I will try to state my story and the essence of the problem as briefly as possible so that in the future this topic will help people solve their difficulties. I am from Russia and I use google translator, so if something is unclear ask, and I will clarify. Good? Then I will continue:
Last week I installed bad Windows updates, after that the system broke down and stopped loading, Windows was encrypted by Truecrypt, then I had to permanently decrypt the partition. Everything went well, removed the encryption from Windows, recovered the information. Then I started formatting the 1st partition of the disk and lost the MBR partition table ... At this moment I copied information from one disk to another, I opened GPATED and saw that the entire hard drive was displayed as one unit - unallocated partition ... then my computer hung and the mouse did not move on the screen, and I had to reboot. After began "Dancing with a tambourine" ...
Installed systems before failure:
- Windows - encrypted by TRUECRYPT
Ubuntu - encrypted by LUKS
Then I ran TESTDISK several times in two modes:dev / sda - 500 GB / 465 GiB - CHS 60801 255 63:
dev / sda1 - 100g - Windows 10 (already decrypted partition)
dev / sda2 - 200g - Truecrypt cryptocontainer
dev / sda3 - 165g - LUKS cryptocontainer, and inside it:
- dev / sda 4 LVM section
- dev / sda 5 SWAP
- dev / sda 6 ROOT
The / boot partition is located on a removable USB flash drive - / dev / sdb1.
1. INTEL PARTITION / DEEPSEARCH
I conducted a search in INTEL several times: the first time I did not write logs, but I recorded a partition table. Then I came back spent again DEEPSEARCH and recorded the log.
Code: Select all
Tue Oct 2 21:00:52 2018
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-38-generic (#42~16.04.1-Ubuntu SMP Tue Oct 10 16:32:20 UTC 2017) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPCX-00VHAT0, S/N:WD-WXV1A97NKFTV, FW:01.01A01
Disk /dev/sdb - 30 GB / 28 GiB - CHS 29327 64 32, sector size=512 - SanDisk Ultra USB 3.0, FW:1.00
Disk /dev/sdd - 31 GB / 28 GiB - CHS 29568 64 32, sector size=512, FW:PMAP
Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000LPCX-00VHAT0
Partition table type: Intel
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 83
check_part_i386 failed for partition type 07
Current partition structure:
1 * HPFS - NTFS 0 32 33 13498 15 21 216844288
Invalid NTFS or EXFAT boot
2 P HPFS - NTFS 13498 47 54 28067 89 54 234053632
2 P HPFS - NTFS 13498 47 54 28067 89 54 234053632
No ext2, JFS, Reiser, cramfs or XFS marker
3 P Linux 28067 89 55 49082 198 19 337612807
3 P Linux 28067 89 55 49082 198 19 337612807
Invalid NTFS or EXFAT boot
4 P HPFS - NTFS 49082 198 20 60801 47 46 188256249
4 P HPFS - NTFS 49082 198 20 60801 47 46 188256249
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
BAD_RS LBA=216848384 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 13498 47 54 28067 89 54 234053632
Results
* HPFS - NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
P HPFS - NTFS 13498 47 54 28067 89 54 234053632
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 216844288 linear /dev/sda 2048" | dmsetup create test0
echo "0 234053632 linear /dev/sda 216848384" | dmsetup create test1
interface_write()
1 * HPFS - NTFS 0 32 33 13498 15 21 216844288
2 P HPFS - NTFS 13498 47 54 28067 89 54 234053632
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
NTFS at 13498/15/21
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 13498 15 21 216844288
NTFS found using backup sector, blocksize=4096, 111 GB / 103 GiB
BAD_RS LBA=216848384 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 13498 47 54 28067 89 54 234053632
NTFS at 60801/47/46
filesystem size 188256249
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 39
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 49082 198 20 60801 47 46 188256249
NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
Results
* HPFS - NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
P HPFS - NTFS 13498 47 54 28067 89 54 234053632
P HPFS - NTFS 49082 198 20 60801 47 46 188256249
NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 216844288 linear /dev/sda 2048" | dmsetup create test0
echo "0 234053632 linear /dev/sda 216848384" | dmsetup create test1
echo "0 188256249 linear /dev/sda 788514823" | dmsetup create test2
interface_write()
1 * HPFS - NTFS 0 32 33 13498 15 21 216844288
2 P HPFS - NTFS 13498 47 54 28067 89 54 234053632
3 P HPFS - NTFS 49082 198 20 60801 47 46 188256249
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New options :
Dump : No
Align partition: Yes
Expert mode : No
