33348608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=33348608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255953207296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=33348608
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63, sector size=512 - WDC WD10 01FALS-00J7B, S/N:W -DMWTA3V393331, FW:05.0
Disk /dev/sdb - 256 GB / 238 GiB - CHS 117508 224 19, sector size=512 - OCZ-VERT EX4, S/N:CO-Z786X5X828EBT4TBV, FW:1.5
Partition table type (auto): Intel
Disk /dev/sda - 33 MB / 31 MiB - WDC WD10 01FALS-00J7B
Partition table type: Intel
New geometry
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63 sector_size=512
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS: Can't read MFT
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
No partition is bootable
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(4,8,buffer,1953519616(121600/247/56)) lseek err Invalid argument
file_pread(4,8,buffer,1953519624(121600/248/1)) lseek err Invalid argument
file_pread(4,3,buffer,1953519632(121600/248/9)) lseek err Invalid argument
file_pread(4,3,buffer,1953519679(121600/248/56)) lseek err Invalid argument
file_pread(4,8,buffer,1953519695(121600/249/9)) lseek err Invalid argument
file_pread(4,11,buffer,1953519742(121600/249/56)) lseek err Invalid argument
file_pread(4,2,buffer,1953521664(121601/25/25)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open backup.log file: No such file or directory
interface_load
file_pread(4,1,buffer,6293505(391/191/58)) lseek err Invalid argument
Not an exFAT boot sector.
* HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 32 33 121600 247 55 1953517568
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(4,2,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,2,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,1,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,2,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,1,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,2,buffer,65219(4/15/15)) lseek err Invalid argument
file_pread(4,2,buffer,65282(4/16/15)) lseek err Invalid argument
file_pread(4,2,buffer,65345(4/17/15)) lseek err Invalid argument
file_pread(4,1,buffer,65535(4/20/16)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 121600 247 55 1953517568
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
file_pread(4,1,buffer,1953519615(121600/247/55)) lseek err Invalid argument
filesystem size 1953517568 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(4,2,buffer,976760812(60800/139/56)) lseek err Invalid argument
file_pread(4,1,buffer,976760814(60800/139/58)) lseek err Invalid argument
file_pread(4,1,buffer,976760815(60800/139/59)) lseek err Invalid argument
file_pread(4,1,buffer,976760816(60800/139/60)) lseek err Invalid argument
file_pread(4,1,buffer,976760817(60800/139/61)) lseek err Invalid argument
file_pread(4,1,buffer,976760818(60800/139/62)) lseek err Invalid argument
file_pread(4,1,buffer,976760819(60800/139/63)) lseek err Invalid argument
file_pread(4,1,buffer,976760820(60800/140/1)) lseek err Invalid argument
file_pread(4,1,buffer,976760821(60800/140/2)) lseek err Invalid argument
file_pread(4,1,buffer,976760822(60800/140/3)) lseek err Invalid argument
file_pread(4,1,buffer,976760823(60800/140/4)) lseek err Invalid argument
file_pread(4,1,buffer,976760824(60800/140/5)) lseek err Invalid argument
file_pread(4,1,buffer,976760825(60800/140/6)) lseek err Invalid argument
file_pread(4,1,buffer,976760826(60800/140/7)) lseek err Invalid argument
file_pread(4,1,buffer,976760827(60800/140/8)) lseek err Invalid argument
file_pread(4,1,buffer,976760828(60800/140/9)) lseek err Invalid argument
file_pread(4,1,buffer,976760829(60800/140/10)) lseek err Invalid argument
file_pread(4,1,buffer,976760830(60800/140/11)) lseek err Invalid argument
file_pread(4,1,buffer,976760831(60800/140/12)) lseek err Invalid argument
file_pread(4,1,buffer,976760832(60800/140/13)) lseek err Invalid argument
file_pread(4,1,buffer,976760833(60800/140/14)) lseek err Invalid argument
file_pread(4,1,buffer,976760834(60800/140/15)) lseek err Invalid argument
file_pread(4,1,buffer,976760835(60800/140/16)) lseek err Invalid argument
file_pread(4,1,buffer,976760836(60800/140/17)) lseek err Invalid argument
file_pread(4,1,buffer,976760837(60800/140/18)) lseek err Invalid argument
file_pread(4,1,buffer,976760838(60800/140/19)) lseek err Invalid argument
file_pread(4,1,buffer,976760839(60800/140/20)) lseek err Invalid argument
file_pread(4,1,buffer,976760840(60800/140/21)) lseek err Invalid argument
file_pread(4,1,buffer,976760841(60800/140/22)) lseek err Invalid argument
file_pread(4,1,buffer,976760842(60800/140/23)) lseek err Invalid argument
file_pread(4,1,buffer,976760843(60800/140/24)) lseek err Invalid argument
file_pread(4,1,buffer,976760844(60800/140/25)) lseek err Invalid argument
file_pread(4,1,buffer,976760845(60800/140/26)) lseek err Invalid argument
file_pread(4,1,buffer,976760846(60800/140/27)) lseek err Invalid argument
file_pread(4,1,buffer,976760847(60800/140/28)) lseek err Invalid argument
file_pread(4,1,buffer,976760848(60800/140/29)) lseek err Invalid argument
file_pread(4,1,buffer,976760849(60800/140/30)) lseek err Invalid argument
file_pread(4,1,buffer,976760850(60800/140/31)) lseek err Invalid argument
file_pread(4,1,buffer,976760851(60800/140/32)) lseek err Invalid argument
file_pread(4,1,buffer,976760852(60800/140/33)) lseek err Invalid argument
file_pread(4,1,buffer,976760853(60800/140/34)) lseek err Invalid argument
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
file_pread(4,2,buffer,6293514(391/192/4)) lseek err Invalid argument
file_pread(4,1,buffer,6293514(391/192/4)) lseek err Invalid argument
NTFS Can't read "root directory" in MFT
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
file_pread(4,1,buffer,1953519615(121600/247/55)) lseek err Invalid argument
filesystem size 1953517568 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
filesystem size 1953517568 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy original boot sector over backup boot
file_pwrite(4,1,buffer,1953519615(121600/247/55)) seek err Invalid argument
Write error: Can't overwrite NTFS backup boot sector
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
file_pread(4,1,buffer,1953519615(121600/247/55)) lseek err Invalid argument
filesystem size 1953517568 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
}[/scroll]