Recovery of Truecrypt Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Noah
Posts: 2
Joined: 15 Oct 2012, 23:49

Recovery of Truecrypt Partition

#1 Post by Noah »

Like most of the people who find themselves on this wonderful forum, I accidently did something I was not supposed to do. While installing Ubuntu, I assumed the drive it attempted to install itself on was the one I intended it to install on. The drive in question (/dev/sdb) was a 750 GB truecrypt drive in NTFS format.

I've tried just about everything I could up to this point, searching the forums and other sites high and low to figure it out on my own. My attempts were futile (although I did learn quite a bit in the process).


I could try and explain more, but I think posting the log should do more justice. This log is the appended version.

It would mean so much to me if I could recover the files on this drive; years of my research and inventions are stored on it. Either way, I'd like to thank the people of these forums in advance for the diligent work I've seen in so many previous posts. An excellent community for an excellent program.

Code: Select all

Mon Oct 15 06:45:28 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-29-generic-pae (#46-Ubuntu SMP Fri Jul 27 17:25:43 UTC 2012) i686
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:16:54
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       1250263728 sectors
/dev/sda: user_max   1250263728 sectors
/dev/sda: dco        1250263728 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       1465149168 sectors
/dev/sdb: user_max   1465149168 sectors
/dev/sdb: native_max 1465149168 sectors
/dev/sdb: dco        1465149168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD6400AAKS-65A7B0, S/N:WD-WMASY2669025, FW:01.03B01
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD01ZFL, FW:3.AAK
Disk /dev/sdc - 1031 MB / 984 MiB - CHS 1015 32 62, sector size=512 - PNY USB 2.0 FD, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sdb - 750 GB / 698 GiB - ST3750640AS
Partition table type: Intel

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Computes LBA from CHS for Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
BAD_RS LBA=887256156 135029
check_part_i386 failed for partition type 07
     HPFS - NTFS          55229  36  4 169397 160 36 1834116765
This partition ends after the disk limits. (start=887256156, size=1834116765, end=2721372920, disk end=1465160130)
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (750 GB / 698 GiB) seems too small! (< 1393 GB / 1297 GiB)
The following partition can't be recovered:
     HPFS - NTFS          55229  36  4 169397 160 36 1834116765

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
BAD_RS LBA=887256156 135029
check_part_i386 failed for partition type 07
     HPFS - NTFS          55229  36  4 169397 160 36 1834116765
This partition ends after the disk limits. (start=887256156, size=1834116765, end=2721372920, disk end=1465160130)
Search for partition aborted
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (750 GB / 698 GiB) seems too small! (< 1393 GB / 1297 GiB)
The following partition can't be recovered:
     HPFS - NTFS          55229  36  4 169397 160 36 1834116765

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB


dir_partition inode=2
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
Directory /
       2 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 .
       2 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 ..
      11 drwx------     0      0     16384 14-Oct-2012 17:45 lost+found
 21233665 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 etc
 23855105 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 media
 1572865 drwxr-xr-x     0      0      4096 17-Aug-2012 22:11 bin
 7077889 drwxr-xr-x     0      0      4096 14-Oct-2012 17:47 boot
 24641537 drwxr-xr-x     0      0      4096 17-Aug-2012 22:06 dev
 39583745 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 home
 6291457 drwxr-xr-x     0      0      4096 17-Aug-2012 22:09 lib
 14417921 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 mnt
 17301505 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 opt
 15204353 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 proc
 15335425 drwx------     0      0      4096 17-Aug-2012 22:10 root
 38273025 drwxr-xr-x     0      0      4096 17-Aug-2012 22:08 run
 2097153 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 sbin
 5505025 drwxr-xr-x     0      0      4096  5-Mar-2012 13:48 selinux
 13893633 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 srv
 19660801 drwxr-xr-x     0      0      4096 14-Apr-2012 09:26 sys
 17432577 drwxrwxrwt     0      0      4096 14-Oct-2012 17:51 tmp
 24117249 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 usr
 25952257 drwxr-xr-x     0      0      4096 17-Aug-2012 22:08 var
      12 lrwxrwxrwx     0      0        37 14-Oct-2012 17:46 initrd.img
      13 lrwxrwxrwx     0      0        33 14-Oct-2012 17:46 vmlinuz
 1835009 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 cdrom

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
SIGHUP detected! TestDisk has been killed.


Mon Oct 15 11:02:46 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-29-generic-pae (#46-Ubuntu SMP Fri Jul 27 17:25:43 UTC 2012) i686
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:16:54
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       1250263728 sectors
/dev/sda: user_max   1250263728 sectors
/dev/sda: dco        1250263728 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       1465149168 sectors
/dev/sdb: user_max   1465149168 sectors
/dev/sdb: native_max 1465149168 sectors
/dev/sdb: dco        1465149168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD6400AAKS-65A7B0, S/N:WD-WMASY2669025, FW:01.03B01
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD01ZFL, FW:3.AAK
Disk /dev/sdc - 1031 MB / 984 MiB - CHS 1015 32 62, sector size=512 - PNY USB 2.0 FD, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sdb - 750 GB / 698 GiB - ST3750640AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 P Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
 2 E extended             90157  65 19 91201  52 51   16771074
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
     SWAP2 version 1, 8586 MB / 8189 MiB

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Computes LBA from CHS for Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
Search for partition aborted

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New options :
 Dump : No
 Cylinder boundary : Yes
 Allow partial last cylinder : Yes
 Expert mode : No

TestDisk exited normally.


