File partition recovery Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
hollinew
Posts: 3
Joined: 07 Apr 2018, 22:07

File partition recovery

#1 Post by hollinew »

In the absence of any physical damage, my SanDisk Cruzer External USB drive (15.7 GB) is no longer readable. The partition system was initiated on my laptop, a MacBook Pro (13-inch, Mid 2012) running 10.13.12 High Sierra. Below is the external drive information returned from diskutil list and diskutil info /dev/disk3

Code: Select all

 ➜ diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *750.2 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage Macintosh HD            749.3 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

/dev/disk1 (internal, virtual):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh HD           +748.9 GB   disk1
                                 Logical Volume on disk0s2
                                 C37F3541-17DE-49E6-B5BC-2B60076D62AD
                                 Unlocked Encrypted

/dev/disk3 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *15.7 GB    disk3

➜ diskutil info /dev/disk3
   Device Identifier:        disk3
   Device Node:              /dev/disk3
   Whole:                    Yes
   Part of Whole:            disk3
   Device / Media Name:      Cruzer Glide

   Volume Name:              Not applicable (no file system)
   Mounted:                  Not applicable (no file system)
   File System:              None

   Content (IOContent):      FDisk_partition_scheme
   OS Can Be Installed:      No
   Media Type:               Generic
   Protocol:                 USB
   SMART Status:             Not Supported

   Disk Size:                15.7 GB (15698231296 Bytes) (exactly 30660608 512-Byte-Units)
   Device Block Size:        512 Bytes

   Read-Only Media:          No
   Read-Only Volume:         Not applicable (no file system)

   Device Location:          External
   Removable Media:          Removable
   Media Removal:            Software-Activated

   Virtual:                  No
   OS 9 Drivers:             No
   Low Level Format:         Not supported

~ took 2s 
Using TestDisk, I did a deep scan, which returned the following. I have seen other posts about creating an image backup, but didn't know if this was straightforward enough of a fix to not worry about that. I also have attached my log file in full below.

Code: Select all

 Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors

The harddisk (15 GB / 14 GiB) seems too small! (< 2246 GB / 2092 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  FAT32 LBA                     38   30660613   30660576 [NO NAME]
   FAT16 >32M            1286397454 4388646105 3102248652
   FAT16 >32M            1308096031 3377048781 2068952751 
When trying to recover the data before repairing the partitions, I am able to see the file names, but when I try to copy all selected files to a folder I created on my internal drive, only the commercial SanDisk "quick start" folder is transferred. Is this because those files are housed within the deleted partitions while the SanDisk is in the initial FAT32 LBA? Would transferring these files to a separate external hard drive, rather than an internal drive, amend this issue?

It is my impression that if I can recover the partitions than there is no longer a need for data recovery, so this additional problem I think can be disregarded if the partitions are salvageable.

Please let me know any suggestions and thank you tremendously in advance for any guidance you can provide.

EDIT: Here is correct original log file with the indicated Intel.

Code: Select all

 

Sat Apr  7 18:11:38 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, March 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov  9 18:09:22 PST 2017; root:xnu-4570.31.3~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2018-03-19T20:41:07
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/rdisk2 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/rdisk3 - 15 GB / 14 GiB - 30660608 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/disk3 - 15 GB / 14 GiB
Partition table type: None

Interface Advanced
   P Unknown                        0   30660607   30660608
Partition table type (auto): Intel
Disk /dev/disk3 - 15 GB / 14 GiB
Partition table type: Intel

