Help Recovering NTFS Partitions

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Sickify
Posts: 3
Joined: 30 Jan 2015, 04:19

Help Recovering NTFS Partitions

#1 Post by Sickify »

I was trying to use testdisk to recover a lost ext4 partition. Originally I had a ~327MB NTFS boot partition ~260GB NTFS partition and a ~1.8TB ext4 partition, and 700GB Free Space
I ran testdisk overnight and in my groggy state the next morning wrote the changes. Which left me with no ext4 partition and two goofy NTFS partitions that took up the majority of the drive.
I have since managed to save my ext4 partition, although it shows as 2.0TB now, and i'm pretty sure it was around 1.8TB before.
Unfortunately my drive now looks like this;
8.4MB Free Space
2.9GB NTFS Boot
263GB NTFS
2.0TB ext4
700GB Free Space

Here is my log

Code: Select all



Tue Jan 27 20:11:49 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-34-generic (#60-Ubuntu SMP Wed Aug 13 15:45:27 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       7813971633 sectors
/dev/sda: user_max   7813971633 sectors
/dev/sda: dco        7814037168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       3907029168 sectors
/dev/sde: user_max   3907029168 sectors
/dev/sde: native_max 3907029168 sectors
/dev/sde: dco        3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0980572, FW:80.00A80
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - INTEL SSDSC2CT060A3, S/N:CVMP233500LD060AGN, FW:300i
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F2ND11, FW:CC26
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F498YT, FW:CC29
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WCAZA4653281, FW:51.0AB51

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - ST3000DM001-1CH166
Partition table type: EFI GPT

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.


Tue Jan 27 20:16:34 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-34-generic (#60-Ubuntu SMP Wed Aug 13 15:45:27 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       7813971633 sectors
/dev/sda: user_max   7813971633 sectors
/dev/sda: dco        7814037168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       3907029168 sectors
/dev/sde: user_max   3907029168 sectors
/dev/sde: native_max 3907029168 sectors
/dev/sde: dco        3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0980572, FW:80.00A80
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - INTEL SSDSC2CT060A3, S/N:CVMP233500LD060AGN, FW:300i
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F2ND11, FW:CC26
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F498YT, FW:CC29
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WCAZA4653281, FW:51.0AB51

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - ST3000DM001-1CH166
Partition table type: Intel
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400
check_part_i386 failed for partition type 83
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
 2 P Linux                  357 247 19 258910   8 42 4153638912

 2 P Linux                  357 247 19 258910   8 42 4153638912
Support for this filesystem hasn't been enable during compilation.
search_superblock
Change partition type:
 2 P Linux                  357 247 19 258910   8 42 4153638912

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400
check_part_i386 failed for partition type 83
Current partition structure:
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
No ext2, JFS, Reiser, cramfs or XFS marker
 2 P Linux                  357 247 19 258910   8 42 4153638912
 2 P Linux                  357 247 19 258910   8 42 4153638912
Backup partition structure
partition_save

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size           5734393
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              1   5  5   357 247 11    5734393 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2799 MiB
NTFS at 357/247/19
filesystem size           4153638905
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            357 247 19 258910   8 35 4153638905
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

Results
   * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
   P HPFS - NTFS            357 247 19 258910   8 42 4153638912
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

interface_write()
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
 2 P HPFS - NTFS            357 247 19 258910   8 42 4153638912

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size           5734393
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              1   5  5   357 247 11    5734393 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2799 MiB
NTFS at 357/247/19
filesystem size           4153638905
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            357 247 19 258910   8 35 4153638905
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

recover_EXT2: s_block_group_nr=0/15157, s_mnt_count=5/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock, 2034 GB / 1894 GiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 343

recover_EXT2: "e2fsck -b 11239424 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=343/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 729

recover_EXT2: "e2fsck -b 23887872 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=729/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 2187

recover_EXT2: "e2fsck -b 71663616 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2187/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB
BAD_RS LBA=3401446167 255110
check_part_i386 failed for partition type 01
     FAT12                211730  59  1 346188  40 50 2160066623

