I have went through the process of analysing, searching and writing a partition (with my files listed inside) but it is still showing as RAW and i'm kinda stucked with the sector size error:
Also, not entirely sure if it's correct to use EFI GPT! should I be using Intel instead?
Code: Select all
Tue Sep 25 01:43:21 2018
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999626375168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=240054697984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4000650887168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=5000845590528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=3000589352960
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 860 EVO 1TB, S/N:S3Z9NB0K612711X, FW:RVT01B6Q
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WDC WD40EFRX-68WT0N0, S/N:WD-WMC4E0010003, FW:80.00A80
Disk /dev/sdc - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - INTEL SSDSC2BW240A4, S/N:BTDA333507F32403GN, FW:DC32
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00MMMB0, S/N:WD-WCAWZ1591984, FW:80.00A80
Disk /dev/sde - 5000 GB / 4657 GiB - CHS 608001 255 63, sector size=512 - Seagate BUP BK, S/N:NA9FLQJ0, FW:0304
Partition table type (auto): EFI GPT
Disk /dev/sdd - 3000 GB / 2794 GiB - WDC WD30EZRX-00MMMB0
Partition table type: EFI GPT
Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
1 P MS Data 2048 5860528127 5860526080 [DRAMA]
search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732565760
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 366282879
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=3000589352960, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732565760
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 366282879
clusters_per_mft_record 1
clusters_per_index_record 1
MS Data 2048 5860528127 5860526080 [DRAMA]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(7,1,buffer,1565565872(364801/81/1)) ReadFile Incorrect function.
file_pread(7,1,buffer,1565565873(364801/81/2)) lseek err Invalid argument
file_pread(7,1,buffer,1565565874(364801/81/3)) lseek err Invalid argument
file_pread(7,1,buffer,1565565875(364801/81/4)) lseek err Invalid argument
file_pread(7,1,buffer,1565565876(364801/81/5)) lseek err Invalid argument
file_pread(7,1,buffer,1565565877(364801/81/6)) lseek err Invalid argument
file_pread(7,1,buffer,1565565878(364801/81/7)) lseek err Invalid argument
file_pread(7,1,buffer,1565565879(364801/81/8)) lseek err Invalid argument
file_pread(7,1,buffer,1565565880(364801/81/9)) lseek err Invalid argument
Please help!
Regards,
KC