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576
SIGHUP detected! TestDisk has been killed.
r-xr-x     0      0         0 29-Nov-2017 16:06 11-29-2017 AHR Quantifications
X 263337 -rwxr-xr-x     0      0       450 29-Nov-2017 16:07 DATA (D) - Shortcut.lnk
X 263343 drwxr-xr-x     0      0         0  9-Dec-2017 13:18 New folder
X 263343 drwxr-xr-x     0      0         0  9-Dec-2017 13:18 12-9-17 Confocal
X      0 -rwxr-xr-x     0      0         0 21-Dec-2017 06:49 12-20-17 STAT1_Keystone_Abstract.docx
X 524381 -rwxr-xr-x     0      0     19798 21-Dec-2017 06:49 _WRD0000.TMP
  524381 -rwxr-xr-x     0      0     19798 21-Dec-2017 06:49 12-20-17 STAT1_Keystone_Abstract.docx
X 541708 -rwxr-xr-x     0      0    236821  2-Feb-2018 13:32 _WRD1000.TMP
X  47318 -rwxr-xr-x     0      0    196237  2-Feb-2018 07:03 _WRL1203.TMP
X 541708 -rwxr-xr-x     0      0    236821  2-Feb-2018 13:32 2018-AHR 1312018  draft 1 ethan.docx
X 524389 drwxr-xr-x     0      0         0  4-Feb-2018 16:53 New folder
  524389 drwxr-xr-x     0      0         0  4-Feb-2018 16:53 2-4-18 Confocal
X 262238 drwxr-xr-x     0      0         0 13-Feb-2018 11:03 New folder
  262238 drwxr-xr-x     0      0         0 13-Feb-2018 11:03 2-13-2018 Confocal
X 262241 drwxr-xr-x     0      0         0 16-Feb-2018 10:59 New folder
  262241 drwxr-xr-x     0      0         0 16-Feb-2018 10:59 2-16-2018 Confocal
  263320 drwxr-xr-x     0      0         0  5-Mar-2018 13:33 3-5-18 IFNg
X 524396 drwxr-xr-x     0      0         0  6-Mar-2018 15:50 New folder
  524396 drwxr-xr-x     0      0         0  6-Mar-2018 15:50 3-6-18 Confocal
  656318 -rwxr-xr-x     0      0     57168  8-Mar-2018 16:15 Gresham_LOR.PDF
X 656322 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 New folder
X 656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 New folder (2)
X 656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 _
  656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 3-12-18 IFNg
X 593362 drwxr-xr-x     0      0         0 19-Mar-2018 11:44 New folder (2)
  593362 drwxr-xr-x     0      0         0 19-Mar-2018 11:44 3-19-18 IFNg
X 263322 drwxr-xr-x     0      0         0 20-Mar-2018 13:04 New folder
  263322 drwxr-xr-x     0      0         0 20-Mar-2018 13:04 3-20-18 Confocal