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 3125

recover_EXT2: "e2fsck -b 102400000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3125/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 6561

recover_EXT2: "e2fsck -b 214990848 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=6561/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB
BAD_RS LBA=6266520808 6676946
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
     FAT16 <32M           390072 224 17 605625 227 33 3462859151
This partition ends after the disk limits. (start=6266520808, size=3462859151, end=9729379958, disk end=5860533168)
BAD_RS LBA=4582543824 14277268
check_part_i386 failed for partition type 06
     FAT16 >32M           285250  40 55 320278  15  5  562723196
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4981 GB / 4639 GiB)
The following partition can't be recovered:
     FAT16 <32M           390072 224 17 605625 227 33 3462859151
get_geometry_from_list_part_aux head=8 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 8.

Results
   * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
     HPFS - NTFS            357 247 19 258910   8 42 4153638912
     NTFS, blocksize=4096, 2126 GB / 1980 GiB
     Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock, 2034 GB / 1894 GiB
     FAT12                211730  59  1 346188  40 63 2160066636
     FAT16 >32M           285250  40 55 320278  15  5  562723196


dir_partition inode=2
     Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock, 2034 GB / 1894 GiB
Directory /
       2 drwxrwxrwx  1000   1000      4096 24-Oct-2014 19:50 .
       2 drwxrwxrwx  1000   1000      4096 24-Oct-2014 19:50 ..
      11 drwxrwxrwx     0      0     16384 12-Apr-2014 14:09 lost+found
 73924609 drwxr-xr-x  1000   1000      4096 27-Jan-2015 05:02 Staging
 108789761 drwxr-xr-x  1000   1000      4096 20-Dec-2014 21:20 Videos
 74055681 drwxr-xr-x  1000   1000      4096 21-Apr-2014 22:03 Torrents
 76677121 drwx------  1000   1000      4096 18-Sep-2014 20:47 .Trash-1000
X     12 -rw-r--r--     0      0         0 24-Oct-2014 19:50 photorec.ses

interface_write()
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
 2 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
 3 P FAT16 >32M           285250  40 55 320278  15  5  562723196
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.


Wed Jan 28 17:31:20 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-34-generic (#60-Ubuntu SMP Wed Aug 13 15:45:27 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       7813971633 sectors
/dev/sda: user_max   7813971633 sectors
/dev/sda: dco        7814037168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdb: dco        7814037168 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       3907029168 sectors
/dev/sde: user_max   3907029168 sectors
/dev/sde: native_max 3907029168 sectors
/dev/sde: dco        3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0980572, FW:80.00A80
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - INTEL SSDSC2CT060A3, S/N:CVMP233500LD060AGN, FW:300i
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F2ND11, FW:CC26
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F498YT, FW:CC29
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WCAZA4653281, FW:51.0AB51

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - ST3000DM001-1CH166
Partition table type: Intel

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400


test_FAT()
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
Current partition structure:
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
 2 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
Invalid FAT boot sector
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196
Space conflict between the following two partitions
 2 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196


Wed Jan 28 19:51:08 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-34-generic (#60-Ubuntu SMP Wed Aug 13 15:45:27 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       7813971633 sectors
/dev/sda: user_max   7813971633 sectors
/dev/sda: dco        7814037168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       3907029168 sectors
/dev/sde: user_max   3907029168 sectors
/dev/sde: native_max 3907029168 sectors
/dev/sde: dco        3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0980572, FW:80.00A80
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - INTEL SSDSC2CT060A3, S/N:CVMP233500LD060AGN, FW:300i
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F2ND11, FW:CC26
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F498YT, FW:CC29
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WCAZA4653281, FW:51.0AB51

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - ST3000DM001-1CH166
Partition table type: Intel

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400


test_FAT()
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196
sector_size  0
cluster_size 0
reserved     0
fats         0
dir_entries  0
sectors      0
media        00
fat_length   0
secs_track   0
heads        0
hidden       0
total_sect   0
check_part_i386 failed for partition type 06
Current partition structure:
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
 2 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
Invalid FAT boot sector
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196
Space conflict between the following two partitions
 2 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
 3 P FAT16 >32M           267349  89  4 302377  63 17  562723196

