Where does testdisk store analyze results?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mausebaer
Posts: 12
Joined: 22 Mar 2012, 10:06

Where does testdisk store analyze results?

#1 Post by mausebaer »

Hi!

Just two questions:

I want to recover partitions which I deleted by mistake.

Running testdisk in simple mode doesn't show the deleted partitions, however if I run the "deeper search" several deleted partitions were found. That's OK so far.

1) I tried to check the contents using the P key, one partition after the other. At the third partition testdisk crashed without any warning after pressing P. What did I wrong?

2) After having run the deeper search the analyse results are shown. Can I strore the results somewhere and start testdisk with these results again (I mean to continue testdisk at that point where it crashed)? It would save me a lot of time, because the deeper search takes several haurs...

Thanks for your reply,

Wolfgang

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Where does testdisk store analyze results?

#2 Post by Fiona »

Did you use the 64 bit version?
It's only intended on machines lacking WOW64 like itanium.
If not, please copy and paste the content of your testdisk.log.
You'll find it in your testdisk folder.
It would be possible that a damaged file system can cause that testdisk crashes.
But this is very rare.

Fiona

enkenk
Posts: 3
Joined: 10 May 2013, 00:27

Re: Where does testdisk store analyze results?

#3 Post by enkenk »

I have a similar problem: Testdisk always crashes if I want to copy files from the disk. Copying single files is no problem, but when copying directories that contain subdirectories, testdisk always crashes. I am using Testdisk 32 bit, on Windows 8 64bit

mausebaer
Posts: 12
Joined: 22 Mar 2012, 10:06

Re: Where does testdisk store analyze results?

#4 Post by mausebaer »

Fiona wrote:Did you use the 64 bit version?
No. I used V. 6.13 32bit
B.T.W. the OS is Vista 32bit, as you can also see below.

But I'm trying now V. 6.14wip...
What's the main difference between v6.13 and 6.14wip?

Again my second question: Can I start testdisk somehow without searching the whole disk with the results of the previous run???

I'm using here the english forum. Should I better use the german forum, as I am in Germany?

Here the log:


Fri May 10 16:56:54 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=157287440384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857595904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=713023798784
filewin32_getfilesize(\\.\F:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\F:
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=235794101760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=500096991744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=115343101440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=107380997632
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=2097152000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=1646719995904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=80073068544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=79960211456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=903304183808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=146796571648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=99501212160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=33427537920
file_pread(4,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,1565576833(364801/254/63)) lseek err Invalid argument
file_pread(7,1,buffer,3907040129(243201/254/63)) lseek err Invalid argument
file_pread(8,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
file_pread(9,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-07A7B2, S/N:2020202057202d44435753413359343834383836, FW:01.03B01
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103UJ, S/N:31535033394a5330313336303938202020202020, FW:1AA01113
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00MMMB0, S/N:2020202057202d4443575741325a383337373932, FW:80.00A80
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARX-00PASB0, S/N:2020202057202d4443575a413741303930353834, FW:51.0AB51
Disk /dev/sde - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST916082 1AS
Disk /dev/sdf - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WD 5000AAV External, FW:1.06

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - SAMSUNG HD103UJ
Partition table type: Intel
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 86687/0/1
NTFS at 100710/0/1
FAT32 at 117537/0/1
Info: size boot_sector 65288160, partition 65288160
FAT1 : 32-15963
FAT2 : 15964-31895
start_rootdir : 31896 root cluster : 2
Data : 31896-65288151
sectors : 65288160
cluster_size : 32
no_of_cluster : 2039258 (2 - 2039259)
fat_length 15932 calculated 15932
NTFS at 0/32/33
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 P HPFS - NTFS 86687 0 1 100709 254 63 225279495 [1TB-Part.2 Work-Areas & System]
2 P HPFS - NTFS 100710 0 1 117536 254 63 270325755 [1TB-Part.3 Win8]
3 P FAT32 LBA 117537 0 1 121600 254 63 65288160 [FAT32_WIN98]
4 E extended LBA 0 31 33 86686 254 63 1392624670
No partition is bootable
5 L HPFS - NTFS 0 32 33 86686 254 63 1392624607 [1TB-Part.1 Daten]
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size 1392624607
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094975
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 86686 254 63 1392624607 [1TB-Part.1 Daten]
NTFS, 713 GB / 664 GiB
NTFS at 86687/0/1
filesystem size 225279495
sectors_per_cluster 8
mft_lcn 3
mftmirr_lcn 14079968
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 86687 0 1 100709 254 63 225279495 [1TB-Part.2 Work-Areas & System]
NTFS, 115 GB / 107 GiB
NTFS at 100710/0/1
filesystem size 270325755
sectors_per_cluster 8
mft_lcn 3
mftmirr_lcn 16639323
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 100710 0 1 117536 254 63 270325755 [1TB-Part.3 Win8]
NTFS, 138 GB / 128 GiB
FAT32 at 117537/0/1
FAT1 : 32-15963
FAT2 : 15964-31895
start_rootdir : 31896 root cluster : 2
Data : 31896-65288151
sectors : 65288160
cluster_size : 32
no_of_cluster : 2039258 (2 - 2039259)
fat_length 15932 calculated 15932

