Re: Query on Lost partition on Windows Vista with RAID 1
Posted: 28 Nov 2013, 11:47
Here are the screen shots plus the new log:
Wed Nov 27 12:48:54 2013
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=319999180800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=319999180800
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319997083648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=319997083648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=5230495744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2000397883392
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD32 00KS-75PFB0, FW:21.0
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63, sector size=512 - Dell VIRTUAL DISK, FW:1028
Disk /dev/sdg - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Expansion Desk, S/N:NA4LC2P3, FW:0319
Drive E: - 5230 MB / 4988 MiB - CHS 1247 64 32, sector size=2048 - HL-DT-ST DVD-ROM GDR8164B, FW:0D08
Drive F: - 2048 B - CHS 1 64 32, sector size=2048 - PHILIPS DVD+-RW DVD8801, FW:4D28
Partition table type (auto): Intel
Disk /dev/sdb - 319 GB / 298 GiB - Dell VIRTUAL DISK
Partition table type: Intel
Analyse Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
search_part()
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(5,2,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,2,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,2,buffer,624998463(38904/90/34)) lseek err Invalid argument
file_pread(5,2,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,14,buffer,624998401(38904/89/35)) lseek err Invalid argument
file_pread(5,3,buffer,624998415(38904/89/49)) lseek err Invalid argument
file_pread(5,3,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,8,buffer,624998478(38904/90/49)) lseek err Invalid argument
file_pread(5,11,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,2,buffer,625000447(38904/122/2)) lseek err Invalid argument
file_pread(5,1,buffer,624998418(38904/89/52)) lseek err Invalid argument
file_pread(5,1,buffer,624998465(38904/90/36)) lseek err Invalid argument
file_pread(5,1,buffer,624998486(38904/90/57)) lseek err Invalid argument
file_pread(5,1,buffer,624998536(38904/91/44)) lseek err Invalid argument
file_pread(5,1,buffer,625000449(38904/122/4)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdb - 319 GB / 298 GiB - Dell VIRTUAL DISK
Partition table type: Intel
Analyse Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
search_part()
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(5,2,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,2,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,2,buffer,624998463(38904/90/34)) lseek err Invalid argument
file_pread(5,2,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,14,buffer,624998401(38904/89/35)) lseek err Invalid argument
file_pread(5,3,buffer,624998415(38904/89/49)) lseek err Invalid argument
file_pread(5,3,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,8,buffer,624998478(38904/90/49)) lseek err Invalid argument
file_pread(5,11,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,2,buffer,625000447(38904/122/2)) lseek err Invalid argument
file_pread(5,1,buffer,624998418(38904/89/52)) lseek err Invalid argument
file_pread(5,1,buffer,624998465(38904/90/36)) lseek err Invalid argument
file_pread(5,1,buffer,624998486(38904/90/57)) lseek err Invalid argument
file_pread(5,1,buffer,624998536(38904/91/44)) lseek err Invalid argument
file_pread(5,1,buffer,625000449(38904/122/4)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD32 00KS-75PFB0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(4,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(4,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(4,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(4,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(4,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(4,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(4,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(4,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(4,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304
NTFS, blocksize=4096, 319 GB / 298 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304
Other screens to follow
Wed Nov 27 12:48:54 2013
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=319999180800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=319999180800
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319997083648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=319997083648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=5230495744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2000397883392
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD32 00KS-75PFB0, FW:21.0
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63, sector size=512 - Dell VIRTUAL DISK, FW:1028
Disk /dev/sdg - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Expansion Desk, S/N:NA4LC2P3, FW:0319
Drive E: - 5230 MB / 4988 MiB - CHS 1247 64 32, sector size=2048 - HL-DT-ST DVD-ROM GDR8164B, FW:0D08
Drive F: - 2048 B - CHS 1 64 32, sector size=2048 - PHILIPS DVD+-RW DVD8801, FW:4D28
Partition table type (auto): Intel
Disk /dev/sdb - 319 GB / 298 GiB - Dell VIRTUAL DISK
Partition table type: Intel
Analyse Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
search_part()
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(5,2,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,2,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,2,buffer,624998463(38904/90/34)) lseek err Invalid argument
file_pread(5,2,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,14,buffer,624998401(38904/89/35)) lseek err Invalid argument
file_pread(5,3,buffer,624998415(38904/89/49)) lseek err Invalid argument
file_pread(5,3,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,8,buffer,624998478(38904/90/49)) lseek err Invalid argument
file_pread(5,11,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,2,buffer,625000447(38904/122/2)) lseek err Invalid argument
file_pread(5,1,buffer,624998418(38904/89/52)) lseek err Invalid argument
file_pread(5,1,buffer,624998465(38904/90/36)) lseek err Invalid argument
file_pread(5,1,buffer,624998486(38904/90/57)) lseek err Invalid argument
file_pread(5,1,buffer,624998536(38904/91/44)) lseek err Invalid argument
file_pread(5,1,buffer,625000449(38904/122/4)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdb - 319 GB / 298 GiB - Dell VIRTUAL DISK
Partition table type: Intel
Analyse Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
search_part()
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(5,2,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,2,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,2,buffer,624998463(38904/90/34)) lseek err Invalid argument
file_pread(5,2,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.
file_pread(5,14,buffer,624998401(38904/89/35)) lseek err Invalid argument
file_pread(5,3,buffer,624998415(38904/89/49)) lseek err Invalid argument
file_pread(5,3,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,8,buffer,624998478(38904/90/49)) lseek err Invalid argument
file_pread(5,11,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,2,buffer,625000447(38904/122/2)) lseek err Invalid argument
file_pread(5,1,buffer,624998418(38904/89/52)) lseek err Invalid argument
file_pread(5,1,buffer,624998465(38904/90/36)) lseek err Invalid argument
file_pread(5,1,buffer,624998486(38904/90/57)) lseek err Invalid argument
file_pread(5,1,buffer,624998536(38904/91/44)) lseek err Invalid argument
file_pread(5,1,buffer,625000449(38904/122/4)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD32 00KS-75PFB0
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(4,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(4,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(4,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(4,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(4,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(4,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(4,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(4,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(4,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304
NTFS, blocksize=4096, 319 GB / 298 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304
Other screens to follow