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size           5734393
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              1   5  5   357 247 11    5734393 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2799 MiB
NTFS at 357/247/19
filesystem size           4153638905
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            357 247 19 258910   8 35 4153638905
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

Results
   * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
   P HPFS - NTFS            357 247 19 258910   8 42 4153638912
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

interface_write()
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
 2 P HPFS - NTFS            357 247 19 258910   8 42 4153638912

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size           5734393
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              1   5  5   357 247 11    5734393 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2799 MiB
NTFS at 357/247/19
filesystem size           4153638905
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            357 247 19 258910   8 35 4153638905
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

recover_EXT2: s_block_group_nr=0/15157, s_mnt_count=6/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 2034 GB / 1894 GiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 49

recover_EXT2: "e2fsck -b 1605632 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=49/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 125

recover_EXT2: "e2fsck -b 4096000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=125/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 243

recover_EXT2: "e2fsck -b 7962624 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=243/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 343

recover_EXT2: "e2fsck -b 11239424 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=343/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 729

recover_EXT2: "e2fsck -b 23887872 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=729/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 2187

recover_EXT2: "e2fsck -b 71663616 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2187/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB
BAD_RS LBA=3401446167 255110
check_part_i386 failed for partition type 01
     FAT12                211730  59  1 346188  40 50 2160066623

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 3125

recover_EXT2: "e2fsck -b 102400000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3125/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB

block_group_nr 6561

recover_EXT2: "e2fsck -b 214990848 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=6561/15157, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 496677734
recover_EXT2: part_size 3973421872
     Linux                32363 192 22 279697 210 49 3973421872 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Backup superblock, 2034 GB / 1894 GiB
BAD_RS LBA=6266520808 6676946
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
     FAT16 <32M           390072 224 17 605625 227 33 3462859151
This partition ends after the disk limits. (start=6266520808, size=3462859151, end=9729379958, disk end=5860533168)
BAD_RS LBA=4582543824 14277268
check_part_i386 failed for partition type 06
     FAT16 >32M           285250  40 55 320278  15  5  562723196
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4981 GB / 4639 GiB)
The following partition can't be recovered:
     FAT16 <32M           390072 224 17 605625 227 33 3462859151
get_geometry_from_list_part_aux head=8 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 8.

Results
   * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
     HPFS - NTFS            357 247 19 258910   8 42 4153638912
     NTFS, blocksize=4096, 2126 GB / 1980 GiB
     Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 2034 GB / 1894 GiB
     FAT12                211730  59  1 346188  40 63 2160066636
     FAT16 >32M           285250  40 55 320278  15  5  562723196


dir_partition inode=2
     Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 2034 GB / 1894 GiB
Directory /
       2 drwxrwxrwx  1000   1000      4096 24-Oct-2014 19:50 .
       2 drwxrwxrwx  1000   1000      4096 24-Oct-2014 19:50 ..
      11 drwxrwxrwx     0      0     16384 12-Apr-2014 14:09 lost+found
 73924609 drwxr-xr-x  1000   1000      4096 27-Jan-2015 05:02 Staging
 108789761 drwxr-xr-x  1000   1000      4096 20-Dec-2014 21:20 Videos
 74055681 drwxr-xr-x  1000   1000      4096 21-Apr-2014 22:03 Torrents
 76677121 drwx------  1000   1000      4096 18-Sep-2014 20:47 .Trash-1000
X     12 -rw-r--r--     0      0         0 24-Oct-2014 19:50 photorec.ses
Change partition type:
     HPFS - NTFS            357 230 22 32363 254 63  514177944
Change partition type:
     HPFS - NTFS            357 230 22 32363 254 63  514177944
Change partition type:
     HPFS - NTFS            357 247 19 364800 254  8 5854777226

interface_write()
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
 2 P HPFS - NTFS            357 247 19 32363   8 42  514161357
 3 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.


