cgsecurity.org

I feel like my log file is telling me useful information that could help me fix the filesystem of a lost partition that I am trying to recover, but I need help analyzing what the log file is saying.

I can read the files of this partition:
HPFS - NTFS 5100 0 1 10010 254 63 78895215

but this is the partition I am trying to recover:
HPFS - NTFS 2550 0 1 5099 254 63 40965750

I would love to figure out how to understand the log files, but I don't know where to begin. Any information that would lead me in the right direction would be appreciated.


Sat May 10 10:37:10 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Jul 30 2013 14:09:04
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=82348277760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=626112069632
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=82351471104
Hard disk list
Disk \\.\PhysicalDrive0 - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 82 GB / 76 GiB - CHS 10011 255 63, sector size=512
Drive C: - 626 GB / 583 GiB - CHS 76120 255 63, sector size=512
Drive E: - 82 GB / 76 GiB - CHS 10011 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 82 GB / 76 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 82 GB / 76 GiB - CHS 10011 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
Info: size boot_sector 160831031, partition 160842717
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P HPFS - NTFS 0 1 1 10011 254 63 160842717
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 82 GB / 76 GiB - CHS 10011 255 63
NTFS at 0/1/1
filesystem size 160831031
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 10011 69 32 160831031
NTFS, blocksize=4096, 82 GB / 76 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
* HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 10011 254 63 160842717
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk \\.\PhysicalDrive1 - 82 GB / 76 GiB - CHS 10011 255 63
NTFS at 0/1/1
filesystem size 160831031
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 10011 69 32 160831031
NTFS, blocksize=4096, 82 GB / 76 GiB
NTFS at 5099/254/63
filesystem size 40965750
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 2560359
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2550 0 1 5099 254 63 40965750
NTFS found using backup sector, blocksize=4096, 20 GB / 19 GiB
NTFS at 5100/0/1
filesystem size 78895215
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4930950
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5100 0 1 10010 254 63 78895215
NTFS, blocksize=4096, 40 GB / 37 GiB
NTFS at 10010/254/63
filesystem size 78895215
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4930950
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 5100 0 1 10010 254 63 78895215
NTFS found using backup sector, blocksize=4096, 40 GB / 37 GiB
NTFS at 10010/254/63
filesystem size 78895215
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4930950
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 10010 254 63 14921 254 62 78895215
NTFS, blocksize=4096, 40 GB / 37 GiB
This partition ends after the disk limits. (start=160826714, size=78895215, end=239721928, disk end=160836480)
Disk \\.\PhysicalDrive1 - 82 GB / 76 GiB - CHS 10011 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (82 GB / 76 GiB) seems too small! (< 122 GB / 114 GiB)
The following partition can't be recovered:
HPFS - NTFS 10010 254 63 14921 254 62 78895215
NTFS, blocksize=4096, 40 GB / 37 GiB
get_geometry_from_list_part_aux head=255 nbr=5
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=5

Results
HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
HPFS - NTFS 2550 0 1 5099 254 63 40965750
NTFS found using backup sector, blocksize=4096, 20 GB / 19 GiB
HPFS - NTFS 5100 0 1 10010 254 63 78895215
NTFS, blocksize=4096, 40 GB / 37 GiB
Not an exFAT boot sector.

HPFS - NTFS 2550 0 1 5099 254 63 40965750
NTFS found using backup sector, blocksize=4096, 20 GB / 19 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
HPFS - NTFS 5100 0 1 10010 254 63 78895215
NTFS, blocksize=4096, 40 GB / 37 GiB
Directory /
5 dr-xr-xr-x 0 0 0 27-Mar-2013 15:35 .
5 dr-xr-xr-x 0 0 0 27-Mar-2013 15:35 ..
5741 dr-xr-xr-x 0 0 0 27-Mar-2013 15:35 $RECYCLE.BIN
2724 dr-xr-xr-x 0 0 0 17-Jan-2010 01:07 .TemporaryItems
4870 dr-xr-xr-x 0 0 0 28-Dec-2010 11:32 72df113822fd13b6e3ca73
733 dr-xr-xr-x 0 0 0 26-May-2011 15:13 Music
3524 dr-xr-xr-x 0 0 0 17-Jan-2010 00:57 My Pictures
349 dr-xr-xr-x 0 0 0 21-Mar-2013 20:05 RECYCLER
27 dr-xr-xr-x 0 0 0 21-Mar-2013 20:05 System Volume Information
3902 dr-xr-xr-x 0 0 0 9-Apr-2012 12:02 Xperia
2353 dr-xr-xr-x 0 0 0 4-Jan-2012 15:29 finepix
4703 dr-xr-xr-x 0 0 0 19-Dec-2009 10:02 ziprar
2725 -r-$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
-r--r-- 0 0 4096 17-Jan-2010 01:07 ._.TemporaryItems
Not an exFAT boot sector.

HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
Info: size boot_sector 160831031, partition 160842717
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 P HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
Not an exFAT boot sector.

1 P HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

1 P HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
NTFS at 0/1/1
Info: size boot_sector 160831031, partition 160842717
filesystem size 160831031 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

1 P HPFS - NTFS 0 1 1 10011 254 63 160842717
NTFS, blocksize=4096, 82 GB / 76 GiB
Can't open filesystem. Filesystem seems damaged.

Using TestDisk, you can recover this lost partition. Use the arrow keys to switch the partitions to recover to P(rimary) or L(ogical). But as the filesystem is very damaged, you will have to try other data recovery utilities or use PhotoRec to recover your data from this partition.