Disk structure - bad back up boot sector
Posted: 16 Jul 2013, 19:01
Working on last drive = 750 GB
1. Wasn't sure of CHS 254 vs 255. Went with 255 and did Deep Search earlier (4 hrs) for 750 GB HDD.
2. Bad Backup Boot Sector - cant fix this. Any help welcome. Thank you.
Tue Jul 16 13:30:49 2013
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, May 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-06-24T18:54:26
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=300090728448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=300090728448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=32547432960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=469869085184
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=467549553152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=30063398400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=105662882304
filewin32_getfilesize(\\.\M:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\M:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=194426233344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=750161954304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=750153729024
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00AAKB-00H8A, FW:05.0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00AAKB-00H8A, FW:05.0
Disk /dev/sdc - 300 GB / 279 GiB - CHS 38764 240 63, sector size=512 - Maxtor 6L300R0, S/N:364C523158444853, FW:BAJ41G20
Disk /dev/sdd - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Maxtor OneTouch, S/N:02b9100028cf4011, FW:0121
Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Maxtor OneTouch, S/N:02b9100001364211, FW:0121
Partition table type (auto): Intel
Disk /dev/sde - 750 GB / 698 GiB - Maxtor OneTouch
Partition table type: Intel
Analyse Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
file_pread(8,4096,buffer,79(0/1/17)) ReadFile Data error (cyclic redundancy check).
file_pread(8,1,buffer,3789(0/60/10)) ReadFile Data error (cyclic redundancy check).
NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
search_part()
Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/1/1
filesystem size 1465160067
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(8,4095,buffer,80(0/1/18)) ReadFile Data error (cyclic redundancy check).
file_pread(8,1,buffer,3789(0/60/10)) ReadFile Data error (cyclic redundancy check).
NTFS: Can't read MFT
HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
file_pread(8,4096,buffer,79(0/1/17)) ReadFile Data error (cyclic redundancy check).
file_pread(8,1,buffer,3789(0/60/10)) ReadFile Data error (cyclic redundancy check).
NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
NTFS at 0/1/1
file_pread(8,1,buffer,1465160129(91201/254/63)) lseek err Invalid argument
filesystem size 1465160067 1
sectors_per_cluster 8 0
mft_lcn 2 0
mftmirr_lcn 48 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 2
ntfs_find_mft: mftmirr_lcn 48
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 2
ntfs_find_mft: mftmirr_lcn 48
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 1465160067
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
NTFS at 0/1/1
filesystem size 1465160067 1
sectors_per_cluster 8 0
mft_lcn 2 0
mftmirr_lcn 48 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.
1. Wasn't sure of CHS 254 vs 255. Went with 255 and did Deep Search earlier (4 hrs) for 750 GB HDD.
2. Bad Backup Boot Sector - cant fix this. Any help welcome. Thank you.
Tue Jul 16 13:30:49 2013
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, May 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-06-24T18:54:26
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=300090728448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=300090728448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=32547432960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=469869085184
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=467549553152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=30063398400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=105662882304
filewin32_getfilesize(\\.\M:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\M:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=194426233344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=750161954304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=750153729024
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00AAKB-00H8A, FW:05.0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD50 00AAKB-00H8A, FW:05.0
Disk /dev/sdc - 300 GB / 279 GiB - CHS 38764 240 63, sector size=512 - Maxtor 6L300R0, S/N:364C523158444853, FW:BAJ41G20
Disk /dev/sdd - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Maxtor OneTouch, S/N:02b9100028cf4011, FW:0121
Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Maxtor OneTouch, S/N:02b9100001364211, FW:0121
Partition table type (auto): Intel
Disk /dev/sde - 750 GB / 698 GiB - Maxtor OneTouch
Partition table type: Intel
Analyse Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
file_pread(8,4096,buffer,79(0/1/17)) ReadFile Data error (cyclic redundancy check).
file_pread(8,1,buffer,3789(0/60/10)) ReadFile Data error (cyclic redundancy check).
NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
search_part()
Disk /dev/sde - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/1/1
filesystem size 1465160067
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(8,4095,buffer,80(0/1/18)) ReadFile Data error (cyclic redundancy check).
file_pread(8,1,buffer,3789(0/60/10)) ReadFile Data error (cyclic redundancy check).
NTFS: Can't read MFT
HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
file_pread(8,4096,buffer,79(0/1/17)) ReadFile Data error (cyclic redundancy check).
file_pread(8,1,buffer,3789(0/60/10)) ReadFile Data error (cyclic redundancy check).
NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
NTFS at 0/1/1
file_pread(8,1,buffer,1465160129(91201/254/63)) lseek err Invalid argument
filesystem size 1465160067 1
sectors_per_cluster 8 0
mft_lcn 2 0
mftmirr_lcn 48 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 2
ntfs_find_mft: mftmirr_lcn 48
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 2
ntfs_find_mft: mftmirr_lcn 48
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 1465160067
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 91201 254 63 1465160067
NTFS, blocksize=4096, 750 GB / 698 GiB
NTFS at 0/1/1
filesystem size 1465160067 1
sectors_per_cluster 8 0
mft_lcn 2 0
mftmirr_lcn 48 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.