Page 1 of 1

i lost my most important hard disk

Posted: 22 Oct 2017, 22:04
by mamiakimo
hello

i defected by virus and when i restart windows 10 it start to check and repair all my hard disks
after windows open i found on hard disk which have 2 partitions not open
when i open Disk manager i found it like this
Image

i downloaded latet version of testdisk and make this
Analysis => quick search => write
i get this error
partition: write error

when i tried to open wile i get this
Can't open filesystem. Filesystem seems damaged

Re: i lost my most important hard disk

Posted: 23 Oct 2017, 06:16
by cgrenier
Start Windows in Safe mode and try again to rewrite the partition table with testdisk.
Please post (copy/paste) the testdisk.log file.

Re: i lost my most important hard disk

Posted: 23 Oct 2017, 22:59
by mamiakimo
i think i made the problem worse after create rebuild BS
now i have 3 partitions not 2
and i get errors when i create deep search analysis

Image
Image

Re: i lost my most important hard disk

Posted: 23 Oct 2017, 23:00
by mamiakimo
log file
  • Mon Oct 23 22:45:07 2017
    Command line: TestDisk

    TestDisk 7.1-WIP, Data Recovery Utility, October 2017
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    OS: Windows 8 (9200)
    Compiler: GCC 5.4, Cygwin32 2005.2
    ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=300067970560
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=300067970560
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=510621943296
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202241024
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=32210164224
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=72653865984
    disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=195202312704
    Hard disk list
    Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 850 PRO 512GB, S/N:S39FNX0J657478H, FW:EXM04B6Q
    Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1001FALS-00J7B1, S/N:WD-WMATV2506359, FW:05.00K05
    Disk /dev/sdc - 300 GB / 279 GiB - CHS 36481 255 63, sector size=512 - ST3300822AS, S/N:4NF1AM4Q, FW:3.AAE
    Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SI, S/N:S1Y5JD2B306880, FW:1AG01118

    Partition table type (auto): Intel
    Disk /dev/sdc - 300 GB / 279 GiB - ST3300822AS
    Partition table type: Intel

    Analyse Disk /dev/sdc - 300 GB / 279 GiB - CHS 36481 255 63
    Geometry from i386 MBR: head=255 sector=63
    NTFS at 0/1/1
    NTFS at 3916/1/1
    NTFS at 12749/1/1
    Error: size boot_sector 444162933 > partition 381254517
    check_part_i386 failed for partition type 07
    get_geometry_from_list_part_aux head=255 nbr=10
    get_geometry_from_list_part_aux head=8 nbr=1
    get_geometry_from_list_part_aux head=16 nbr=1
    get_geometry_from_list_part_aux head=32 nbr=1
    get_geometry_from_list_part_aux head=64 nbr=1
    get_geometry_from_list_part_aux head=128 nbr=1
    get_geometry_from_list_part_aux head=240 nbr=1
    get_geometry_from_list_part_aux head=255 nbr=10
    Current partition structure:
    1 * HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    2 E extended LBA 3916 0 1 36480 254 63 523156725
    5 L HPFS - NTFS 3916 1 1 12748 254 63 141902082
    X extended 12749 0 1 36480 254 63 381254580
    Error: size boot_sector 444162933 > partition 381254517
    Invalid NTFS or exFAT boot
    6 L HPFS - NTFS 12749 1 1 36480 254 63 381254517
    6 L HPFS - NTFS 12749 1 1 36480 254 63 381254517

