Partition table mismatch External drive 1TB-WD10
Posted: 18 Dec 2014, 12:00
Thu Dec 18 09:05:23 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-11-13T18:59:50
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=38724585984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=51457319424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=409915054080
filewin32_getfilesize(\\.\M:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\M:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=1000200994816
filewin32_getfilesize(\\.\Q:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\Q:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\Q:
filewin32_getfilesize(\\.\T:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\T:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\T:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - SATA WDC WD50
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SATA WDC WD10
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - SATA WDC WD10
Partition table type: Intel
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 121600 247 55 1953517568
No partition is bootable
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094847
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094847
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 39 41 121600 254 63 1953517568
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122094847
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,1024,buffer,1959814592(121992/208/9)) lseek err Invalid argument
file_pread(5,1,buffer,1959814592(121992/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 243201 215 22 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953520064, size=1953517568, end=3907037631, disk end=1953525168)
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525185(121601/81/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525313(121601/83/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525441(121601/85/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525569(121601/87/24)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,1953525697(121601/89/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1863 GiB)
The following partition can't be recovered:
HPFS - NTFS 121600 254 63 243201 215 22 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
HPFS - NTFS 0 32 33 121600 247 55 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 0 39 41 121600 254 63 1953517568
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
------------------------
This partitiontable shows data but not the other one
HPFS - NTFS 0 32 33 121600 247 55 1953517568
what should be done? changing geometry pls explain the procedure. is there a manual for that?
I changed the first one to P and tried to write and reboot, did not work. i simply dont understand what must be done.
btw: desaster began when i forgot to switch docking-station form usb to esata(orico 6515 series) after cloning a different drive which has overlapping problem on first and second partition.
so i had external drive on usb3.0(pc has usb 2.0 only). when i saw no data later i panicked attached it accidentally as first drive(both sata-cables have same color....) could have used the third slower channel.. so autochk(run almost 2hrs) messed up partition table.
pls fiona delete or dont start my german thread. i will stay here.