Hello,
I would like to have a much needed help if possible, I run test disk analysis and it showed a space conflict, at this point I am not exactly sure how to proceed to hopefully recuperate the family pictures.
windows indicates that the drive is not accessible, the parameter is incorrect.
Things I tried: changing the drive letter, try to boot from a linux live OS hoping to see the files, but unfortunately without success.
Thank you for reading.
Michel
Not sure how to proceed
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Re: Not sure how to proceed
Can you repeat your diagnose and selecting disk instead of a drive.
Disk looks like:
Fiona
Disk looks like:
TestDisk 7.1WIP 32bit is recommended.Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Drive C: - 981 GB / 913 GiB - CHS 119300 255 63, sector size=512
Drive E: - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive F: - 3000 GB / 2794 GiB - CHS 45598 255 63, sector size=4096
Fiona
Re: Not sure how to proceed
Yes of course,
Thank you.
Michel
Thank you.
Michel
Re: Not sure how to proceed
You already have a partition in your partition table.
If this partition would be correct, you can have a try to run a boot sector diagnose.
Can you run testdisk, Advanced and Boot and upload another snapshot?
Can you use the menu List and have a try to list your files?
Until yet, don't use Write nor RepairMFT!
It's intended to avoid any changes to your file system.
Fiona
If this partition would be correct, you can have a try to run a boot sector diagnose.
Can you run testdisk, Advanced and Boot and upload another snapshot?
Can you use the menu List and have a try to list your files?
Until yet, don't use Write nor RepairMFT!
It's intended to avoid any changes to your file system.
Fiona
Re: Not sure how to proceed
Thank you Fiona,
here are the screenshots:
Boot:
List:
Regards,
Michel
here are the screenshots:
Boot:
List:
Regards,
Michel
Re: Not sure how to proceed
Can you try to run on your current partition a RebuildBS and if the boot sector is different, you can have another try to list your files, using the menu List.
If it wouldn't help:
Can you run TestDisk Deeper Search?
The intention is, to find another partition by the backup of the boot sector.
Fiona
If it wouldn't help:
Can you run TestDisk Deeper Search?
The intention is, to find another partition by the backup of the boot sector.
Fiona
Re: Not sure how to proceed
Thank you Fiona,
RebuildBS:
Boot sectors identical could not list:
Deep scan result:
I could not see the back up of the boot sector.
Regards,
Michel
RebuildBS:
Boot sectors identical could not list:
Deep scan result:
I could not see the back up of the boot sector.
Regards,
Michel
Re: Not sure how to proceed
Your current message displays only not recoverable partitions which end after disk limit.
Fat12 and FAT16 partitions are probably wrong.
At this display, when you press enter, you'll get to the results.
Did testdisk find another partition?
If not, you'll probably need datarecovery software which reads underlying data.
Can you copy and paste the content of your testdisk.log into your next post?
PhotoRec could help.
Info will follow.
Fiona
Fat12 and FAT16 partitions are probably wrong.
At this display, when you press enter, you'll get to the results.
Did testdisk find another partition?
If not, you'll probably need datarecovery software which reads underlying data.
Can you copy and paste the content of your testdisk.log into your next post?
PhotoRec could help.
Info will follow.
Fiona
Re: Not sure how to proceed
Thank you Fiona,
After continue on Fat12:
seems like a boot partition found.
Log:
Tue Aug 4 12:20:43 2015
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, Cygwin 2000.4
Compilation date: 2015-07-30T21:13:54
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=64421363712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=55055966208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=2000396321280
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 840 Series, S/N:*************, FW:DXT09B0Q
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-9YN164, S/N:**********
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20 EARS-00MVWB0, S/N:************
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Intel
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=16 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 1 1 243201 0 63 3907024065
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/1/1
filesystem size 3907024065
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189004
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 243201 0 63 3907024065
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029183(243201/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,3907029311(243201/83/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029439(243201/85/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029567(243201/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029695(243201/89/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029823(243201/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029951(243201/93/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030079(243201/95/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030207(243201/97/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030335(243201/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030463(243201/101/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030591(243201/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030719(243201/105/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030847(243201/107/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030975(243201/109/44)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(5,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(5,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(5,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.
Results
* HPFS - NTFS 0 1 1 243201 254 63 3907040067
NTFS, blocksize=4096, 2000 GB / 1863 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 243201 254 63 3907040067
***end of log***
Regards,
Michel
After continue on Fat12:
seems like a boot partition found.
Log:
Tue Aug 4 12:20:43 2015
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, Cygwin 2000.4
Compilation date: 2015-07-30T21:13:54
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=64421363712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=55055966208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=2000396321280
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 840 Series, S/N:*************, FW:DXT09B0Q
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-9YN164, S/N:**********
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20 EARS-00MVWB0, S/N:************
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM 001-9YN164
Partition table type: Intel
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=16 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 1 1 243201 0 63 3907024065
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/1/1
filesystem size 3907024065
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189004
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 243201 0 63 3907024065
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029183(243201/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,3907029311(243201/83/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029439(243201/85/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029567(243201/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029695(243201/89/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029823(243201/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029951(243201/93/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030079(243201/95/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030207(243201/97/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030335(243201/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030463(243201/101/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030591(243201/103/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030719(243201/105/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030847(243201/107/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030975(243201/109/44)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(5,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(5,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(5,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.
Results
* HPFS - NTFS 0 1 1 243201 254 63 3907040067
NTFS, blocksize=4096, 2000 GB / 1863 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 243201 254 63 3907040067
***end of log***
Regards,
Michel