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 83
check_part_i386 failed for partition type 07
Current partition structure:
1 * HPFS - NTFS 0 32 33 13498 15 21 216844288
Invalid NTFS or EXFAT boot
2 P HPFS - NTFS 13498 47 54 28067 89 54 234053632
2 P HPFS - NTFS 13498 47 54 28067 89 54 234053632
No ext2, JFS, Reiser, cramfs or XFS marker
3 P Linux 28067 89 55 49082 198 19 337612807
3 P Linux 28067 89 55 49082 198 19 337612807
Invalid NTFS or EXFAT boot
4 P HPFS - NTFS 49082 198 20 60801 47 46 188256249
4 P HPFS - NTFS 49082 198 20 60801 47 46 188256249
Here I recorded logs and found at least some information about the LUKS partition.
Code: Select all
Wed Oct 3 01:34:31 2018
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-38-generic (#42~16.04.1-Ubuntu SMP Tue Oct 10 16:32:20 UTC 2017) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPCX-00VHAT0, S/N:WD-WXV1A97NKFTV, FW:01.01A01
Disk /dev/sdb - 30 GB / 28 GiB - CHS 29327 64 32, sector size=512 - SanDisk Ultra USB 3.0, FW:1.00
Disk /dev/sde - 31 GB / 28 GiB - CHS 29568 64 32, sector size=512, FW:PMAP
Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000LPCX-00VHAT0
Partition table type: None
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
P Unknown 0 0 1 60801 80 63 976773168
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=111024275456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
Search for partition aborted
Results
P NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 216844288 linear /dev/sda 2048" | dmsetup create test0
interface_write()
P NTFS 0 32 33 13498 15 21 216844288
Write isn't available because the partition table type "None" has been selected.
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=111024275456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 32 33 13498 15 21 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
LVM magic value at 188/226/37
NTFS at 1039/16/18
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1038 173 19 1039 16 18 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/16/18
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1039 16 18 1039 114 17 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/114/44
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1039 16 45 1039 114 44 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/114/44
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1039 114 44 1039 212 43 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/212/62
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1039 114 63 1039 212 62 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/212/62
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1039 212 62 1040 55 61 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1040/56/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1039 213 26 1040 56 25 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1040/56/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 1040 56 25 1040 154 24 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1245/156/24
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=10245517312, part_size=111024275456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 1245/156/24
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 1245 156 24 14743 139 12 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
HFS magic value at 1513/109/15
part_size 301989890
HFS 1513 109 15 20311 109 34 301989890 [ÿÿÿâD$]
HFS blocksize=16777216, 154 GB / 144 GiB
HFS magic value at 1513/109/17
FAT12 at 1622/194/37
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 1622/194/37
FAT12 1622 194 37 1622 240 18 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
HFS magic value at 1850/147/6
part_size 1987906052
HFS 1850 147 6 125592 1 25 1987906052 [ ]
HFS blocksize=16777216, 1017 GB / 947 GiB
This partition ends after the disk limits. (start=29729516, size=1987906052, end=2017635567, disk end=976773168)
HFS magic value at 1850/147/8
FAT12 at 2047/131/5
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 2047/131/5
FAT12 2047 131 5 2047 176 49 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 2055/15/57
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 2054 172 58 2055 15 57 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 2055/15/57
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 2055 15 57 2055 113 56 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 2064/242/27
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-8222
FAT2 : 8223-16413
start_rootdir : 16414 root cluster : 2
Data : 16414-67108829
sectors : 67108860
cluster_size : 64
no_of_cluster : 1048319 (2 - 1048320)
