I am trying to recover an NTFS harddisk through Ubuntu Linux with testdisk. I got the following mesage:
Code: Select all
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
The harddisk (1000 GB / 931 GiB) seems too small! (< 2871 GB / 2674 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 121600 254 63 243201 253 61 1953520001
FAT16 <32M 305787 165 10 349124 17 48 696199620
[ Continue ]
I am attaching the testdisk.log file below.
Code: Select all
Sun Jul 17 12:24:34 2016
Command line: TestDisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.2.0-42-generic (#49-Ubuntu SMP Tue Jun 28 21:26:26 UTC 2016) x86_64
Compiler: GCC 4.9
Compilation date: 2015-04-03T09:01:54
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 234441648 sectors
/dev/sda: user_max 234441648 sectors
/dev/sda: native_max 234441648 sectors
/dev/sda: dco 234441648 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 1953525168 sectors
/dev/sdb: user_max 1953525168 sectors
/dev/sdb: native_max 1953525168 sectors
/dev/sdb: dco 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - Samsung SSD 850 EVO 120GB, S/N:S21UNSBG124737L, FW:EMT01B6Q
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SI, S/N:S1VSJ90SC05158, FW:1AG01118
Disk /dev/sdc - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - Samsung S2 Portable
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung M3 Portable, FW:1301
Partition table type (auto): Intel
Partition table type (auto): Intel
Disk /dev/sdd - 1000 GB / 931 GiB - Samsung M3 Portable
Partition table type: Intel
Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
Current partition structure:
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
L HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 0 1 1 121600 254 63 1953520002
5 L HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
BAD_RS LBA=1116974034 14209606
check_part_i386 failed for partition type 06
FAT16 >32M 69528 106 37 82193 13 44 203457374
BAD_RS LBA=4912478559 10394081
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 305787 165 10 349124 17 48 696199620
This partition ends after the disk limits. (start=4912478559, size=696199620, end=5608678178, disk end=1953525168)
NTFS at 121600/254/63
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 243201 253 61 1953520001
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953520064, size=1953520001, end=3907040064, disk end=1953525168)
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2871 GB / 2674 GiB)
The following partitions can't be recovered:
HPFS - NTFS 121600 254 63 243201 253 61 1953520001
NTFS, blocksize=4096, 1000 GB / 931 GiB
FAT16 <32M 305787 165 10 349124 17 48 696199620
Results
HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
FAT16 >32M 69528 106 37 82193 13 44 203457374
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/1/2
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS Volume is dirty.
Directory /
5 dr-xr-xr-x 0 0 0 17-Jul-2016 12:15 .
5 dr-xr-xr-x 0 0 0 17-Jul-2016 12:15 ..
236 dr-xr-xr-x 0 0 0 14-Aug-2015 00:37 $RECYCLE.BIN
2337 dr-xr-xr-x 0 0 0 20-Dec-2015 14:12 2 B fotóstudió
39 dr-xr-xr-x 0 0 0 19-Oct-2014 14:33 Macintosh Driver
27084 dr-xr-xr-x 0 0 0 13-May-2015 18:23 RECYCLER
41 dr-xr-xr-x 0 0 0 19-Oct-2014 14:33 Samsung Drive Manager
43 dr-xr-xr-x 0 0 0 19-Oct-2014 14:33 Samsung Drive Manager Manuals
27082 dr-xr-xr-x 0 0 0 15-May-2016 13:08 System Volume Information
2327 dr-xr-xr-x 0 0 0 11-May-2016 15:42 Szamszim
74 dr-xr-xr-x 0 0 0 19-Oct-2014 14:33 User Manual
224 dr-xr-xr-x 0 0 0 15-Apr-2015 11:37 audio
235 dr-xr-xr-x 0 0 0 15-Jun-2015 18:56 graded readers
1220 dr-xr-xr-x 0 0 0 15-Apr-2015 11:27 kolel
131 dr-xr-xr-x 0 0 0 3-Apr-2016 22:18 video
3268 dr-xr-xr-x 0 0 0 6-Apr-2016 21:05 web
35 -r--r--r-- 0 0 120 6-Dec-2013 02:40 Autorun.inf
36 -r--r--r-- 0 0 1407568 17-Dec-2013 11:57 Portable SecretZone.exe
37 -r--r--r-- 0 0 166488 17-Dec-2013 11:58 Samsung_Drive_Manager.exe
38 -r--r--r-- 0 0 712704 17-Dec-2013 11:55 Secure Unlock_win.exe
ntfs_boot_sector
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/1/2
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Change partition type:
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
Current partition structure:
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
L HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 0 1 1 121600 254 63 1953520002
5 L HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=63
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/1/2
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/2
Current partition structure:
1 * HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/1/2
filesystem size 1953520001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
L HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
NTFS, blocksize=4096, 1000 GB / 931 GiB
add_ext_part_i386: max
add_ext_part_i386: min
interface_write()
1 E extended LBA 0 1 1 121600 254 63 1953520002
5 L HPFS - NTFS 0 1 2 121600 254 63 1953520001 [SAMSUNG]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/1/1,lba=63
TestDisk exited normally.
Thank you very much,
Binyomin