Re: Help needed with recovering data from RAW Partition
Posted: 04 Oct 2015, 14:10
Hi,
Sorry about the incomplete info before. I have done as you stated and the log is as below:
Sun Oct 4 21:05:17 2015
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, Cygwin 2002.0
Compilation date: 2015-10-02T11:09:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=121402917888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=295201358336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=311795656704
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - WDC WD75 00BPKT-75PK4, S/N:W -DXW187EW1HL23, FW:01.0
Partition table type (auto): Intel
Disk /dev/sda - 750 GB / 698 GiB - WDC WD75 00BPKT-75PK4
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 5/25/21
NTFS at 2644/189/42
NTFS at 17404/121/63
NTFS at 53294/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
1 P Dell Utility 0 1 1 4 254 63 80262
2 * HPFS - NTFS 5 25 21 2644 189 41 42405888
NTFS, blocksize=4096, 21 GB / 20 GiB
3 P HPFS - NTFS 2644 189 42 17404 120 62 237115074
NTFS, blocksize=4096, 121 GB / 113 GiB
4 E extended LBA 17404 120 63 91200 254 63 1185541183
5 L HPFS - NTFS 17404 121 63 53293 254 51 576565153
NTFS, blocksize=8192, 295 GB / 274 GiB
X extended 53294 0 1 91200 254 63 608975955
6 L HPFS - NTFS 53294 1 1 91200 254 63 608975892
NTFS, blocksize=8192, 311 GB / 290 GiB
ntfs_boot_sector
5 L HPFS - NTFS 17404 121 63 53293 254 51 576565153
NTFS, blocksize=8192, 295 GB / 274 GiB
NTFS at 17404/121/63
filesystem size 576565153 1
sectors_per_cluster 16 0
mft_lcn 15010230 0
mftmirr_lcn 3238 0
clusters_per_mft_record -10 0
clusters_per_index_record -12 0
Boot sector
Status: OK
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Sorry about the incomplete info before. I have done as you stated and the log is as below:
Sun Oct 4 21:05:17 2015
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, Cygwin 2002.0
Compilation date: 2015-10-02T11:09:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=121402917888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=295201358336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=311795656704
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - WDC WD75 00BPKT-75PK4, S/N:W -DXW187EW1HL23, FW:01.0
Partition table type (auto): Intel
Disk /dev/sda - 750 GB / 698 GiB - WDC WD75 00BPKT-75PK4
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type DE: no test
NTFS at 5/25/21
NTFS at 2644/189/42
NTFS at 17404/121/63
NTFS at 53294/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
1 P Dell Utility 0 1 1 4 254 63 80262
2 * HPFS - NTFS 5 25 21 2644 189 41 42405888
NTFS, blocksize=4096, 21 GB / 20 GiB
3 P HPFS - NTFS 2644 189 42 17404 120 62 237115074
NTFS, blocksize=4096, 121 GB / 113 GiB
4 E extended LBA 17404 120 63 91200 254 63 1185541183
5 L HPFS - NTFS 17404 121 63 53293 254 51 576565153
NTFS, blocksize=8192, 295 GB / 274 GiB
X extended 53294 0 1 91200 254 63 608975955
6 L HPFS - NTFS 53294 1 1 91200 254 63 608975892
NTFS, blocksize=8192, 311 GB / 290 GiB
ntfs_boot_sector
5 L HPFS - NTFS 17404 121 63 53293 254 51 576565153
NTFS, blocksize=8192, 295 GB / 274 GiB
NTFS at 17404/121/63
filesystem size 576565153 1
sectors_per_cluster 16 0
mft_lcn 15010230 0
mftmirr_lcn 3238 0
clusters_per_mft_record -10 0
clusters_per_index_record -12 0
Boot sector
Status: OK
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.