fat_length 8191 calculated 8191
FAT differs, FAT sectors=0-16/8191
set_FAT_info: name from BS used
FAT32 at 2064/242/27
FAT32 2064 242 27 6242 72 26 67108860 [NO NAME]
FAT32, blocksize=32768, 34 GB / 31 GiB
FAT32 at 2064/242/29
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-8222
FAT2 : 8223-16413
start_rootdir : 16414 root cluster : 2
Data : 16414-67108829
sectors : 67108860
cluster_size : 64
no_of_cluster : 1048319 (2 - 1048320)
fat_length 8191 calculated 8191
FAT differs, FAT sectors=0-16/8191
set_FAT_info: name from BS used
FAT32 at 2064/242/29
FAT32 2064 242 29 6242 72 28 67108860 [NO NAME]
FAT32, blocksize=32768, 34 GB / 31 GiB
recover_EXT2: s_block_group_nr=0/2, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
ext3 2675 130 32 2708 37 33 524288
ext3 blocksize=4096 Large_file Sparse_SB Recover, 268 MB / 256 MiB
recover_EXT2: s_block_group_nr=0/40, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 2675 132 34 3328 58 10 10485760
ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB
recover_EXT2: s_block_group_nr=0/40, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 2678 130 61 3331 56 37 10485760
ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB
recover_EXT2: s_block_group_nr=0/40, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 2678 132 55 3331 58 31 10485760
ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB
HFS magic value at 3574/90/9
part_size 742392066
HFS 3574 90 9 49786 31 11 742392066
HFS blocksize=16777216, 380 GB / 354 GiB
HFS magic value at 3574/90/11
HFS magic value at 3574/94/48
part_size 742392066
HFS 3574 94 48 49786 35 50 742392066
HFS blocksize=16777216, 380 GB / 354 GiB
HFS magic value at 3574/94/50
HFS magic value at 3574/96/31
part_size 742392066
HFS 3574 96 31 49786 37 33 742392066
HFS blocksize=16777216, 380 GB / 354 GiB
HFS magic value at 3574/96/33
HFS magic value at 3574/101/1
part_size 742392066
HFS 3574 101 1 49786 42 3 742392066
HFS blocksize=16777216, 380 GB / 354 GiB
HFS magic value at 3574/101/3
HFS magic value at 3574/102/33
part_size 742392066
HFS 3574 102 33 49786 43 35 742392066
HFS blocksize=16777216, 380 GB / 354 GiB
HFS magic value at 3574/102/35
recover_EXT2: s_block_group_nr=0/2, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
ext3 3600 68 61 3632 230 62 524288
ext3 blocksize=4096 Large_file Sparse_SB, 268 MB / 256 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/2, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
ext3 3583 251 3 3616 158 4 524288
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 268 MB / 256 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/2, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
ext3 3583 251 5 3616 158 6 524288
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 268 MB / 256 MiB
recover_EXT2: s_block_group_nr=0/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3600 81 10 4253 6 49 10485760
ext3 blocksize=4096 Large_file Sparse_SB, 5368 MB / 5120 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3584 142 21 4237 67 60 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3584 142 23 4237 67 62 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3551 241 25 4204 167 1 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3551 241 27 4204 167 3 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 5
recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3519 85 29 4172 11 5 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 5
recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3519 85 31 4172 11 7 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 7
recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3486 184 33 4139 110 9 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 7
recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3486 184 35 4139 110 11 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 9
recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3454 28 37 4106 209 13 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 9
recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3454 28 39 4106 209 15 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 25
recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3193 41 55 3845 222 31 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 25
recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3193 41 57 3845 222 33 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 27
recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3160 140 59 3813 66 35 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
block_group_nr 27
recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
