Code: Select all
Tue Feb 14 03:39:14 2017
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.4.0-31-generic (#50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
/dev/sda: dco 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZRX-00L4HB0, S/N:WD-WCC4JRAJ8HZZ, FW:01.01A01
Disk /dev/sdb - 8004 MB / 7633 MiB - CHS 1020 247 62, sector size=512 - SanDisk Cruzer Blade, FW:1.27
Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10EZRX-00L4HB0
Partition table type: Intel
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 63/221/31
NTFS at 9140/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P HPFS - NTFS 0 32 33 63 221 30 1024000
2 P HPFS - NTFS 63 221 31 9139 211 32 145805312
3 P HPFS - NTFS 9140 1 1 11749 254 63 41929587
No partition is bootable
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000
NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size 145805312
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63 221 31 9139 211 32 145805312
NTFS, blocksize=4096, 74 GB / 69 GiB
NTFS at 9140/1/1
filesystem size 41929587
sectors_per_cluster 8
mft_lcn 3
mftmirr_lcn 2620599
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 9140 1 1 11749 254 63 41929587
NTFS, blocksize=4096, 21 GB / 19 GiB
recover_EXT2: s_block_group_nr=0/79, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2617920
recover_EXT2: part_size 20943360
Linux 11750 136 35 13054 50 52 20943360
ext4 blocksize=4096 Large_file Sparse_SB, 10723 MB / 10226 MiB
NTFS at 13054/75/14
filesystem size 209715200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 13054 75 14 26108 117 57 209715200
NTFS, blocksize=4096, 107 GB / 100 GiB
NTFS at 26108/150/27
filesystem size 209715200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 26108 150 27 39162 193 7 209715200
NTFS, blocksize=4096, 107 GB / 100 GiB
NTFS at 39162/225/40
filesystem size 419430400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 39162 225 40 65271 56 1 419430400
NTFS, blocksize=4096, 214 GB / 200 GiB
NTFS at 65271/88/34
filesystem size 419430400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 65271 88 34 91379 173 58 419430400
NTFS, blocksize=4096, 214 GB / 200 GiB
NTFS at 91379/206/28
filesystem size 485505024
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 91379 206 28 121601 25 24 485505024
NTFS, blocksize=4096, 248 GB / 231 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 32 33 63 221 30 1024000
NTFS, blocksize=4096, 524 MB / 500 MiB
HPFS - NTFS 63 221 31 9139 211 32 145805312
NTFS, blocksize=4096, 74 GB / 69 GiB
HPFS - NTFS 9140 1 1 11749 254 63 41929587
NTFS, blocksize=4096, 21 GB / 19 GiB
Linux 11750 136 35 13054 75 13 20944896
ext4 blocksize=4096 Large_file Sparse_SB, 10723 MB / 10227 MiB
HPFS - NTFS 13054 75 14 26108 117 57 209715200
NTFS, blocksize=4096, 107 GB / 100 GiB
HPFS - NTFS 26108 150 27 39162 193 7 209715200
NTFS, blocksize=4096, 107 GB / 100 GiB
HPFS - NTFS 39162 225 40 65271 56 1 419430400
NTFS, blocksize=4096, 214 GB / 200 GiB
HPFS - NTFS 65271 88 34 91379 173 58 419430400
NTFS, blocksize=4096, 214 GB / 200 GiB
HPFS - NTFS 91379 206 28 121601 25 24 485505024
NTFS, blocksize=4096, 248 GB / 231 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 1024000 linear /dev/sda 2048" | dmsetup create test0
echo "0 145805312 linear /dev/sda 1026048" | dmsetup create test1
echo "0 41929587 linear /dev/sda 146834163" | dmsetup create test2
echo "0 20944896 linear /dev/sda 188772352" | dmsetup create test3
echo "0 209715200 linear /dev/sda 209717248" | dmsetup create test4
echo "0 209715200 linear /dev/sda 419434496" | dmsetup create test5
echo "0 419430400 linear /dev/sda 629151744" | dmsetup create test6
echo "0 419430400 linear /dev/sda 1048584192" | dmsetup create test7
echo "0 485505024 linear /dev/sda 1468016640" | dmsetup create test8
ntfs_device_testdisk_io_ioctl() unimplemented
dir_partition inode=5
HPFS - NTFS 63 221 31 9139 211 32 145805312
NTFS, blocksize=4096, 74 GB / 69 GiB
Directory /
5 dr-xr-xr-x 0 0 0 12-Feb-2017 15:27 .
5 dr-xr-xr-x 0 0 0 12-Feb-2017 15:27 ..