Thu Jan 29 17:39:14 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-34-generic (#60-Ubuntu SMP Wed Aug 13 15:45:27 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       7813971633 sectors
/dev/sda: user_max   7813971633 sectors
/dev/sda: dco        7814037168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       3907029168 sectors
/dev/sde: user_max   3907029168 sectors
/dev/sde: native_max 3907029168 sectors
/dev/sde: dco        3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0980572, FW:80.00A80
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - INTEL SSDSC2CT060A3, S/N:CVMP233500LD060AGN, FW:300i
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F2ND11, FW:CC26
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F498YT, FW:CC29
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WCAZA4653281, FW:51.0AB51

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - ST3000DM001-1CH166
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400
NTFS at 357/247/19
Error: size boot_sector 4153638905 > partition 514161357
check_part_i386 failed for partition type 07
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
 2 P HPFS - NTFS            357 247 19 32363   8 42  514161357
 3 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
     ext4 blocksize=4096 Large file Sparse superblock Recover, 2034 GB / 1894 GiB

ntfs_boot_sector
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400
filesystem size           5734393 1
sectors_per_cluster       8 0
mft_lcn                   29866 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.

Directory /
       5 dr-xr-xr-x     0      0         0 17-Jun-2013 02:27 .
       5 dr-xr-xr-x     0      0         0 17-Jun-2013 02:27 ..
      35 dr-xr-xr-x     0      0         0 17-Jun-2013 03:21 Boot
     162 dr-xr-xr-x     0      0         0 17-Jun-2013 02:27 Recovery
     160 dr-xr-xr-x     0      0         0 17-Jun-2013 02:25 System Volume Information
     155 -r--r--r--     0      0         1  2-Jun-2012 08:30 BOOTNXT
     159 -r--r--r--     0      0      8192 17-Jun-2013 03:21 BOOTSECT.BAK
     133 -r--r--r--     0      0    398156 25-Jul-2012 21:44 bootmgr

