Sat Nov 14 12:25:40 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <
grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2199023255552
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=801567145984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=127928369152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199021158400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=801566097408
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=314567576064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=685626407424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=2000396288512
Hard disk list
Disk \\.\PhysicalDrive0 - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 2199 GB / 2048 GiB - CHS 267349 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 127 GB / 119 GiB - CHS 15553 255 63, sector size=512
Drive E: - 2199 GB / 2047 GiB - CHS 267349 255 63, sector size=512
Drive F: - 801 GB / 746 GiB - CHS 97451 255 63, sector size=512
Drive G: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive H: - 314 GB / 292 GiB - CHS 38243 255 63, sector size=512
Drive I: - 685 GB / 638 GiB - CHS 83355 255 63, sector size=512
Drive J: - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512
Partition table type (auto): Intel
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 2 243200 254 63 3907024001
1 * HPFS - NTFS 0 1 2 243200 254 63 3907024001
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63
file_win32_pread(108,16,buffer,95(0/1/33)) read err: read after end of file
file_win32_pread(108,1,buffer,95(0/1/33)) read err: read after end of file
file_win32_pread(108,16,buffer,65(0/1/3)) read err: read after end of file
file_win32_pread(108,1,buffer,65(0/1/3)) read err: read after end of file
file_win32_pread(108,8,buffer,71(0/1/9)) read err: read after end of file
file_win32_pread(108,16,buffer,64(0/1/2)) read err: read after end of file
file_win32_pread(108,1,buffer,64(0/1/2)) read err: read after end of file
file_win32_pread(108,16,buffer,6160447(383/119/56)) read err: read after end of file
file_win32_pread(108,1,buffer,6160447(383/119/56)) read err: read after end of file
file_win32_pread(108,8,buffer,6160463(383/120/9)) read err: read after end of file
file_win32_pread(108,16,buffer,6291519(391/160/25)) read err: read after end of file
file_win32_pread(108,1,buffer,6291520(391/160/26)) read err: read after end of file
file_win32_pread(108,16,buffer,6291582(391/161/25)) read err: read after end of file
file_win32_pread(108,1,buffer,6291582(391/161/25)) read err: read after end of file
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189000
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Results
L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
file_win32_pread(108,16,buffer,6291520(391/160/26)) read err: read after end of file
file_win32_pread(108,1,buffer,6291520(391/160/26)) read err: read after end of file
file_win32_pread(108,1,buffer,6291521(391/160/27)) read err: read after end of file
Not an exFAT boot sector.
L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 0 1 1 243200 254 63 3907024002
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
Error reading $MFT: Input/output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63
file_win32_pread(108,16,buffer,95(0/1/33)) read err: read after end of file
file_win32_pread(108,1,buffer,95(0/1/33)) read err: read after end of file
file_win32_pread(108,16,buffer,64(0/1/2)) read err: read after end of file
file_win32_pread(108,1,buffer,64(0/1/2)) read err: read after end of file
file_win32_pread(108,8,buffer,71(0/1/9)) read err: read after end of file
file_win32_pread(108,16,buffer,65(0/1/3)) read err: read after end of file
file_win32_pread(108,1,buffer,65(0/1/3)) read err: read after end of file
file_win32_pread(108,16,buffer,69(0/1/7)) read err: read after end of file
file_win32_pread(108,1,buffer,69(0/1/7)) read err: read after end of file
file_win32_pread(108,16,buffer,6160447(383/119/56)) read err: read after end of file
file_win32_pread(108,1,buffer,6160447(383/119/56)) read err: read after end of file
file_win32_pread(108,8,buffer,6160463(383/120/9)) read err: read after end of file
file_win32_pread(108,16,buffer,6291519(391/160/25)) read err: read after end of file
file_win32_pread(108,1,buffer,6291520(391/160/26)) read err: read after end of file
file_win32_pread(108,16,buffer,6291582(391/161/25)) read err: read after end of file
file_win32_pread(108,1,buffer,6291582(391/161/25)) read err: read after end of file
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244189000
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
file_win32_pread(108,16,buffer,49(0/0/50)) read err: read after end of file
file_win32_pread(108,16,buffer,50(0/0/51)) read err: read after end of file
file_win32_pread(108,16,buffer,51(0/0/52)) read err: read after end of file
file_win32_pread(108,16,buffer,52(0/0/53)) read err: read after end of file
file_win32_pread(108,16,buffer,53(0/0/54)) read err: read after end of file
file_win32_pread(108,16,buffer,54(0/0/55)) read err: read after end of file
file_win32_pread(108,16,buffer,55(0/0/56)) read err: read after end of file
file_win32_pread(108,16,buffer,56(0/0/57)) read err: read after end of file
file_win32_pread(108,16,buffer,57(0/0/58)) read err: read after end of file
file_win32_pread(108,16,buffer,58(0/0/59)) read err: read after end of file
file_win32_pread(108,16,buffer,59(0/0/60)) read err: read after end of file
file_win32_pread(108,16,buffer,60(0/0/61)) read err: read after end of file
file_win32_pread(108,16,buffer,61(0/0/62)) read err: read after end of file
file_win32_pread(108,16,buffer,62(0/0/63)) read err: read after end of file
file_win32_pread(108,16,buffer,63(0/1/1)) read err: read after end of file
Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Results
L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
file_win32_pread(108,16,buffer,6291520(391/160/26)) read err: read after end of file
file_win32_pread(108,1,buffer,6291520(391/160/26)) read err: read after end of file
Not an exFAT boot sector.
L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 0 1 1 243200 254 63 3907024002
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=63
ntfs_boot_sector
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/1/2
filesystem size 1763440303340643858 3907024001
sectors_per_cluster 96 8
mft_lcn 2457582888 786432
mftmirr_lcn 752161660 244189000
clusters_per_mft_record 110 -10
clusters_per_index_record 4 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/1/2
filesystem size 1763440303340643858 3907024001
sectors_per_cluster 96 8
mft_lcn 2457582888 786432
mftmirr_lcn 752161660 244189000
clusters_per_mft_record 110 -10
clusters_per_index_record 4 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 1953512000
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 244189000
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 244189000
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 3907024001 1763440303340643858
sectors_per_cluster 8 96
mft_lcn 786432 2457582888
mftmirr_lcn 244189000 752161660
clusters_per_mft_record -10 110
clusters_per_index_record 1 4
Extrapolated boot sector and current boot sector are different.
filesystem size 3907024001 1763440303340643858
sectors_per_cluster 8 96
mft_lcn 786432 2457582888
mftmirr_lcn 244189000 752161660
clusters_per_mft_record -10 110
clusters_per_index_record 1 4
ntfs_boot_sector
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/1/2
filesystem size 1763440303340643858 3907024001
sectors_per_cluster 96 8
mft_lcn 2457582888 786432
mftmirr_lcn 752161660 244189000
clusters_per_mft_record 110 -10
clusters_per_index_record 4 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
5 L HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/1/2
filesystem size 1763440303340643858 3907024001
sectors_per_cluster 96 8
mft_lcn 2457582888 786432
mftmirr_lcn 752161660 244189000
clusters_per_mft_record 110 -10
clusters_per_index_record 4 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.
Analyse Disk \\.\PhysicalDrive5 - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55