Page 1 of 1

File system corrupt after attempting NTFS partition repair

Posted: 22 Jul 2014, 22:58
by JamesH
Quick Summary
I have a 6 TB drive using GUID partition structure that contained 1 small reserved and 1 large NTFS partition. Windows stopped recognizing these and was displaying the entire disk as RAW in Disk Management. TestDisk could see the partitions (it displayed the reserved one twice) and could even list the files on the NTFS partition.

After having TestDisk write the partition data the NTFS partition is now displayed as Unallocated in Disk Management and even TestDisk can not display the file contents! I think it wrote the wrong partition data for the NTFS partition (see the before & after backup logs below).

Decided its best to stop making changes and seek advice before proceeding. I'm new to TestDisk so I'm hoping people on here will be able to help identify what went wrong and how best to recover from this.

Complete Details
I've got a 6 TB RAID 5 disk in my home server that's using HighPoint RocketRAID card. The power supply on the system died and it was off-line for awhile. Just replaced the power supply and everything seems fine except the 6TB drive now appears as RAW in Windows Disk Management instead of containing my NTFS data volume. The OS (Windows Server 2012 Standard) was on a different drive and boots fine.

Tried several recovery software tools to get the partition and/or data back. Both TestDisk (open source) and Active Partition Recovery (commercial) could see the partitions (1 small reserved, 1 large data) and could list my files. I paid for Active Partition Recovery and tried it since it seemed the most straight forward to use. Unfortunately it stopped during the restore partition process one prompt after where it requires a commercial license saying it can't recover the partition because its already active or live or something. Completely bogus, I'll be seeking a refund or a charge back (FYI).

TestDisk after running Analyze over night displayed a list of my files then allowed me to perform data recovery. I've discovered that you can "stop" the Analyze once it displays the partitions (which is almost immediate) instead of leaving it to run multiple hours which doesn't seem to change its results. I'm guessing / hoping that's fine to do because I updated to version 7 of TestDisk (was running 6.12), ran analyze again and stopped it to proceed.

TestDisk could have copied the data to a different location. Unfortunately I don't have 6 TB of disk space available to copy the data off so I tried writing the partitions and fixing it in-place. When I got to the repair partition options I had it "Write" the partition data to disk. It completed and said I needed to reboot to see the changes.

After rebooting Windows Disk Management now displays 2 small partitions and 1 big chunk of unallocated space. This is obviously wrong and the NTFS data is not accessible at all. Even TestDisk can't display the file contents and now shows "Can't open filesystem. Filesystem seems damaged." after performing Analyze.

Below is all of the relevant information I can think of which might help resolve this issue. I'm very experienced with system administration and such but have no experience with TestDisk and haven't had to manipulate / recover partitions in 10+ years so I'm stale and my memory is fuzzy on the topic.

Any advice or help would be greatly appreciated.

TestDisk Backup.log (before)

Code: Select all

    #1406052104 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
     1 : start=       34, size=   262144, Id=00, P
     2 : start=   264192, size=3130388480, Id=00, P
TestDisk Backup.log (after)

Code: Select all

    #1406053772 Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
     1 : start=     2048, size=   204800, Id=00, P
     2 : start=   206848, size=125829120, Id=00, P
Windows Disk Management (before)
I didn't write it down but the entire drive showed as a single RAW entry

Windows Disk Management (after)

Code: Select all

    Disk 3, Basic, 5588.81 GB, Online
    100 MB RAW, Healthy (Primary Partition)
    60 GB RAW, Healthy (Primary Partition)
    5528.71 GB, Unallocated
TestDisk Analyze display output (before)
I didn't save this. I *believe* it displayed the 1st reserved partition twice (with identical start and stop positions) and then the NTFS partition once. It also displayed number of bytes per sector mismatches warnings and I *believe* the numbers were the same before and after.

Hardware RAID
This is a RAID 5 disk implemented in hardware using a HighPoint RocketRAID card. RAID is configured using the card, not in Windows Disk Management. So Windows just sees this as a single large 6 TB drive and the fact that its a hardware RAID should be irrelevant.