ntfs_boot_sector
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400
filesystem size           5734393 1
sectors_per_cluster       8 0
mft_lcn                   29866 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Boot sector                        Backup boot sector
0000 eb52904e 54465320   .R.NTFS   00000000 00000000   ........
0008 20202000 02080000      .....  00000000 00000000   ........
0010 00000000 00f80000   ........  00000000 00000000   ........
0018 3f00ff00 00080000   ?.......  00000000 00000000   ........
0020 00000000 80008000   ........  00000000 00000000   ........
0028 f87f5700 00000000   ..W.....  00000000 00000000   ........
0030 aa740000 00000000   .t......  00000000 00000000   ........
0038 02000000 00000000   ........  00000000 00000000   ........
0040 f6000000 01000000   ........  00000000 00000000   ........
0048 be7e45b0 b945b0b8   .~E..E..  00000000 00000000   ........
0050 00000000 fa33c08e   .....3..  00000000 00000000   ........
0058 d0bc007c fb68c007   ...|.h..  00000000 00000000   ........
0060 1f1e6866 00cb8816   ..hf....  00000000 00000000   ........
0068 0e006681 3e03004e   ..f.>..N  00000000 00000000   ........
0070 54465375 15b441bb   TFSu..A.  00000000 00000000   ........
0078 aa55cd13 720c81fb   .U..r...  00000000 00000000   ........
0080 55aa7506 f7c10100   U.u.....  00000000 00000000   ........
0088 7503e9dd 001e83ec   u.......  00000000 00000000   ........
0090 18681a00 b4488a16   .h...H..  00000000 00000000   ........
0098 0e008bf4 161fcd13   ........  00000000 00000000   ........
00A0 9f83c418 9e581f72   .....X.r  00000000 00000000   ........
00A8 e13b060b 0075dba3   .;...u..  00000000 00000000   ........
00B0 0f00c12e 0f00041e   ........  00000000 00000000   ........
00B8 5a33dbb9 00202bc8   Z3... +.  00000000 00000000   ........
00C0 66ff0611 0003160f   f.......  00000000 00000000   ........
00C8 008ec2ff 061600e8   ........  00000000 00000000   ........
00D0 4b002bc8 77efb800   K.+.w...  00000000 00000000   ........
00D8 bbcd1a66 23c0752d   ...f#.u-  00000000 00000000   ........
00E0 6681fb54 43504175   f..TCPAu  00000000 00000000   ........
00E8 2481f902 01721e16   $....r..  00000000 00000000   ........
00F0 6807bb16 68521116   h...hR..  00000000 00000000   ........
00F8 68090066 53665366   h..fSfSf  00000000 00000000   ........
0100 55161616 68b80166   U...h..f  00000000 00000000   ........
0108 610e07cd 1a33c0bf   a....3..  00000000 00000000   ........
0110 0a13b9f6 0cfcf3aa   ........  00000000 00000000   ........
0118 e9fe0190 9066601e   .....f`.  00000000 00000000   ........
0120 0666a111 00660306   .f...f..  00000000 00000000   ........
0128 1c001e66 68000000   ...fh...  00000000 00000000   ........
0130 00665006 53680100   .fP.Sh..  00000000 00000000   ........
0138 681000b4 428a160e   h...B...  00000000 00000000   ........
0140 00161f8b f4cd1366   .......f  00000000 00000000   ........
0148 595b5a66 5966591f   Y[ZfYfY.  00000000 00000000   ........
0150 0f821600 66ff0611   ....f...  00000000 00000000   ........
0158 0003160f 008ec2ff   ........  00000000 00000000   ........
0160 0e160075 bc071f66   ...u...f  00000000 00000000   ........
0168 61c3a1f6 01e80900   a.......  00000000 00000000   ........
0170 a1fa01e8 0300f4eb   ........  00000000 00000000   ........
0178 fd8bf0ac 3c007409   ....<.t.  00000000 00000000   ........
0180 b40ebb07 00cd10eb   ........  00000000 00000000   ........
0188 f2c30d0a 41206469   ....A di  00000000 00000000   ........
0190 736b2072 65616420   sk read   00000000 00000000   ........
0198 6572726f 72206f63   error oc  00000000 00000000   ........
01A0 63757272 6564000d   curred..  00000000 00000000   ........
01A8 0a424f4f 544d4752   .BOOTMGR  00000000 00000000   ........
01B0 20697320 636f6d70    is comp  00000000 00000000   ........
01B8 72657373 6564000d   ressed..  00000000 00000000   ........
01C0 0a507265 73732043   .Press C  00000000 00000000   ........
01C8 74726c2b 416c742b   trl+Alt+  00000000 00000000   ........
01D0 44656c20 746f2072   Del to r  00000000 00000000   ........
01D8 65737461 72740d0a   estart..  00000000 00000000   ........
01E0 00000000 00000000   ........  00000000 00000000   ........
01E8 00000000 00000000   ........  00000000 00000000   ........
01F0 00000000 00008a01   ........  00000000 00000000   ........
01F8 a701bf01 000055aa   ......U.  00000000 00000000   ........

ntfs_boot_sector
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
NTFS at 1/5/5
Info: size boot_sector 5734393, partition 5734400
filesystem size           5734393 1
sectors_per_cluster       8 0
mft_lcn                   29866 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn             29866
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn             29866
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: mft_record_size     1024
ntfs_find_mft: index_block_size    4096
             New / Current boot sector
filesystem size           5734400 5734393
sectors_per_cluster       8 8
mft_lcn                   29866 29866
mftmirr_lcn               2 2
clusters_per_mft_record   -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size           5734400 5734393
sectors_per_cluster       8 8
mft_lcn                   29866 29866
mftmirr_lcn               2 2
clusters_per_mft_record   -10 -10
clusters_per_index_record 1 1
Write new boot!

ntfs_boot_sector
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
NTFS at 1/5/5
NTFS at 1/5/5
filesystem size           5734400
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.