ext3 3160 140 61 3813 66 37 10485760
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB
recover_EXT2: s_block_group_nr=0/0, s_mnt_count=0/20, s_blocks_per_group=4352, s_inodes_per_group=16
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 4347
recover_EXT2: part_size 8694
ext2 5851 136 14 5852 19 13 8694
ext2 blocksize=1024, 4451 KB / 4347 KiB
recover_EXT2: s_block_group_nr=0/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
ext3 5852 21 18 5917 90 21 1048576
ext3 blocksize=4096 Large_file Sparse_SB, 536 MB / 512 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
ext3 5850 218 23 5916 32 26 1048576
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
ext3 5850 218 25 5916 32 28 1048576
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
ext3 5834 54 3 5899 123 6 1048576
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
ext3 5834 54 5 5899 123 8 1048576
ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB
NTFS at 13498/15/21
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 32 33 13498 15 21 216844288
NTFS found using backup sector, blocksize=4096, 111 GB / 103 GiB
NTFS at 13498/15/21
filesystem size 216844288
sectors_per_cluster 8
mft_lcn 10941717
mftmirr_lcn 13552767
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 13498 15 21 26995 253 9 216844288
NTFS, blocksize=4096, 111 GB / 103 GiB
Linux LUKS 39786 5 12 39786 70 12 4096
LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
NTFS at 49940/24/53
filesystem size 220547072
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 13784191
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 36211 172 43 49940 24 53 220547072
NTFS found using backup sector, blocksize=4096, 112 GB / 105 GiB
NTFS at 49940/24/53
filesystem size 220547072
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 13784191
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 49940 24 53 63668 131 63 220547072
NTFS, blocksize=4096, 112 GB / 105 GiB
This partition ends after the disk limits. (start=802287664, size=220547072, end=1022834735, disk end=976773168)
SYSV4 Marker at 54010/239/62
recover_sysv4
SysV 4 54010 239 62 423971263 237 54 6810230669312 [ÉŸE0]
SysV4, 3486 TB / 3171 TiB
This partition ends after the disk limits. (start=867685768, size=6810230669312, end=6811098355079, disk end=976773168)
NTFS at 60801/47/39
filesystem size 188256249
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 39
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 49082 198 13 60801 47 39 188256249
NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
NTFS at 60801/47/39
filesystem size 188256249
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 39
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
NTFS 60801 47 39 72519 152 2 188256249
NTFS, blocksize=4096, 96 GB / 89 GiB
This partition ends after the disk limits. (start=976771064, size=188256249, end=1165027312, disk end=976773168)
NTFS at 60801/47/46
filesystem size 188256249
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 39
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 49082 198 20 60801 47 46 188256249
NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
NTFS at 60801/47/46
filesystem size 188256249
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 39
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
NTFS 60801 47 46 72519 152 9 188256249
NTFS, blocksize=4096, 96 GB / 89 GiB
This partition ends after the disk limits. (start=976771071, size=188256249, end=1165027319, disk end=976773168)
NTFS at 1039/16/18
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS at 1039/114/44
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS at 1039/212/62
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 3487 TB / 3171 TiB)
The following partitions can't be recovered:
HFS 1850 147 6 125592 1 25 1987906052 [ ]
HFS blocksize=16777216, 1017 GB / 947 GiB
NTFS 49940 24 53 63668 131 63 220547072
NTFS, blocksize=4096, 112 GB / 105 GiB
SysV 4 54010 239 62 423971263 237 54 6810230669312 [ÉŸE0]
SysV4, 3486 TB / 3171 TiB
NTFS 60801 47 39 725
Notes and questions:
1. I tried to find the LUKS header with the help of GREP, that's what happened:
~ $ sudo grep -a -b -P --only-matching 'LUKS \ xba \ xbe' / dev / sda
grep: memory exhausted
What search should I run to find the correct information?
2. In the logs I found the lines, apparently this is the heading LUKS? How do I get it and what to do?
Linux LUKS 39786 5 12 39786 70 12 4096
LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
3. In the logs, I did not find information about the TRUECRYPT section. Its size was 200g before the crash. How to find it?
Thanks!