57 dr-xr-xr-x 0 0 0 30-Mar-2016 07:12 $Recycle.Bin
5321 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 6awrap68
149112 dr-xr-xr-x 0 0 0 29-Nov-2016 16:11 6b2a0d656378b8604969199d
98894 dr-xr-xr-x 0 0 0 24-Aug-2016 05:13 AnuSM
183 dr-xr-xr-x 0 0 0 19-Jan-2017 14:58 Boot
148050 dr-xr-xr-x 0 0 0 12-Feb-2017 14:55 Config.Msi
103844 dr-xr-xr-x 0 0 0 9-Jan-2017 13:16 CryptoPreventQuarantine
97601 dr-xr-xr-x 0 0 0 28-Feb-2016 13:36 Intel
85184 dr-xr-xr-x 0 0 0 4-Mar-2016 07:35 LJM1005_MFP_Full_Solution
85829 dr-xr-xr-x 0 0 0 29-Feb-2016 15:34 MSOCache
96128 dr-xr-xr-x 0 0 0 8-Feb-2017 13:51 NST
58 dr-xr-xr-x 0 0 0 14-Jul-2009 03:20 PerfLogs
60 dr-xr-xr-x 0 0 0 9-Feb-2017 14:50 Program Files
274 dr-xr-xr-x 0 0 0 1-Feb-2017 04:19 Program Files (x86)
392 dr-xr-xr-x 0 0 0 12-Feb-2017 15:28 ProgramData
84284 dr-xr-xr-x 0 0 0 30-Apr-2016 13:12 Recovery
84904 dr-xr-xr-x 0 0 0 12-Feb-2017 14:41 System Volume Information
496 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 Users
686 dr-xr-xr-x 0 0 0 5-Feb-2017 14:35 Windows
148066 dr-xr-xr-x 0 0 0 1-Dec-2016 10:16 XiaoMi
24069 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 Ypackage69
135163 dr-xr-xr-x 0 0 0 27-May-2016 15:29 adb
135454 dr-xr-xr-x 0 0 0 29-Nov-2016 14:40 cb0430bfb0222b7d1b88378a
156489 dr-xr-xr-x 0 0 0 1-Dec-2016 11:34 mi
103304 -r--r--r-- 0 0 1024 8-Jun-2016 13:10 AMTAG.BIN
94675 -r--r--r-- 0 0 274596 8-Feb-2017 13:51 ANG0
85448 -r--r--r-- 0 0 274596 29-Feb-2016 07:31 ANG0.tmp
84100 -r--r--r-- 0 0 271158 1-Aug-2016 11:23 DUMP3004.tmp
86154 -r--r--r-- 0 0 272150 1-Aug-2016 11:36 DUMP642e.tmp
97685 -r--r--r-- 0 0 361868 8-Feb-2017 13:03 LEOPT
86212 -r--r--r-- 0 0 446865 3-Feb-2017 15:15 MXLUE
155774 -r--r--r-- 0 0 1521 29-Nov-2016 15:17 MicRooCerAut2011_2011_03_22.crt
90841 -r--r--r-- 0 0 441601 30-Apr-2016 00:04 NMIBK
139523 -r--r--r-- 0 0 464888 6-Feb-2017 12:29 PSZWB
24484 -r--r--r-- 0 0 393991 31-Jan-2017 15:10 PUBOF
91082 -r--r--r-- 0 0 449226 20-Aug-2016 23:01 QBLVU
138441 -r--r--r-- 0 0 298243 6-Feb-2017 08:31 ZWONT
1279 -r--r--r-- 0 0 0 19-Jan-2017 14:58 asc_rdflag
85315 -r--r--r-- 0 0 383786 21-Nov-2010 03:23 bootmgr
85384 -r--r--r-- 0 0 383786 29-Feb-2016 07:08 bootmgr.tmp
20 -r--r--r-- 0 0 10168 24-Nov-2016 10:53 bootsqm.dat
87442 -r--r--r-- 0 0 3453214720 12-Feb-2017 15:24 pagefile.sys
ntfs_device_testdisk_io_ioctl() unimplemented
dir_partition inode=5
P HPFS - NTFS 0 32 33 63 221 30 1024000
NTFS, blocksize=4096, 524 MB / 500 MiB
Directory /
5 dr-xr-xr-x 0 0 0 12-Feb-2017 15:27 .
5 dr-xr-xr-x 0 0 0 12-Feb-2017 15:27 ..