Thu Jan 29 17:44:01 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-34-generic (#60-Ubuntu SMP Wed Aug 13 15:45:27 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       7813971633 sectors
/dev/sda: user_max   7813971633 sectors
/dev/sda: dco        7814037168 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       117231408 sectors
/dev/sdb: user_max   117231408 sectors
/dev/sdb: native_max 117231408 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size       5860533168 sectors
/dev/sdc: user_max   5860533168 sectors
/dev/sdc: native_max 5860533168 sectors
/dev/sdc: dco        5860533168 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       5860533168 sectors
/dev/sdd: user_max   5860533168 sectors
/dev/sdd: native_max 5860533168 sectors
/dev/sdd: dco        5860533168 sectors
/dev/sde: LBA, HPA, LBA48, DCO support
/dev/sde: size       3907029168 sectors
/dev/sde: user_max   3907029168 sectors
/dev/sde: native_max 3907029168 sectors
/dev/sde: dco        3907029168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:WD-WCC4E0980572, FW:80.00A80
Disk /dev/sdb - 60 GB / 55 GiB - CHS 7297 255 63, sector size=512 - INTEL SSDSC2CT060A3, S/N:CVMP233500LD060AGN, FW:300i
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F2ND11, FW:CC26
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH166, S/N:Z1F498YT, FW:CC29
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WCAZA4653281, FW:51.0AB51

Partition table type (auto): Intel
Disk /dev/sdd - 3000 GB / 2794 GiB - ST3000DM001-1CH166
Partition table type: Intel

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 1/5/5
NTFS at 357/247/19
Error: size boot_sector 4153638905 > partition 514161357
check_part_i386 failed for partition type 07
Current partition structure:
 1 * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
Error: size boot_sector 4153638905 > partition 514161357
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS            357 247 19 32363   8 42  514161357
 2 P HPFS - NTFS            357 247 19 32363   8 42  514161357
 3 P Linux                32363 192 22 279697 230 21 3973423104 [New Volume]

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
filesystem size           5734400
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
NTFS at 357/247/19
filesystem size           4153638905
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS            357 247 19 258910   8 35 4153638905
     NTFS, blocksize=4096, 2126 GB / 1980 GiB

Results
   * HPFS - NTFS              1   5  5   357 247 18    5734400 [System Reserved]
     NTFS, blocksize=4096, 2936 MB / 2800 MiB
   P HPFS - NTFS            357 247 19 258910   8 42 4153638912
     NTFS, blocksize=4096, 2126 GB / 1980 GiB
SIGHUP detected! TestDisk has been killed.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Help Recovering NTFS Partitions

#2 Post by cgrenier »

Concerning your ext4 partition size, are you sure you aren't confusing GB and GiB ?

Code: Select all

Linux                32363 192 22 279697 230 21 3973423104 [New Volume]
         ext4 blocksize=4096 Large file Sparse superblock, 2034 GB / 1894 GiB

Sickify
Posts: 3
Joined: 30 Jan 2015, 04:19

Re: Help Recovering NTFS Partitions

#3 Post by Sickify »

Linux Mint's disk manager reports the partition currently being 2.0TB (definitely no i), and the file manager lists it in terabytes as well. However, that could very well be wrong.
Another oddity is the disk manager reports ~200GB free space, where the file manager reports ~100GB free space, which
would be more in line with the original partition size.


Here is the output of fdisk as well

Code: Select all

Disk /dev/sde: 3000.6 GB, 3000592982016 bytes
255 heads, 63 sectors/track, 364801 cylinders, total 5860533168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x000850b6

   Device Boot      Start         End      Blocks   Id  System
/dev/sde1   *       16384     5750783     2867200    7  HPFS/NTFS/exFAT
/dev/sde2         5750784   519912140   257080678+   7  HPFS/NTFS/exFAT
/dev/sde3       519923712  4493346815  1986711552   83  Linux

**EDIT This disk is now sde instead of sdd as I have added another harddrive.

Sickify
Posts: 3
Joined: 30 Jan 2015, 04:19

Re: Help Recovering NTFS Partitions

#4 Post by Sickify »

Sorry, I don't mean to bump, but any chance I could get some further guidance on this?


Thank you.

Locked