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
FAT32 at 38/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 38/0/1
FAT: cluster=2(0x2), pos=15014
FAT: cluster=771(0x303), pos=39622
FAT: cluster=1540(0x604), pos=64230
FAT: cluster=2309(0x905), pos=88838
FAT: cluster=3078(0xc06), pos=113446
FAT: cluster=3847(0xf07), pos=138054
FAT: cluster=4616(0x1208), pos=162662
FAT: cluster=5385(0x1509), pos=187270
FAT: cluster=6154(0x180a), pos=211878
FAT: cluster=6923(0x1b0b), pos=236486
FAT: cluster=7692(0x1e0c), pos=261094
FAT: cluster=8461(0x210d), pos=285702
FAT: cluster=9230(0x240e), pos=310310
FAT: cluster=9999(0x270f), pos=334918
FAT: cluster=10768(0x2a10), pos=359526
FAT: cluster=11537(0x2d11), pos=384134
FAT: cluster=12306(0x3012), pos=408742
FAT: cluster=13075(0x3313), pos=433350
FAT: cluster=13844(0x3614), pos=457958
FAT: cluster=14613(0x3915), pos=482566
FAT: cluster=15382(0x3c16), pos=507174
FAT: cluster=16151(0x3f17), pos=531782
FAT: cluster=16920(0x4218), pos=556390
FAT: cluster=17689(0x4519), pos=580998
FAT: cluster=18458(0x481a), pos=605606
FAT: cluster=19227(0x4b1b), pos=630214
FAT: cluster=19996(0x4e1c), pos=654822
FAT: cluster=20765(0x511d), pos=679430
FAT: cluster=21534(0x541e), pos=704038
FAT: cluster=22303(0x571f), pos=728646
FAT: cluster=23072(0x5a20), pos=753254
FAT: cluster=23841(0x5d21), pos=777862
FAT: cluster=24610(0x6022), pos=802470
FAT: cluster=25379(0x6323), pos=827078
FAT: cluster=26148(0x6624), pos=851686
FAT: cluster=26917(0x6925), pos=876294
FAT: cluster=27686(0x6c26), pos=900902
FAT: cluster=28455(0x6f27), pos=925510
FAT: cluster=29224(0x7228), pos=950118
FAT: cluster=29993(0x7529), pos=974726
FAT: cluster=30762(0x782a), pos=999334
FAT: cluster=31531(0x7b2b), pos=1023942
FAT: cluster=32300(0x7e2c), pos=1048550
FAT: cluster=33069(0x812d), pos=1073158
FAT: cluster=33838(0x842e), pos=1097766
FAT: cluster=34607(0x872f), pos=1122374
FAT: cluster=35376(0x8a30), pos=1146982
FAT: cluster=36145(0x8d31), pos=1171590
FAT: cluster=36914(0x9032), pos=1196198
FAT: cluster=37683(0x9333), pos=1220806
FAT: cluster=38452(0x9634), pos=1245414
     FAT32 LBA                     38   30660613   30660576 [NO NAME]
     FAT32, blocksize=16384, 15 GB / 14 GiB
This partition ends after the disk limits. (start=38, size=30660576, end=30660613, disk end=30660608)
BAD_RS LBA=1286397454 277
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            1286397454 4388646105 3102248652
This partition ends after the disk limits. (start=1286397454, size=3102248652, end=4388646105, disk end=30660608)
BAD_RS LBA=1308096031 907
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            1308096031 3377048781 2068952751
This partition ends after the disk limits. (start=1308096031, size=2068952751, end=3377048781, disk end=30660608)
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (15 GB / 14 GiB) seems too small! (< 2246 GB / 2092 GiB)
The following partitions can't be recovered:
     FAT32 LBA                     38   30660613   30660576 [NO NAME]
     FAT32, blocksize=16384, 15 GB / 14 GiB
     FAT16 >32M            1286397454 4388646105 3102248652
     FAT16 >32M            1308096031 3377048781 2068952751
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)
SIGHUP detected! TestDisk has been killed. 
Last edited by hollinew on 09 Apr 2018, 17:45, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File partition recovery

#2 Post by cgrenier »

Use PC Intel partition table type, not "None".

hollinew
Posts: 3
Joined: 07 Apr 2018, 22:07

Re: File partition recovery

#3 Post by hollinew »

@cgrenier

Below is correct log file with Intel table type run.

Code: Select all

 

Sat Apr  7 18:11:38 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, March 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov  9 18:09:22 PST 2017; root:xnu-4570.31.3~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2018-03-19T20:41:07
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/rdisk2 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/rdisk3 - 15 GB / 14 GiB - 30660608 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/disk3 - 15 GB / 14 GiB
Partition table type: None

Interface Advanced
   P Unknown                        0   30660607   30660608
Partition table type (auto): Intel
Disk /dev/disk3 - 15 GB / 14 GiB
Partition table type: Intel