Mon Oct 15 11:13:30 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-29-generic-pae (#46-Ubuntu SMP Fri Jul 27 17:25:43 UTC 2012) i686
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:16:54
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       1250263728 sectors
/dev/sda: user_max   1250263728 sectors
/dev/sda: dco        1250263728 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       1465149168 sectors
/dev/sdb: user_max   1465149168 sectors
/dev/sdb: native_max 1465149168 sectors
/dev/sdb: dco        1465149168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - WDC WD6400AAKS-65A7B0, S/N:WD-WMASY2669025, FW:01.03B01
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD01ZFL, FW:3.AAK
Disk /dev/sdc - 1031 MB / 984 MiB - CHS 1015 32 62, sector size=512 - PNY USB 2.0 FD, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sdb - 750 GB / 698 GiB - ST3750640AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 P Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
 2 E extended             90157  65 19 91201  52 51   16771074
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
     SWAP2 version 1, 8586 MB / 8189 MiB
search_superblock

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 2 (block=0, blocksize=4096)

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 262144 (block=32768, blocksize=4096)

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 786432 (block=98304, blocksize=4096)

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 1310720 (block=163840, blocksize=4096)

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 1835008 (block=229376, blocksize=4096)

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 2359296 (block=294912, blocksize=4096)

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 6553600 (block=819200, blocksize=4096)

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 7077888 (block=884736, blocksize=4096)

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 12845056 (block=1605632, blocksize=4096)

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/5525, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
Ext2 superblock found at sector 21233664 (block=2654208, blocksize=4096)
  Linux                    0  32 33 90157  32 51 1448372224
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []
superblock 163840, blocksize=4096 []
superblock 229376, blocksize=4096 []
superblock 294912, blocksize=4096 []
superblock 819200, blocksize=4096 []
superblock 884736, blocksize=4096 []
superblock 1605632, blocksize=4096 []
superblock 2654208, blocksize=4096 []

To repair the filesystem using alternate superblock, run
fsck.ext4 -p -b superblock -B blocksize device

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 P Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
 2 E extended             90157  65 19 91201  52 51   16771074
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
     SWAP2 version 1, 8586 MB / 8189 MiB
Change partition type:
 1 P HPFS - NTFS              0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
filesystem size           1
sectors_per_cluster       0
mft_lcn                   0
mftmirr_lcn               0
clusters_per_mft_record   0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
filesystem size           1
sectors_per_cluster       0
mft_lcn                   0
mftmirr_lcn               0
clusters_per_mft_record   0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.


dir_partition inode=2
 1 P HPFS - NTFS              0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
Directory /
       2 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 .
       2 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 ..
      11 drwx------     0      0     16384 14-Oct-2012 17:45 lost+found
 21233665 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 etc
 23855105 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 media
 1572865 drwxr-xr-x     0      0      4096 17-Aug-2012 22:11 bin
 7077889 drwxr-xr-x     0      0      4096 14-Oct-2012 17:47 boot
 24641537 drwxr-xr-x     0      0      4096 17-Aug-2012 22:06 dev
 39583745 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 home
 6291457 drwxr-xr-x     0      0      4096 17-Aug-2012 22:09 lib
 14417921 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 mnt
 17301505 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 opt
 15204353 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 proc
 15335425 drwx------     0      0      4096 17-Aug-2012 22:10 root
 38273025 drwxr-xr-x     0      0      4096 17-Aug-2012 22:08 run
 2097153 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 sbin
 5505025 drwxr-xr-x     0      0      4096  5-Mar-2012 13:48 selinux
 13893633 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 srv
 19660801 drwxr-xr-x     0      0      4096 14-Apr-2012 09:26 sys
 17432577 drwxrwxrwt     0      0      4096 14-Oct-2012 17:51 tmp
 24117249 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 usr
 25952257 drwxr-xr-x     0      0      4096 17-Aug-2012 22:08 var
      12 lrwxrwxrwx     0      0        37 14-Oct-2012 17:46 initrd.img
      13 lrwxrwxrwx     0      0        33 14-Oct-2012 17:46 vmlinuz
 1835009 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 cdrom

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Computes LBA from CHS for Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
BAD_RS LBA=887256156 135029
check_part_i386 failed for partition type 07
     HPFS - NTFS          55229  36  4 169397 160 36 1834116765
This partition ends after the disk limits. (start=887256156, size=1834116765, end=2721372920, disk end=1465160130)
Search for partition aborted
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (750 GB / 698 GiB) seems too small! (< 1393 GB / 1297 GiB)
The following partition can't be recovered:
     HPFS - NTFS          55229  36  4 169397 160 36 1834116765