    search_part()
    Disk /dev/sdc - 300 GB / 279 GiB - CHS 36481 255 63
    NTFS at 0/1/1
    filesystem size 62910477
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 2
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    NTFS, blocksize=4096, 32 GB / 29 GiB
    NTFS at 3916/1/1
    filesystem size 141902082
    sectors_per_cluster 8
    mft_lcn 4
    mftmirr_lcn 8868880
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 3916 1 1 12748 254 63 141902082
    NTFS, blocksize=4096, 72 GB / 67 GiB
    Error: size boot_sector 444162933 > partition 381254517
    check_part_i386 failed for partition type 07
    HPFS - NTFS 12749 1 1 36480 254 63 381254517
    file_pread(6,2,buffer,586072063(36481/76/11)) lseek err Invalid argument
    file_pread(6,1,buffer,586072063(36481/76/11)) lseek err Invalid argument
    file_pread(6,2,buffer,586072064(36481/76/12)) lseek err Invalid argument
    file_pread(6,8,buffer,586070348(36481/48/60)) lseek err Invalid argument
    file_pread(6,1,buffer,586070348(36481/48/60)) lseek err Invalid argument
    file_pread(6,8,buffer,586070476(36481/50/62)) lseek err Invalid argument
    file_pread(6,8,buffer,586070604(36481/53/1)) lseek err Invalid argument
    file_pread(6,8,buffer,586070732(36481/55/3)) lseek err Invalid argument
    file_pread(6,8,buffer,586070860(36481/57/5)) lseek err Invalid argument
    file_pread(6,8,buffer,586070988(36481/59/7)) lseek err Invalid argument
    file_pread(6,8,buffer,586071116(36481/61/9)) lseek err Invalid argument
    file_pread(6,8,buffer,586071244(36481/63/11)) lseek err Invalid argument
    file_pread(6,8,buffer,586071372(36481/65/13)) lseek err Invalid argument
    file_pread(6,8,buffer,586071500(36481/67/15)) lseek err Invalid argument
    file_pread(6,8,buffer,586071628(36481/69/17)) lseek err Invalid argument
    file_pread(6,8,buffer,586071756(36481/71/19)) lseek err Invalid argument
    file_pread(6,8,buffer,586071884(36481/73/21)) lseek err Invalid argument
    file_pread(6,8,buffer,586072012(36481/75/23)) lseek err Invalid argument
    file_pread(6,2,buffer,586072064(36481/76/12)) lseek err Invalid argument
    file_pread(6,14,buffer,586072066(36481/76/14)) lseek err Invalid argument
    file_pread(6,3,buffer,586072080(36481/76/28)) lseek err Invalid argument
    file_pread(6,3,buffer,586072127(36481/77/12)) lseek err Invalid argument
    file_pread(6,8,buffer,586072143(36481/77/28)) lseek err Invalid argument
    file_pread(6,11,buffer,586072190(36481/78/12)) lseek err Invalid argument
    file_pread(6,2,buffer,586074112(36481/108/44)) lseek err Invalid argument
    get_geometry_from_list_part_aux head=255 nbr=6
    get_geometry_from_list_part_aux head=8 nbr=1
    get_geometry_from_list_part_aux head=16 nbr=1
    get_geometry_from_list_part_aux head=32 nbr=1
    get_geometry_from_list_part_aux head=64 nbr=1
    get_geometry_from_list_part_aux head=128 nbr=1
    get_geometry_from_list_part_aux head=240 nbr=1
    get_geometry_from_list_part_aux head=255 nbr=6

    Results
    * HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    NTFS, blocksize=4096, 32 GB / 29 GiB
    L HPFS - NTFS 3916 1 1 12748 254 63 141902082
    NTFS, blocksize=4096, 72 GB / 67 GiB
    L HPFS - NTFS 12749 1 1 36480 254 63 381254517
    add_ext_part_i386: max
    add_ext_part_i386: min

    interface_write()
    1 * HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    2 E extended LBA 3916 0 1 36480 254 63 523156725
    5 L HPFS - NTFS 3916 1 1 12748 254 63 141902082
    6 L HPFS - NTFS 12749 1 1 36480 254 63 381254517