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576
SIGHUP detected! TestDisk has been killed.
r-xr-x     0      0         0 29-Nov-2017 16:06 11-29-2017 AHR Quantifications
X 263337 -rwxr-xr-x     0      0       450 29-Nov-2017 16:07 DATA (D) - Shortcut.lnk
X 263343 drwxr-xr-x     0      0         0  9-Dec-2017 13:18 New folder
X 263343 drwxr-xr-x     0      0         0  9-Dec-2017 13:18 12-9-17 Confocal
X      0 -rwxr-xr-x     0      0         0 21-Dec-2017 06:49 12-20-17 STAT1_Keystone_Abstract.docx
X 524381 -rwxr-xr-x     0      0     19798 21-Dec-2017 06:49 _WRD0000.TMP
  524381 -rwxr-xr-x     0      0     19798 21-Dec-2017 06:49 12-20-17 STAT1_Keystone_Abstract.docx
X 541708 -rwxr-xr-x     0      0    236821  2-Feb-2018 13:32 _WRD1000.TMP
X  47318 -rwxr-xr-x     0      0    196237  2-Feb-2018 07:03 _WRL1203.TMP
X 541708 -rwxr-xr-x     0      0    236821  2-Feb-2018 13:32 2018-AHR 1312018  draft 1 ethan.docx
X 524389 drwxr-xr-x     0      0         0  4-Feb-2018 16:53 New folder
  524389 drwxr-xr-x     0      0         0  4-Feb-2018 16:53 2-4-18 Confocal
X 262238 drwxr-xr-x     0      0         0 13-Feb-2018 11:03 New folder
  262238 drwxr-xr-x     0      0         0 13-Feb-2018 11:03 2-13-2018 Confocal
X 262241 drwxr-xr-x     0      0         0 16-Feb-2018 10:59 New folder
  262241 drwxr-xr-x     0      0         0 16-Feb-2018 10:59 2-16-2018 Confocal
  263320 drwxr-xr-x     0      0         0  5-Mar-2018 13:33 3-5-18 IFNg
X 524396 drwxr-xr-x     0      0         0  6-Mar-2018 15:50 New folder
  524396 drwxr-xr-x     0      0         0  6-Mar-2018 15:50 3-6-18 Confocal
  656318 -rwxr-xr-x     0      0     57168  8-Mar-2018 16:15 Gresham_LOR.PDF
X 656322 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 New folder
X 656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 New folder (2)
X 656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 _
  656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 3-12-18 IFNg
X 593362 drwxr-xr-x     0      0         0 19-Mar-2018 11:44 New folder (2)
  593362 drwxr-xr-x     0      0         0 19-Mar-2018 11:44 3-19-18 IFNg
X 263322 drwxr-xr-x     0      0         0 20-Mar-2018 13:04 New folder
  263322 drwxr-xr-x     0      0         0 20-Mar-2018 13:04 3-20-18 Confocal