FAT32 at 117537/0/1
FAT32 LBA 117537 0 1 121600 254 63 65288160 [FAT32_WIN98]
FAT32, 33 GB / 31 GiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525217(121601/81/50)) lseek err Invalid argument
file_pread(5,1,buffer,1953525217(121601/81/50)) lseek err Invalid argument
file_pread(5,8,buffer,1953525345(121601/83/52)) lseek err Invalid argument
file_pread(5,8,buffer,1953525473(121601/85/54)) lseek err Invalid argument
file_pread(5,8,buffer,1953525601(121601/87/56)) lseek err Invalid argument
file_pread(5,8,buffer,1953525729(121601/89/58)) lseek err Invalid argument
file_pread(5,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6

Results
L HPFS - NTFS 0 32 33 86686 254 63 1392624607 [1TB-Part.1 Daten]
NTFS, 713 GB / 664 GiB
* HPFS - NTFS 86687 0 1 100709 254 63 225279495 [1TB-Part.2 Work-Areas & System]
NTFS, 115 GB / 107 GiB
P HPFS - NTFS 100710 0 1 117536 254 63 270325755 [1TB-Part.3 Win8]
NTFS, 138 GB / 128 GiB
P FAT32 LBA 117537 0 1 121600 254 63 65288160 [FAT32_WIN98]
FAT32, 33 GB / 31 GiB

interface_write()
1 E extended LBA 0 1 1 86687 0 1 1392626592
2 * HPFS - NTFS 86687 0 1 100709 254 63 225279495 [1TB-Part.2 Work-Areas & System]
3 P HPFS - NTFS 100710 0 1 117536 254 63 270325755 [1TB-Part.3 Win8]
4 P FAT32 LBA 117537 0 1 121600 254 63 65288160 [FAT32_WIN98]
5 L HPFS - NTFS 0 32 33 86686 254 63 1392624607 [1TB-Part.1 Daten]

mausebaer
Posts: 12
Joined: 22 Mar 2012, 10:06

Re: Where does testdisk store analyze results?

#5 Post by mausebaer »

I managed now to locate the lost partition.
Everything seemed to be OK, howewer ... :evil:
...the partition was marked as RAW...
I tried to write an image of it, what lasted about 30 hours (the partition is about 450GB large), but in the end the PC freezed after about 80% of writing...
So i had to force the PC to run down, because of no reaktion.

1) Is it possible to recover the original previous structure out of a RAW-marked partition?
(single files do not interest me too much)

2) What can I do to extract the original file structure out of the truncated image file image.dd (which is about 400 GB large...?

I googled already, also here in this forum, but nothing helped by now...

Thanks a lot for hints,

Wolfgang

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Where does testdisk store analyze results?

#6 Post by Fiona »

@ enkenk:

Might be possible that a couple of files are corrupt.
Then, it's possible that testdisk crashes during copying.
Would it be possible to exclude that folder ant trying to use the next one?

Also check your disk using crystaldiskinfo:
http://crystalmark.info/software/Crysta ... dex-e.html

@ mausebaer:
I tried to write an image of it, what lasted about 30 hours (the partition is about 450GB large), but in the end the PC freezed after about 80% of writing...
In some cases, it's faster to have a try to list your data and copy them to another intact disk or partition.
If listing of files crashes, you can have another try using this procedure:
Start TestDisk, confirm at create a log with enter and select your affected disk.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
Confirm at Boot.
Highlight Rebuild BS and hit Enter.
Rebuild your BS will be in progress.
Normally, it takes some minutes.
If you see a menu List, please highlight it and press enter.
Please let me know, do you see your data or an error message.
To get back to the previous screen, easily press q for Quit.

If you still experience problems:
Would it be possible to check your disk using CrystalDisk Info?;
http://crystalmark.info/software/Crysta ... dex-e.html
It's unusual that testdisk crashes.
Often indicates a damaged file system or bad sectors.
I already downloaded the newest version and tested it.
I didn't experience any problems.
Even to copy data to another disk, worked great.

Antivirus and some other background processes can cause problems.
In case it's advisable to disable background processes and services using msconfig.

Locked