Code: Select all
Tue Nov 18 23:38:37 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-11-02T16:15:34
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156372992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156372992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=164532060160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=335467773952
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=215821058048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=25037897728
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=104857600
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000BEVT-75A0RT0, S/N:2020202057202d44585731344141303031323635, FW:01.01A01
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - Mass Storage Device
Partition table type (auto): Intel
Disk /dev/sdb - 750 GB / 698 GiB - Mass Storage Device
Partition table type: Intel
Analyse Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Info: size boot_sector 421525497, partition 421525504
NTFS at 88157/48/20
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 26251 159 20 421525504
3 P HPFS - NTFS 88157 48 20 91201 52 51 48902144
search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 421525497
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 26251 159 13 421525497
NTFS, blocksize=4096, 215 GB / 200 GiB
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 88157/48/20
filesystem size 48902144
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 88157 48 20 91201 52 51 48902144
NTFS, blocksize=4096, 25 GB / 23 GiB
Search for partition aborted
Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 26251 159 20 421525504
NTFS, blocksize=4096, 215 GB / 200 GiB
P HPFS - NTFS 88157 48 20 91201 52 51 48902144
NTFS, blocksize=4096, 25 GB / 23 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 26251 159 20 421525504
3 P HPFS - NTFS 88157 48 20 91201 52 51 48902144
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
search_part()
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 421525497
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 26251 159 13 421525497
NTFS, blocksize=4096, 215 GB / 200 GiB
file_pread(5,16,buffer,59912318(3729/94/12)) ReadFile Erreur de données (contrôle de redondance cyclique).
file_pread(5,1,buffer,59912318(3729/94/12)) ReadFile Erreur de données (contrôle de redondance cyclique).
NTFS at 26251/159/20
filesystem size 421525497
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 27 26251 159 20 421525497
NTFS found using backup sector, blocksize=4096, 215 GB / 200 GiB
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 88157/48/19
heads/cylinder 16 (NTFS) != 255 (HD)
filesystem size 994508592
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 26251 227 41 88157 48 19 994508592
NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
NTFS at 88157/48/20
filesystem size 48902144
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 88157 48 20 91201 52 51 48902144
NTFS, blocksize=4096, 25 GB / 23 GiB
NTFS at 91201/52/51
filesystem size 48902144
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 88157 48 20 91201 52 51 48902144
NTFS found using backup sector, blocksize=4096, 25 GB / 23 GiB
file_pread(5,2,buffer,1465149440(91201/85/21)) lseek err Invalid argument
file_pread(5,1,buffer,1465149440(91201/85/21)) lseek err Invalid argument
file_pread(5,2,buffer,1465149452(91201/85/33)) lseek err Invalid argument
file_pread(5,1,buffer,1465149452(91201/85/33)) lseek err Invalid argument
file_pread(5,2,buffer,1465149503(91201/86/21)) lseek err Invalid argument
file_pread(5,1,buffer,1465149503(91201/86/21)) lseek err Invalid argument
file_pread(5,2,buffer,1465149515(91201/86/33)) lseek err Invalid argument
file_pread(5,1,buffer,1465149515(91201/86/33)) lseek err Invalid argument
file_pread(5,8,buffer,1465149184(91201/81/17)) lseek err Invalid argument
file_pread(5,1,buffer,1465149184(91201/81/17)) lseek err Invalid argument
file_pread(5,8,buffer,1465149312(91201/83/19)) lseek err Invalid argument
file_pread(5,1,buffer,1465149439(91201/85/20)) lseek err Invalid argument
file_pread(5,1,buffer,1465149440(91201/85/21)) lseek err Invalid argument
file_pread(5,14,buffer,1465149441(91201/85/22)) lseek err Invalid argument
file_pread(5,3,buffer,1465149455(91201/85/36)) lseek err Invalid argument
file_pread(5,3,buffer,1465149502(91201/86/20)) lseek err Invalid argument
file_pread(5,8,buffer,1465149518(91201/86/36)) lseek err Invalid argument
file_pread(5,11,buffer,1465149565(91201/87/20)) lseek err Invalid argument
file_pread(5,2,buffer,1465151487(91201/117/52)) lseek err Invalid argument
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 12/223/20
filesystem size 421525497
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Results
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
HPFS - NTFS 12 223 20 26251 159 20 421525504
NTFS, blocksize=4096, 215 GB / 200 GiB
* HPFS - NTFS 26251 227 41 88157 48 19 994508592
NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
P HPFS - NTFS 88157 48 20 91201 52 51 48902144
NTFS, blocksize=4096, 25 GB / 23 GiB
dir_partition inode=5
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
Directory /
5 dr-xr-xr-x 0 0 0 14-Nov-2014 12:55 .