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
FAT32 at 38/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 38/0/1
FAT: cluster=2(0x2), pos=15014
FAT: cluster=771(0x303), pos=39622
FAT: cluster=1540(0x604), pos=64230
FAT: cluster=2309(0x905), pos=88838
FAT: cluster=3078(0xc06), pos=113446
FAT: cluster=3847(0xf07), pos=138054
FAT: cluster=4616(0x1208), pos=162662
FAT: cluster=5385(0x1509), pos=187270
FAT: cluster=6154(0x180a), pos=211878
FAT: cluster=6923(0x1b0b), pos=236486
FAT: cluster=7692(0x1e0c), pos=261094
FAT: cluster=8461(0x210d), pos=285702
FAT: cluster=9230(0x240e), pos=310310
FAT: cluster=9999(0x270f), pos=334918
FAT: cluster=10768(0x2a10), pos=359526
FAT: cluster=11537(0x2d11), pos=384134
FAT: cluster=12306(0x3012), pos=408742
FAT: cluster=13075(0x3313), pos=433350
FAT: cluster=13844(0x3614), pos=457958
FAT: cluster=14613(0x3915), pos=482566
FAT: cluster=15382(0x3c16), pos=507174
FAT: cluster=16151(0x3f17), pos=531782
FAT: cluster=16920(0x4218), pos=556390
FAT: cluster=17689(0x4519), pos=580998
FAT: cluster=18458(0x481a), pos=605606
FAT: cluster=19227(0x4b1b), pos=630214
FAT: cluster=19996(0x4e1c), pos=654822
FAT: cluster=20765(0x511d), pos=679430
FAT: cluster=21534(0x541e), pos=704038
FAT: cluster=22303(0x571f), pos=728646
FAT: cluster=23072(0x5a20), pos=753254
FAT: cluster=23841(0x5d21), pos=777862
FAT: cluster=24610(0x6022), pos=802470
FAT: cluster=25379(0x6323), pos=827078
FAT: cluster=26148(0x6624), pos=851686
FAT: cluster=26917(0x6925), pos=876294
FAT: cluster=27686(0x6c26), pos=900902
FAT: cluster=28455(0x6f27), pos=925510
FAT: cluster=29224(0x7228), pos=950118
FAT: cluster=29993(0x7529), pos=974726
FAT: cluster=30762(0x782a), pos=999334
FAT: cluster=31531(0x7b2b), pos=1023942
FAT: cluster=32300(0x7e2c), pos=1048550
FAT: cluster=33069(0x812d), pos=1073158
FAT: cluster=33838(0x842e), pos=1097766
FAT: cluster=34607(0x872f), pos=1122374
FAT: cluster=35376(0x8a30), pos=1146982
FAT: cluster=36145(0x8d31), pos=1171590
FAT: cluster=36914(0x9032), pos=1196198
FAT: cluster=37683(0x9333), pos=1220806
FAT: cluster=38452(0x9634), pos=1245414
     FAT32 LBA                     38   30660613   30660576 [NO NAME]
     FAT32, blocksize=16384, 15 GB / 14 GiB
This partition ends after the disk limits. (start=38, size=30660576, end=30660613, disk end=30660608)
BAD_RS LBA=1286397454 277
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            1286397454 4388646105 3102248652
This partition ends after the disk limits. (start=1286397454, size=3102248652, end=4388646105, disk end=30660608)
BAD_RS LBA=1308096031 907
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            1308096031 3377048781 2068952751
This partition ends after the disk limits. (start=1308096031, size=2068952751, end=3377048781, disk end=30660608)
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (15 GB / 14 GiB) seems too small! (< 2246 GB / 2092 GiB)
The following partitions can't be recovered:
     FAT32 LBA                     38   30660613   30660576 [NO NAME]
     FAT32, blocksize=16384, 15 GB / 14 GiB
     FAT16 >32M            1286397454 4388646105 3102248652
     FAT16 >32M            1308096031 3377048781 2068952751
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)
SIGHUP detected! TestDisk has been killed.  

hollinew
Posts: 3
Joined: 07 Apr 2018, 22:07

Re: File partition recovery

#4 Post by hollinew »

@cgrenier

Below is correct log file with Intel table type run.

Code: Select all

 

Sat Apr  7 18:11:38 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, March 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 17.3.0 (Darwin Kernel Version 17.3.0: Thu Nov  9 18:09:22 PST 2017; root:xnu-4570.31.3~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.0
Compilation date: 2018-03-19T20:41:07
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.4
Hard disk list
Disk /dev/disk2 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/rdisk2 - 15 GB / 14 GiB - 30660608 sectors, sector size=512
Disk /dev/rdisk3 - 15 GB / 14 GiB - 30660608 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/disk3 - 15 GB / 14 GiB
Partition table type: None

Interface Advanced
   P Unknown                        0   30660607   30660608
Partition table type (auto): Intel
Disk /dev/disk3 - 15 GB / 14 GiB
Partition table type: Intel

