cgsecurity.org

Hi all,
I couldn't access my 5-year-old WD My Passport 1 TB after my move so I tried chkdsk and TestDisk...
Here's my log file:
Wed Oct 4 12:38:59 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=118113972224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=882086478336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=53694595584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=223349220864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=223061336064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=1000169537536
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA DT01ACA050, S/N:Z3H2XHDKS, FW:MS1OA750
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-60WN4A0, S/N:WD-WCC6Y3ATTZN3, FW:01.01A01
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 0740, S/N:WX71A91X8978, FW:1003

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 0740
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Change partition type:
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953456128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
2 [main] testdisk_win 2640 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump

And dump file:
Exception: STATUS_ACCESS_VIOLATION at rip=0010042188A
rax=0000000000000001 rbx=00000006000CCB30 rcx=0000000600018040
rdx=0000000000000000 rsi=0000000000000050 rdi=0000000000000000
r8 =00000000FFFFA80C r9 =0000000180152440 r10=0000000100000000
r11=0000000100405E13 r12=00000006000CC940 r13=0000000425FA7000
r14=00000000FFFFAB10 r15=0000000000000000
rbp=00000006000CDEB0 rsp=00000000FFFFAAD0
program=G:\testdisk-7.1-WIP\testdisk_win.exe, pid 2640, thread main
cs=0033 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
006000CDEB0 0010042188A (00400000008, 00100485E66, 00100000009, 000FFFFB410)
000FFFFB210 0010043401B (7FF82CEEFD73, 00000000000, 00000000000, 000FFFFB0A0)
000FFFFB210 001004358B3 (00425FA7000, 000004A7F54, 8080808000000000, 000FFFFCB78)
006000CC940 0010043CE8F (01000000018, 00100000017, 00000000000, 000FFFFCB78)
000FFFFCB78 0010041C679 (00100000001, 00000000000, 00000000000, 000FFFFCB78)
00000000001 0010043AA5C (00000000001, 00000000013, 00000000000, 000FFFFCB78)
00000000002 0010043B1B9 (00000000000, 000FFFFC7CC, 00100000000, 00000000000)
00000000001 00100477377 (00000000020, FF0700010302FF00, 00180047B61, 000FFFFD680)
000FFFFCCC0 00180047BD2 (00000000000, 00000000000, 00000000000, 00000000000)
00000000000 0018004591C (00000000000, 00000000000, 00000000000, 00000000000)
000FFFFFFF0 001800459B4 (00000000000, 00000000000, 00000000000, 00000000000)
End of stack trace

Anyone have any idea what am I doinging wrong here? Thx.

The NTFS filesystem is corrupted and triggered a bug in the ntfs library used by TestDisk (This problem will probably not occur with the Linux version.)
What is the output of "chkdsk /f e:" ? (replace e: by the correct drive letter)

Well my OS is in Chinese so I use Bing translator to translate the script...I hope it's readable...

The file system type is NTFS.
The volume label is my Passport.

Phase 1: Check the basic file system structure ...

From file record segment 8
Delete the corrupted property record ($number, $Bad).

File record segment 19536 cannot be read.

File record segment 19537 cannot be read.

File record segment 19538 cannot be read.

File record segment 19539 cannot be read.

Processed 34,816 of file records.

The file verification is complete.

Processed 0 of large file records.

4 error file records processed.

Phase 2: Check the filename link ...

Processed 37,424 index entries.

The index validation is complete.

0 files have been scanned for indexing.

Recovered 0 files that were not indexed.

Phase 3: Check security descriptor ...
Security descriptor verification completed.

Processed 1305 of data files.
CHKDSK is validating the USN journal ...
USN Journal validation completed.
Correcting errors in primary file table (MFT) mirroring.
Fixing incorrect cluster file errors.
Add 1 incorrect clusters to the incorrect cluster file.
An unspecified error occurred (6E74667363686B2E 1363)