189 dr-xr-xr-x 0 0 0 13-May-2016 02:59 $RECYCLE.BIN
197 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 Adocuments11
35 dr-xr-xr-x 0 0 0 29-Feb-2016 00:31 Boot
106 dr-xr-xr-x 0 0 0 5-Mar-2016 13:45 Kaspersky Rescue Disk 10.0
196 dr-xr-xr-x 0 0 0 30-May-2016 03:11 Program Files
101 dr-xr-xr-x 0 0 0 29-Feb-2016 20:57 Recovery
97 dr-xr-xr-x 0 0 0 29-Feb-2016 00:33 System Volume Information
208 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 Tstore62
96 -r--r--r-- 0 0 8192 29-Feb-2016 00:31 BOOTSECT.BAK
99 -r--r--r-- 0 0 405508 28-Apr-2016 10:55 RPIYN
188 -r--r--r-- 0 0 0 30-Apr-2016 12:54 Recovery.txt
85 -r--r--r-- 0 0 383786 21-Nov-2010 03:23 bootmgr
ntfs_device_testdisk_io_ioctl() unimplemented
dir_partition inode=5
P HPFS - NTFS 63 221 31 9139 211 32 145805312
NTFS, blocksize=4096, 74 GB / 69 GiB
Directory /
5 dr-xr-xr-x 0 0 0 12-Feb-2017 15:27 .
5 dr-xr-xr-x 0 0 0 12-Feb-2017 15:27 ..
57 dr-xr-xr-x 0 0 0 30-Mar-2016 07:12 $Recycle.Bin
5321 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 6awrap68
149112 dr-xr-xr-x 0 0 0 29-Nov-2016 16:11 6b2a0d656378b8604969199d
98894 dr-xr-xr-x 0 0 0 24-Aug-2016 05:13 AnuSM
183 dr-xr-xr-x 0 0 0 19-Jan-2017 14:58 Boot
148050 dr-xr-xr-x 0 0 0 12-Feb-2017 14:55 Config.Msi
103844 dr-xr-xr-x 0 0 0 9-Jan-2017 13:16 CryptoPreventQuarantine
97601 dr-xr-xr-x 0 0 0 28-Feb-2016 13:36 Intel
85184 dr-xr-xr-x 0 0 0 4-Mar-2016 07:35 LJM1005_MFP_Full_Solution
85829 dr-xr-xr-x 0 0 0 29-Feb-2016 15:34 MSOCache
96128 dr-xr-xr-x 0 0 0 8-Feb-2017 13:51 NST
58 dr-xr-xr-x 0 0 0 14-Jul-2009 03:20 PerfLogs
60 dr-xr-xr-x 0 0 0 9-Feb-2017 14:50 Program Files
274 dr-xr-xr-x 0 0 0 1-Feb-2017 04:19 Program Files (x86)
392 dr-xr-xr-x 0 0 0 12-Feb-2017 15:28 ProgramData
84284 dr-xr-xr-x 0 0 0 30-Apr-2016 13:12 Recovery
84904 dr-xr-xr-x 0 0 0 12-Feb-2017 14:41 System Volume Information
496 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 Users
686 dr-xr-xr-x 0 0 0 5-Feb-2017 14:35 Windows
148066 dr-xr-xr-x 0 0 0 1-Dec-2016 10:16 XiaoMi
24069 dr-xr-xr-x 0 0 0 12-Feb-2017 15:24 Ypackage69
135163 dr-xr-xr-x 0 0 0 27-May-2016 15:29 adb
135454 dr-xr-xr-x 0 0 0 29-Nov-2016 14:40 cb0430bfb0222b7d1b88378a
156489 dr-xr-xr-x 0 0 0 1-Dec-2016 11:34 mi
103304 -r--r--r-- 0 0 1024 8-Jun-2016 13:10 AMTAG.BIN
94675 -r--r--r-- 0 0 274596 8-Feb-2017 13:51 ANG0
85448 -r--r--r-- 0 0 274596 29-Feb-2016 07:31 ANG0.tmp
84100 -r--r--r-- 0 0 271158 1-Aug-2016 11:23 DUMP3004.tmp
86154 -r--r--r-- 0 0 272150 1-Aug-2016 11:36 DUMP642e.tmp
97685 -r--r--r-- 0 0 361868 8-Feb-2017 13:03 LEOPT
86212 -r--r--r-- 0 0 446865 3-Feb-2017 15:15 MXLUE
155774 -r--r--r-- 0 0 1521 29-Nov-2016 15:17 MicRooCerAut2011_2011_03_22.crt
90841 -r--r--r-- 0 0 441601 30-Apr-2016 00:04 NMIBK
139523 -r--r--r-- 0 0 464888 6-Feb-2017 12:29 PSZWB
24484 -r--r--r-- 0 0 393991 31-Jan-2017 15:10 PUBOF
91082 -r--r--r-- 0 0 449226 20-Aug-2016 23:01 QBLVU
138441 -r--r--r-- 0 0 298243 6-Feb-2017 08:31 ZWONT
1279 -r--r--r-- 0 0 0 19-Jan-2017 14:5