    search_part()
    Disk /dev/sdc - 300 GB / 279 GiB - CHS 36481 255 63
    NTFS at 0/1/1
    filesystem size 62910477
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 2
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    NTFS, blocksize=4096, 32 GB / 29 GiB
    NTFS at 3915/253/50
    filesystem size 444162933
    sectors_per_cluster 8
    mft_lcn 4
    mftmirr_lcn 524288
    clusters_per_mft_record -10
    clusters_per_index_record 1
    NTFS part_offset=32210157056, part_size=227411421696, sector_size=512
    NTFS partition cannot be added (part_offset<part_size).
    NTFS at 3915/254/63
    filesystem size 62910477
    sectors_per_cluster 8
    mft_lcn 786432
    mftmirr_lcn 2
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    NTFS found using backup sector, blocksize=4096, 32 GB / 29 GiB
    NTFS at 3916/1/1
    filesystem size 141902082
    sectors_per_cluster 8
    mft_lcn 4
    mftmirr_lcn 8868880
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 3916 1 1 12748 254 63 141902082
    NTFS, blocksize=4096, 72 GB / 67 GiB
    BAD_RS LBA=3719739369 8303183
    file_pread(6,3,buffer,3719739369(231543/17/4)) lseek err Invalid argument
    file_pread(6,1,buffer,3719739369(231543/17/4)) lseek err Invalid argument
    check_FAT: can't read FAT boot sector
    check_part_i386 failed for partition type 06
    FAT16 >32M 231543 17 4 494024 110 27 4216763148
    This partition ends after the disk limits. (start=3719739369, size=4216763148, end=7936502516, disk end=586070255)
    NTFS at 12748/254/63
    filesystem size 141902082
    sectors_per_cluster 8
    mft_lcn 4
    mftmirr_lcn 8868880
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 3916 1 1 12748 254 63 141902082
    NTFS found using backup sector, blocksize=4096, 72 GB / 67 GiB
    Error: size boot_sector 444162933 > partition 381254517
    check_part_i386 failed for partition type 07
    HPFS - NTFS 12749 1 1 36480 254 63 381254517
    NTFS at 12749/1/1
    filesystem size 444162933
    sectors_per_cluster 8
    mft_lcn 4
    mftmirr_lcn 524288
    clusters_per_mft_record -10
    clusters_per_index_record 1
    HPFS - NTFS 12749 1 1 40396 221 18 444162933
    NTFS, blocksize=4096, 227 GB / 211 GiB
    This partition ends after the disk limits. (start=204812748, size=444162933, end=648975680, disk end=586070255)
    file_pread(6,2,buffer,586072063(36481/76/11)) lseek err Invalid argument
    file_pread(6,1,buffer,586072063(36481/76/11)) lseek err Invalid argument
    file_pread(6,2,buffer,586072064(36481/76/12)) lseek err Invalid argument
    file_pread(6,8,buffer,586070348(36481/48/60)) lseek err Invalid argument
    file_pread(6,1,buffer,586070348(36481/48/60)) lseek err Invalid argument
    file_pread(6,8,buffer,586070476(36481/50/62)) lseek err Invalid argument
    file_pread(6,8,buffer,586070604(36481/53/1)) lseek err Invalid argument
    file_pread(6,8,buffer,586070732(36481/55/3)) lseek err Invalid argument
    file_pread(6,8,buffer,586070860(36481/57/5)) lseek err Invalid argument
    file_pread(6,8,buffer,586070988(36481/59/7)) lseek err Invalid argument
    file_pread(6,2,buffer,586071093(36481/60/49)) lseek err Invalid argument
    file_pread(6,8,buffer,586071116(36481/61/9)) lseek err Invalid argument
    file_pread(6,2,buffer,586071156(36481/61/49)) lseek err Invalid argument
    file_pread(6,2,buffer,586071219(36481/62/49)) lseek err Invalid argument
    file_pread(6,8,buffer,586071244(36481/63/11)) lseek err Invalid argument
    file_pread(6,8,buffer,586071372(36481/65/13)) lseek err Invalid argument
    file_pread(6,8,buffer,586071500(36481/67/15)) lseek err Invalid argument
    file_pread(6,8,buffer,586071628(36481/69/17)) lseek err Invalid argument
    file_pread(6,8,buffer,586071756(36481/71/19)) lseek err Invalid argument
    file_pread(6,8,buffer,586071884(36481/73/21)) lseek err Invalid argument
    file_pread(6,8,buffer,586072012(36481/75/23)) lseek err Invalid argument
    file_pread(6,1,buffer,586072063(36481/76/11)) lseek err Invalid argument
    file_pread(6,1,buffer,586072064(36481/76/12)) lseek err Invalid argument
    Disk /dev/sdc - 300 GB / 279 GiB - CHS 36481 255 63
    Check the harddisk size: HD jumper settings, BIOS detection...
    The harddisk (300 GB / 279 GiB) seems too small! (< 4063 GB / 3784 GiB)
    The following partitions can't be recovered:
    HPFS - NTFS 12749 1 1 40396 221 18 444162933
    NTFS, blocksize=4096, 227 GB / 211 GiB
    FAT16 >32M 231543 17 4 494024 110 27 4216763148
    get_geometry_from_list_part_aux head=255 nbr=6
    get_geometry_from_list_part_aux head=8 nbr=1
    get_geometry_from_list_part_aux head=16 nbr=1
    get_geometry_from_list_part_aux head=32 nbr=1
    get_geometry_from_list_part_aux head=64 nbr=1
    get_geometry_from_list_part_aux head=128 nbr=1
    get_geometry_from_list_part_aux head=240 nbr=1
    get_geometry_from_list_part_aux head=255 nbr=6

    Results
    * HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    NTFS, blocksize=4096, 32 GB / 29 GiB
    L HPFS - NTFS 3916 1 1 12748 254 63 141902082
    NTFS, blocksize=4096, 72 GB / 67 GiB
    L HPFS - NTFS 12749 1 1 36480 254 63 381254517
    add_ext_part_i386: max
    add_ext_part_i386: min

    interface_write()
    1 * HPFS - NTFS 0 1 1 3915 254 63 62910477 [New Volume]
    2 E extended LBA 3916 0 1 36480 254 63 523156725
    5 L HPFS - NTFS 3916 1 1 12748 254 63 141902082
    6 L HPFS - NTFS 12749 1 1 36480 254 63 381254517