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB


dir_partition inode=2
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
Directory /
       2 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 .
       2 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 ..
      11 drwx------     0      0     16384 14-Oct-2012 17:45 lost+found
 21233665 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 etc
 23855105 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 media
 1572865 drwxr-xr-x     0      0      4096 17-Aug-2012 22:11 bin
 7077889 drwxr-xr-x     0      0      4096 14-Oct-2012 17:47 boot
 24641537 drwxr-xr-x     0      0      4096 17-Aug-2012 22:06 dev
 39583745 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 home
 6291457 drwxr-xr-x     0      0      4096 17-Aug-2012 22:09 lib
 14417921 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 mnt
 17301505 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 opt
 15204353 drwxr-xr-x     0      0      4096 19-Apr-2012 09:32 proc
 15335425 drwx------     0      0      4096 17-Aug-2012 22:10 root
 38273025 drwxr-xr-x     0      0      4096 17-Aug-2012 22:08 run
 2097153 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 sbin
 5505025 drwxr-xr-x     0      0      4096  5-Mar-2012 13:48 selinux
 13893633 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 srv
 19660801 drwxr-xr-x     0      0      4096 14-Apr-2012 09:26 sys
 17432577 drwxrwxrwt     0      0      4096 14-Oct-2012 17:51 tmp
 24117249 drwxr-xr-x     0      0      4096 17-Aug-2012 22:05 usr
 25952257 drwxr-xr-x     0      0      4096 17-Aug-2012 22:08 var
      12 lrwxrwxrwx     0      0        37 14-Oct-2012 17:46 initrd.img
      13 lrwxrwxrwx     0      0        33 14-Oct-2012 17:46 vmlinuz
 1835009 drwxr-xr-x     0      0      4096 14-Oct-2012 17:51 cdrom

interface_write()
 1 P Linux                    0  32 33 90157  32 51 1448372224
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 P Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
 2 E extended             90157  65 19 91201  52 51   16771074
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
     SWAP2 version 1, 8586 MB / 8189 MiB
Change partition type:
     HPFS - NTFS          55229   0  1 91201 254 63  577906245
test_structure_i386: severe error

ntfs_boot_sector
     HPFS - NTFS          55229   0  1 91201 254 63  577906245
filesystem size           6077398527727424578 1
sectors_per_cluster       218 0
mft_lcn                   1803066754 0
mftmirr_lcn               3695336872 0
clusters_per_mft_record   -97 0
clusters_per_index_record 79 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
     HPFS - NTFS          55229   0  1 91201 254 63  577906245
filesystem size           6077398527727424578 1
sectors_per_cluster       218 0
mft_lcn                   1803066754 0
mftmirr_lcn               3695336872 0
clusters_per_mft_record   -97 0
clusters_per_index_record 79 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.
Not an exFAT boot sector.

ntfs_boot_sector
     HPFS - NTFS          55229   0  1 91201 254 63  577906245
filesystem size           6077398527727424578 1
sectors_per_cluster       218 0
mft_lcn                   1803066754 0
mftmirr_lcn               3695336872 0
clusters_per_mft_record   -97 0
clusters_per_index_record 79 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Search mft stopped:     327680/577906245
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
     HPFS - NTFS          55229   0  1 91201 254 63  577906245
filesystem size           6077398527727424578 1
sectors_per_cluster       218 0
mft_lcn                   1803066754 0
mftmirr_lcn               3695336872 0
clusters_per_mft_record   -97 0
clusters_per_index_record 79 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
Search for partition aborted

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 P Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
 2 E extended             90157  65 19 91201  52 51   16771074
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
     SWAP2 version 1, 8586 MB / 8189 MiB

Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 P Linux                    0  32 33 90157  32 51 1448372224
 2 E extended             90157  65 19 91201  52 51   16771074
No partition is bootable
 5 L Linux Swap           90157  65 21 91201  52 51   16771072
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91202 255 63

recover_EXT2: s_block_group_nr=0/5525, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 181046528
recover_EXT2: part_size 1448372224
     Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
     Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

Results
   * Linux                    0  32 33 90157  32 51 1448372224
     EXT4 Large file Sparse superblock, 741 GB / 690 GiB
   P Linux Swap           90157  65 21 91201  52 35   16771056
     SWAP2 version 1, 8586 MB / 8188 MiB

interface_write()
 1 * Linux                    0  32 33 90157  32 51 1448372224
 2 P Linux Swap           90157  65 21 91201  52 35   16771056
Last edited by Noah on 18 Oct 2012, 01:14, edited 1 time in total.

Fiecluxulpick
Posts: 1
Joined: 17 Oct 2012, 23:15

Thx

#2 Post by Fiecluxulpick »

Thank you !!
Image

Noah
Posts: 2
Joined: 15 Oct 2012, 23:49

Re: Recovery of Truecrypt Partition

#3 Post by Noah »

I'm going insane at this point (mostly because I continue to do the same thing expecting different results). This is what I see when I conduct a deeper search. I apologize in advance for the terrible cropping. At this point, it doesn't allow me to another but continue, at which point its like being back at the beginning. I've tried using photorec, doesn't give me a single original file. Please help!
Terminal 1.jpg
Terminal 1.jpg (39.69 KiB) Viewed 2165 times

Locked