TestDisk Analyze display output (after)

Code: Select all

    TestDisk 7.0-WIP, Data Recovery Utility, June 2014
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
    Current partition structure:
         Partition                  Start        End    Size in sectors
    
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     1 P MS Data                     2048     206847     204800
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     2 P MS Data                   206848  126035967  125829120
TestDisk log file
Note that this is the complete log containing multiple runs. The run that performed the write begins with Tue Jul 22 11:27:07 2014 or just search for "write!"

Code: Select all

    Tue Jul 22 11:26:54 2014
    Command line: TestDisk
    
    TestDisk 7.0-WIP, Data Recovery Utility, June 2014
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    OS: Windows Server 6.2.9200
    Compiler: GCC 4.7, Cygwin 1007.25
    Compilation date: 2014-06-21T09:12:27
    ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
    Hard disk list
    Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
    Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
    Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00
    
    SIGINT detected! TestDisk has been killed.
    
    Tue Jul 22 11:27:07 2014
    Command line: TestDisk
    
    TestDisk 7.0-WIP, Data Recovery Utility, June 2014
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    OS: Windows Server 6.2.9200
    Compiler: GCC 4.7, Cygwin 1007.25
    Compilation date: 2014-06-21T09:12:27
    ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80022134272
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=750156374016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=6000941727744
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80022134272
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=750156374016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=6000941727744
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80019980288
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=64424509440
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=1000202043392
    Hard disk list
    Disk /dev/sda - 80 GB / 74 GiB - CHS 9728 255 63, sector size=512 - INTEL SSDSA2M080G2GN, S/N:CVPO002501NH080BGN, FW:2CV102HA
    Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Hitachi HDT721010SLA360, S/N:STF607MH3HMXPK, FW:ST6OA3AA
    Disk /dev/sdc - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - ST3750640AS, S/N:5QD4KVRD, FW:3.AAK
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63, sector size=512 - HPT DISK 0_0, FW:4.00
    
    Partition table type (auto): EFI GPT
    Disk /dev/sdd - 6000 GB / 5588 GiB - HPT DISK 0_0
    Partition table type: EFI GPT
    New options :
     Dump : No
     Align partition: Yes
     Expert mode : No
    
    Interface Advanced
    hdr_size=92
    hdr_lba_self=1
    hdr_lba_alt=11720589311 (expected 11720589311)
    hdr_lba_start=34
    hdr_lba_end=11720589278
    hdr_lba_table=2
    hdr_entries=128
    hdr_entsz=128
     1 P MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
     2 P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    
    Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
    hdr_size=92
    hdr_lba_self=1
    hdr_lba_alt=11720589311 (expected 11720589311)
    hdr_lba_start=34
    hdr_lba_end=11720589278
    hdr_lba_table=2
    hdr_entries=128
    hdr_entsz=128
    Current partition structure:
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     1 P MS Data                     2048     206847     204800
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     2 P MS Data                   206848  126035967  125829120
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    Failed to startup volume: Input/output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    Backup partition structure
    partition_save
    
    search_part()
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
    NTFS at 0/32/33
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
    NTFS part_offset=1048576, part_size=104857600, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 0/32/33
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
    NTFS at 12/223/20
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
    NTFS part_offset=105906176, part_size=64424509440, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 12/223/20
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Search for partition aborted
    
    Results
       P MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    gpt_change_part_type
    Change partition type:
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Change partition type:
       P NTFS                      206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Can't open filesystem. Filesystem seems damaged.
    interface_load
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63 Tue Jul 22 11:29:32 2014
     1 P Unknown                     2048     206847     204800
     2 P Unknown                   206848  126035967  125829120
    
    interface_write()
     1 P MS Data                     2048     206847     204800
     2 P MS Data                   206848  126035967  125829120
    write!
    No extended partition
    You will have to reboot for the change to take effect.
    
