RAW recovery
Posted: 02 Jun 2014, 09:09
Hi
I had success using test disk few times in history, but now i can't seem to fix this drive.
its a 1 gb WD with 2 partitions, and it was not a system disk, just for data...
I belive it was just a power failure...
I tried using both 7.0 and 6.14 versions
here is a log file
Mon Jun 2 10:00:09 2014
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=157286400000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=28237103104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=314580140032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=999292928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=524287540224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=475914700800
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EACS-00C7B0, S/N:2020202057202d4443575341324a303033393432, FW:01.01B01
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA DT01ACA050, S/N:2020202020202020202031204d345a4838375347, FW:MS1OA750
Drive F: - 999 MB / 953 MiB - CHS 238 64 32, sector size=2048 - DTSOFT BDROM, FW:1.05
Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EACS-00C7B0
Partition table type: Intel
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 63741/0/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
NTFS at 63741/0/1
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525181(121601/81/14)) lseek err Invalid argument
file_pread(4,1,buffer,1953525181(121601/81/14)) lseek err Invalid argument
file_pread(4,8,buffer,1953525309(121601/83/16)) lseek err Invalid argument
file_pread(4,8,buffer,1953525437(121601/85/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525565(121601/87/20)) lseek err Invalid argument
file_pread(4,8,buffer,1953525693(121601/89/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
P HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
NTFS at 63741/0/1
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
NTFS at 121600/254/63
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS found using backup sector, blocksize=4096, 475 GB / 443 GiB
NTFS at 121600/254/63
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,4096,buffer,1959811520(121992/159/24)) lseek err Invalid argument
file_pread(4,1,buffer,1959811520(121992/159/24)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 179460 254 62 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
This partition ends after the disk limits. (start=1953520064, size=929520900, end=2883040963, disk end=1953525168)
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1476 GB / 1374 GiB)
The following partition can't be recovered:
HPFS - NTFS 121600 254 63 179460 254 62 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
P HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900
in 64 bit version i also tried analyzing the logical drive not the physical disk and here are some errors
Analyse Drive G: - 524 GB / 488 GiB - CHS 63740 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410
Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724
Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724
Analyse Drive G: - 524 GB / 488 GiB - CHS 63740 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410
Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724
Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724
I had success using test disk few times in history, but now i can't seem to fix this drive.
its a 1 gb WD with 2 partitions, and it was not a system disk, just for data...
I belive it was just a power failure...
I tried using both 7.0 and 6.14 versions
here is a log file
Mon Jun 2 10:00:09 2014
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=157286400000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=28237103104
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=314580140032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=999292928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=524287540224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=475914700800
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EACS-00C7B0, S/N:2020202057202d4443575341324a303033393432, FW:01.01B01
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA DT01ACA050, S/N:2020202020202020202031204d345a4838375347, FW:MS1OA750
Drive F: - 999 MB / 953 MiB - CHS 238 64 32, sector size=2048 - DTSOFT BDROM, FW:1.05
Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EACS-00C7B0
Partition table type: Intel
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 63741/0/1
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
NTFS at 63741/0/1
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
file_pread(4,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1953525181(121601/81/14)) lseek err Invalid argument
file_pread(4,1,buffer,1953525181(121601/81/14)) lseek err Invalid argument
file_pread(4,8,buffer,1953525309(121601/83/16)) lseek err Invalid argument
file_pread(4,8,buffer,1953525437(121601/85/18)) lseek err Invalid argument
file_pread(4,8,buffer,1953525565(121601/87/20)) lseek err Invalid argument
file_pread(4,8,buffer,1953525693(121601/89/22)) lseek err Invalid argument
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
P HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/1
filesystem size 1023999102
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 63999943
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
NTFS at 63741/0/1
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
NTFS at 121600/254/63
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS found using backup sector, blocksize=4096, 475 GB / 443 GiB
NTFS at 121600/254/63
filesystem size 929520900
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 58095056
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,4096,buffer,1959811520(121992/159/24)) lseek err Invalid argument
file_pread(4,1,buffer,1959811520(121992/159/24)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 179460 254 62 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
This partition ends after the disk limits. (start=1953520064, size=929520900, end=2883040963, disk end=1953525168)
file_pread(4,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(4,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(4,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(4,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(4,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(4,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(4,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(4,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1476 GB / 1374 GiB)
The following partition can't be recovered:
HPFS - NTFS 121600 254 63 179460 254 62 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 63740 254 63 1023999102
NTFS, blocksize=4096, 524 GB / 488 GiB
P HPFS - NTFS 63741 0 1 121600 254 63 929520900
NTFS, blocksize=4096, 475 GB / 443 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 63740 254 63 1023999102
2 P HPFS - NTFS 63741 0 1 121600 254 63 929520900
in 64 bit version i also tried analyzing the logical drive not the physical disk and here are some errors
Analyse Drive G: - 524 GB / 488 GiB - CHS 63740 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410
Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724
Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724
Analyse Drive G: - 524 GB / 488 GiB - CHS 63740 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410
Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724
Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724