Page 2 of 2

Re: Query on Lost partition on Windows Vista with RAID 1

Posted: 28 Nov 2013, 11:47
by Thornybird
Here are the screen shots plus the new log:
screen1.jpg
screen1.jpg (50.18 KiB) Viewed 1768 times
screen2.jpg
screen2.jpg (51.44 KiB) Viewed 1768 times
screen3.jpg
screen3.jpg (52.13 KiB) Viewed 1768 times

Wed Nov 27 12:48:54 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=319999180800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=319999180800
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319997083648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=319997083648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=5230495744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2000397883392
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD32 00KS-75PFB0, FW:21.0
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63, sector size=512 - Dell VIRTUAL DISK, FW:1028
Disk /dev/sdg - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Expansion Desk, S/N:NA4LC2P3, FW:0319
Drive E: - 5230 MB / 4988 MiB - CHS 1247 64 32, sector size=2048 - HL-DT-ST DVD-ROM GDR8164B, FW:0D08
Drive F: - 2048 B - CHS 1 64 32, sector size=2048 - PHILIPS DVD+-RW DVD8801, FW:4D28

Partition table type (auto): Intel
Disk /dev/sdb - 319 GB / 298 GiB - Dell VIRTUAL DISK
Partition table type: Intel

Analyse Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]

search_part()
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(5,2,buffer,624998400(38904/89/34)) ReadFile Incorrect function.

file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.

file_pread(5,2,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,2,buffer,624998463(38904/90/34)) lseek err Invalid argument
file_pread(5,2,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.

file_pread(5,14,buffer,624998401(38904/89/35)) lseek err Invalid argument
file_pread(5,3,buffer,624998415(38904/89/49)) lseek err Invalid argument
file_pread(5,3,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,8,buffer,624998478(38904/90/49)) lseek err Invalid argument
file_pread(5,11,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,2,buffer,625000447(38904/122/2)) lseek err Invalid argument
file_pread(5,1,buffer,624998418(38904/89/52)) lseek err Invalid argument
file_pread(5,1,buffer,624998465(38904/90/36)) lseek err Invalid argument
file_pread(5,1,buffer,624998486(38904/90/57)) lseek err Invalid argument
file_pread(5,1,buffer,624998536(38904/91/44)) lseek err Invalid argument
file_pread(5,1,buffer,625000449(38904/122/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdb - 319 GB / 298 GiB - Dell VIRTUAL DISK
Partition table type: Intel

Analyse Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]

search_part()
Disk /dev/sdb - 319 GB / 298 GiB - CHS 38904 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(5,2,buffer,624998400(38904/89/34)) ReadFile Incorrect function.

file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.

file_pread(5,2,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,2,buffer,624998463(38904/90/34)) lseek err Invalid argument
file_pread(5,2,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,1,buffer,624998400(38904/89/34)) ReadFile Incorrect function.

file_pread(5,14,buffer,624998401(38904/89/35)) lseek err Invalid argument
file_pread(5,3,buffer,624998415(38904/89/49)) lseek err Invalid argument
file_pread(5,3,buffer,624998462(38904/90/33)) lseek err Invalid argument
file_pread(5,8,buffer,624998478(38904/90/49)) lseek err Invalid argument
file_pread(5,11,buffer,624998525(38904/91/33)) lseek err Invalid argument
file_pread(5,2,buffer,625000447(38904/122/2)) lseek err Invalid argument
file_pread(5,1,buffer,624998418(38904/89/52)) lseek err Invalid argument
file_pread(5,1,buffer,624998465(38904/90/36)) lseek err Invalid argument
file_pread(5,1,buffer,624998486(38904/90/57)) lseek err Invalid argument
file_pread(5,1,buffer,624998536(38904/91/44)) lseek err Invalid argument
file_pread(5,1,buffer,625000449(38904/122/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
NTFS, blocksize=4096, 319 GB / 298 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304 [RAID1]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sda - 320 GB / 298 GiB - WDC WD32 00KS-75PFB0
Partition table type: Intel

Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304

search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
NTFS at 0/32/33
filesystem size 624994304
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 39062143
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38904 57 1 624994304
NTFS, blocksize=4096, 319 GB / 298 GiB
file_pread(4,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(4,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(4,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(4,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(4,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(4,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(4,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(4,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(4,2,buffer,625145855(38913/135/6)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 38904 57 1 624994304
NTFS, blocksize=4096, 319 GB / 298 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 38904 57 1 624994304


Other screens to follow

Re: Query on Lost partition on Windows Vista with RAID 1

Posted: 28 Nov 2013, 11:48
by Thornybird
screen4.jpg
screen4.jpg (38.91 KiB) Viewed 1768 times
screen5.jpg
screen5.jpg (44.69 KiB) Viewed 1768 times
p screen.jpg
p screen.jpg (29.32 KiB) Viewed 1768 times

Re: Query on Lost partition on Windows Vista with RAID 1

Posted: 28 Nov 2013, 12:28
by Thornybird
I just repeated scan of the disk called Virtual disk and pressed P to list files. This worked and contains all the files I expect to be on my C drive

Any help in understanding where my partition has gone or what has happened to the Raid.
But essentially I need to recover the files that were on the D drive. What should I do next.

Thank you in advance
Theresa

Re: Query on Lost partition on Windows Vista with RAID 1

Posted: 02 Dec 2013, 14:43
by Thornybird
Fiona,

do you have any further advice to assist me?
I've downloaded Recovermyfiles to backup the data from the hidden partition onto an external drive.

Can I use TestDisk any further to recover my machine?
TIA
Theresa