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576
SIGHUP detected! TestDisk has been killed.
r-xr-x     0      0         0 29-Nov-2017 16:06 11-29-2017 AHR Quantifications
X 263337 -rwxr-xr-x     0      0       450 29-Nov-2017 16:07 DATA (D) - Shortcut.lnk
X 263343 drwxr-xr-x     0      0         0  9-Dec-2017 13:18 New folder
X 263343 drwxr-xr-x     0      0         0  9-Dec-2017 13:18 12-9-17 Confocal
X      0 -rwxr-xr-x     0      0         0 21-Dec-2017 06:49 12-20-17 STAT1_Keystone_Abstract.docx
X 524381 -rwxr-xr-x     0      0     19798 21-Dec-2017 06:49 _WRD0000.TMP
  524381 -rwxr-xr-x     0      0     19798 21-Dec-2017 06:49 12-20-17 STAT1_Keystone_Abstract.docx
X 541708 -rwxr-xr-x     0      0    236821  2-Feb-2018 13:32 _WRD1000.TMP
X  47318 -rwxr-xr-x     0      0    196237  2-Feb-2018 07:03 _WRL1203.TMP
X 541708 -rwxr-xr-x     0      0    236821  2-Feb-2018 13:32 2018-AHR 1312018  draft 1 ethan.docx
X 524389 drwxr-xr-x     0      0         0  4-Feb-2018 16:53 New folder
  524389 drwxr-xr-x     0      0         0  4-Feb-2018 16:53 2-4-18 Confocal
X 262238 drwxr-xr-x     0      0         0 13-Feb-2018 11:03 New folder
  262238 drwxr-xr-x     0      0         0 13-Feb-2018 11:03 2-13-2018 Confocal
X 262241 drwxr-xr-x     0      0         0 16-Feb-2018 10:59 New folder
  262241 drwxr-xr-x     0      0         0 16-Feb-2018 10:59 2-16-2018 Confocal
  263320 drwxr-xr-x     0      0         0  5-Mar-2018 13:33 3-5-18 IFNg
X 524396 drwxr-xr-x     0      0         0  6-Mar-2018 15:50 New folder
  524396 drwxr-xr-x     0      0         0  6-Mar-2018 15:50 3-6-18 Confocal
  656318 -rwxr-xr-x     0      0     57168  8-Mar-2018 16:15 Gresham_LOR.PDF
X 656322 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 New folder
X 656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 New folder (2)
X 656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 _
  656323 drwxr-xr-x     0      0         0 12-Mar-2018 15:36 3-12-18 IFNg
X 593362 drwxr-xr-x     0      0         0 19-Mar-2018 11:44 New folder (2)
  593362 drwxr-xr-x     0      0         0 19-Mar-2018 11:44 3-19-18 IFNg
X 263322 drwxr-xr-x     0      0         0 20-Mar-2018 13:04 New folder
  263322 drwxr-xr-x     0      0         0 20-Mar-2018 13:04 3-20-18 Confocal

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]