    
    
    Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
    hdr_size=92
    hdr_lba_self=1
    hdr_lba_alt=11720589311 (expected 11720589311)
    hdr_lba_start=34
    hdr_lba_end=11720589278
    hdr_lba_table=2
    hdr_entries=128
    hdr_entsz=128
    Current partition structure:
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     1 P MS Data                     2048     206847     204800
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     2 P MS Data                   206848  126035967  125829120
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    Failed to startup volume: Input/output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    
    search_part()
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729572 255 63
    NTFS at 0/32/33
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
    NTFS part_offset=1048576, part_size=104857600, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 0/32/33
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
    NTFS at 12/223/20
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
    NTFS part_offset=105906176, part_size=64424509440, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 12/223/20
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Search for partition aborted
    
    Results
       P MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Can't open filesystem. Filesystem seems damaged.
    gpt_change_part_type
    Change partition type:
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Change partition type:
       P NTFS                      206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    
    interface_write()
     1 P MS Data                     2048     206847     204800
     2 P MS Data                   206848  126035967  125829120
    simulate write!
    New geometry
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63 sector_size=2048
    
    Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
    file_pread(7,4,buffer,3130703844(729575/254/60)) lseek err Invalid argument
    Bad GPT partition, invalid signature.
    Trying alternate GPT
    Current partition structure:
    Bad GPT partition, invalid signature.
    Trying alternate GPT
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    Failed to startup volume: Input/output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    
    search_part()
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 182394 255 63
    NTFS at 0/8/9
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                      512      51711      51200
         NTFS, blocksize=4096, 104 MB / 100 MiB
    NTFS at 3/55/53
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                    51712   31508991   31457280
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Search for partition aborted
    
    Results
       P MS Data                      512      51711      51200
         NTFS, blocksize=4096, 104 MB / 100 MiB
       P MS Data                    51712   31508991   31457280
         NTFS, blocksize=4096, 64 GB / 60 GiB
    
       P MS Data                    51712   31508991   31457280
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Can't open filesystem. Filesystem seems damaged.
    
    interface_write()
     1 P MS Data                      512      51711      51200
     2 P MS Data                    51712   31508991   31457280
    simulate write!
    New geometry
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63 sector_size=512
    
    Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
    hdr_size=92
    hdr_lba_self=1
    hdr_lba_alt=11720589311 (expected 11720638439)
    hdr_lba_start=34
    hdr_lba_end=11720589278
    hdr_lba_table=2
    hdr_entries=128
    hdr_entsz=128
    Current partition structure:
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     1 P MS Data                     2048     206847     204800
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     2 P MS Data                   206848  126035967  125829120
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    Failed to startup volume: Input/output error.
    $MFT has invalid magic.
    ntfs_mft_load(): Failed.
    Failed to load $MFT: Input/output error.
    
    search_part()
    Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
    NTFS at 0/32/33
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
    NTFS part_offset=1048576, part_size=104857600, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 0/32/33
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           51200
    sectors_per_cluster       2
    mft_lcn                   8533
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
    NTFS at 12/223/20
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
    NTFS part_offset=105906176, part_size=64424509440, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 12/223/20
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
    filesystem size           31457280
    sectors_per_cluster       2
    mft_lcn                   786432
    mftmirr_lcn               2
    clusters_per_mft_record   -11
    clusters_per_index_record 1
         MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Search for partition aborted
    
    Results
       P MS Data                     2048     206847     204800
         NTFS, blocksize=4096, 104 MB / 100 MiB
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    
       P MS Data                   206848  126035967  125829120
         NTFS, blocksize=4096, 64 GB / 60 GiB
    Can't open filesystem. Filesystem seems damaged.
    
    interface_write()
     1 P MS Data                     2048     206847     204800
     2 P MS Data                   206848  126035967  125829120
    simulate write!
    
    Analyse Disk /dev/sdd - 6000 GB / 5588 GiB - CHS 729576 255 63
    hdr_size=92
    hdr_lba_self=1
    hdr_lba_alt=11720589311 (expected 11720638439)
    hdr_lba_start=34
    hdr_lba_end=11720589278
    hdr_lba_table=2
    hdr_entries=128
    hdr_entsz=128
    Current partition structure:
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     1 P MS Data                     2048     206847     204800
    Warning: number of bytes per sector mismatches 2048 (NTFS) != 512 (HD)
     2 P MS Data                   206848  126035967  125829120