Code: Select all
Wed Apr 11 00:09:54 2018
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, March 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=209986061312
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=104857600
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:xxxxxxxxxxxxxxx, FW:EXT0DB6Q
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1002FAEX-00Z3A0, S/N:xxxxxxxxxxxxxxxx, FW:05.01D05
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD1002FAEX-00Z3A0
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=224 sector=19
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=224 sector=19
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953517568
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121613 183 42 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=206848, size=1953517568, end=1953724415, disk end=1953525168)
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 12 223 20 121613 183 42 1953517568
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]