search_part()
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
FAT32 at 32/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 32/0/1
FAT: cluster=2(0x2), pos=15008
FAT: cluster=53610(0xd16a), pos=1730464
FAT: cluster=190903(0x2e9b7), pos=6123840
FAT: cluster=47031(0xb7b7), pos=1519936
FAT: cluster=204545(0x31f01), pos=6560384
     FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB
FAT32 at 38/0/1
FAT1 : 12-7493
FAT2 : 7494-14975
start_rootdir : 14976 root cluster : 2
Data : 14976-30660575
sectors : 30660576
cluster_size : 32
no_of_cluster : 957675 (2 - 957676)
fat_length 7482 calculated 7482
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 38/0/1
FAT: cluster=2(0x2), pos=15014
FAT: cluster=771(0x303), pos=39622
FAT: cluster=1540(0x604), pos=64230
FAT: cluster=2309(0x905), pos=88838
FAT: cluster=3078(0xc06), pos=113446
FAT: cluster=3847(0xf07), pos=138054
FAT: cluster=4616(0x1208), pos=162662
FAT: cluster=5385(0x1509), pos=187270
FAT: cluster=6154(0x180a), pos=211878
FAT: cluster=6923(0x1b0b), pos=236486
FAT: cluster=7692(0x1e0c), pos=261094
FAT: cluster=8461(0x210d), pos=285702
FAT: cluster=9230(0x240e), pos=310310
FAT: cluster=9999(0x270f), pos=334918
FAT: cluster=10768(0x2a10), pos=359526
FAT: cluster=11537(0x2d11), pos=384134
FAT: cluster=12306(0x3012), pos=408742
FAT: cluster=13075(0x3313), pos=433350
FAT: cluster=13844(0x3614), pos=457958
FAT: cluster=14613(0x3915), pos=482566
FAT: cluster=15382(0x3c16), pos=507174
FAT: cluster=16151(0x3f17), pos=531782
FAT: cluster=16920(0x4218), pos=556390
FAT: cluster=17689(0x4519), pos=580998
FAT: cluster=18458(0x481a), pos=605606
FAT: cluster=19227(0x4b1b), pos=630214
FAT: cluster=19996(0x4e1c), pos=654822
FAT: cluster=20765(0x511d), pos=679430
FAT: cluster=21534(0x541e), pos=704038
FAT: cluster=22303(0x571f), pos=728646
FAT: cluster=23072(0x5a20), pos=753254
FAT: cluster=23841(0x5d21), pos=777862
FAT: cluster=24610(0x6022), pos=802470
FAT: cluster=25379(0x6323), pos=827078
FAT: cluster=26148(0x6624), pos=851686
FAT: cluster=26917(0x6925), pos=876294
FAT: cluster=27686(0x6c26), pos=900902
FAT: cluster=28455(0x6f27), pos=925510
FAT: cluster=29224(0x7228), pos=950118
FAT: cluster=29993(0x7529), pos=974726
FAT: cluster=30762(0x782a), pos=999334
FAT: cluster=31531(0x7b2b), pos=1023942
FAT: cluster=32300(0x7e2c), pos=1048550
FAT: cluster=33069(0x812d), pos=1073158
FAT: cluster=33838(0x842e), pos=1097766
FAT: cluster=34607(0x872f), pos=1122374
FAT: cluster=35376(0x8a30), pos=1146982
FAT: cluster=36145(0x8d31), pos=1171590
FAT: cluster=36914(0x9032), pos=1196198
FAT: cluster=37683(0x9333), pos=1220806
FAT: cluster=38452(0x9634), pos=1245414
     FAT32 LBA                     38   30660613   30660576 [NO NAME]
     FAT32, blocksize=16384, 15 GB / 14 GiB
This partition ends after the disk limits. (start=38, size=30660576, end=30660613, disk end=30660608)
BAD_RS LBA=1286397454 277
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            1286397454 4388646105 3102248652
This partition ends after the disk limits. (start=1286397454, size=3102248652, end=4388646105, disk end=30660608)
BAD_RS LBA=1308096031 907
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            1308096031 3377048781 2068952751
This partition ends after the disk limits. (start=1308096031, size=2068952751, end=3377048781, disk end=30660608)
Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (15 GB / 14 GiB) seems too small! (< 2246 GB / 2092 GiB)
The following partitions can't be recovered:
     FAT32 LBA                     38   30660613   30660576 [NO NAME]
     FAT32, blocksize=16384, 15 GB / 14 GiB
     FAT16 >32M            1286397454 4388646105 3102248652
     FAT16 >32M            1308096031 3377048781 2068952751
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                     32   30660607   30660576 [EWH]
     FAT32, blocksize=16384, 15 GB / 14 GiB

interface_write()
 1 * FAT32 LBA                     32   30660607   30660576 [EWH]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 * HFS                            1   30660576   30660576

Analyse Disk /dev/disk3 - 15 GB / 14 GiB - 30660608 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 failed for partition type AF
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
No HFS or HFS+ structure
 1 * HFS                            1   30660576   30660576
 1 * HFS                            1   30660576   30660576

Warning: Bad starting sector (CHS and LBA don't match)
SIGHUP detected! TestDisk has been killed.  

Locked