5 dr-xr-xr-x 0 0 0 14-Nov-2014 12:55 ..
106 dr-xr-xr-x 0 0 0 17-Nov-2014 13:37 $RECYCLE.BIN
36 dr-xr-xr-x 0 0 0 9-Nov-2014 23:40 BOOT
99 dr-xr-xr-x 0 0 0 18-Nov-2014 13:56 System Volume Information
35 -r--r--r-- 0 0 383786 21-Nov-2010 04:23 bootmgr
Not an exFAT boot sector.
dir_partition inode=5
HPFS - NTFS 12 223 20 26251 159 20 421525504
NTFS, blocksize=4096, 215 GB / 200 GiB
Directory /
5 dr-xr-xr-x 0 0 0 18-Nov-2014 21:20 .
5 dr-xr-xr-x 0 0 0 18-Nov-2014 21:20 ..
35 dr-xr-xr-x 0 0 0 17-Nov-2014 13:37 $Recycle.Bin
15441 dr-xr-xr-x 0 0 0 18-Nov-2014 13:56 Config.Msi
13457 dr-xr-xr-x 0 0 0 14-Jul-2009 06:08 Documents and Settings
44830 dr-xr-xr-x 0 0 0 9-Jan-2012 11:46 Intel
36 dr-xr-xr-x 0 0 0 14-Jul-2009 04:20 PerfLogs
38 dr-xr-xr-x 0 0 0 18-Nov-2014 13:44 Program Files
210 dr-xr-xr-x 0 0 0 18-Nov-2014 13:56 Program Files (x86)
325 dr-xr-xr-x 0 0 0 18-Nov-2014 13:42 ProgramData
21360 dr-xr-xr-x 0 0 0 9-Nov-2014 14:45 Recovery
90213 dr-xr-xr-x 0 0 0 14-Nov-2014 21:10 Riot Games
1580 dr-xr-xr-x 0 0 0 18-Nov-2014 15:04 System Volume Information
422 dr-xr-xr-x 0 0 0 9-Nov-2014 14:46 Users
584 dr-xr-xr-x 0 0 0 9-Nov-2014 14:50 Windows
17 dr-xr-xr-x 0 0 0 17-Nov-2014 21:07 found.000
69393 -r--r--r-- 0 0 2184 9-Jan-2012 11:49 RHDSetup.log
58320 -r--r--r-- 0 0 164 9-Nov-2014 14:49 Setup.log
13761 -r--r--r-- 0 0 4204314624 18-Nov-2014 23:27 hiberfil.sys
17007 -r--r--r-- 0 0 4204314624 18-Nov-2014 23:27 pagefile.sys
Not an exFAT boot sector.
P HPFS - NTFS 26251 227 41 88157 48 19 994508592
NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
Can't open filesystem. Filesystem seems damaged.
dir_partition inode=5
P HPFS - NTFS 88157 48 20 91201 52 51 48902144
NTFS, blocksize=4096, 25 GB / 23 GiB
Directory /
5 dr-xr-xr-x 0 0 0 18-Nov-2014 15:04 .
5 dr-xr-xr-x 0 0 0 18-Nov-2014 15:04 ..
35 dr-xr-xr-x 0 0 0 17-Nov-2014 13:37 $RECYCLE.BIN
51 dr-xr-xr-x 0 0 0 11-Jan-2012 00:25 EFI
13628 dr-xr-xr-x 0 0 0 17-Sep-2014 09:32 Recovery
5206 dr-xr-xr-x 0 0 0 11-Jan-2012 00:56 Restore
5205 dr-xr-xr-x 0 0 0 18-Nov-2014 13:56 System Volume Information
64 dr-xr-xr-x 0 0 0 11-Jan-2012 00:29 SystemSoftware
4745 dr-xr-xr-x 0 0 0 9-Nov-2014 23:29 WinClon
38 dr-xr-xr-x 0 0 0 11-Jan-2012 00:25 boot
62 dr-xr-xr-x 0 0 0 11-Jan-2012 00:25 sources
5199 -r--r--r-- 0 0 0 24-Apr-2007 12:56 WinClon.WCL
50 -r--r--r-- 0 0 383786 19-Nov-2010 20:40 bootmgr
61 -r--r--r-- 0 0 481680 13-Jul-2009 23:10 imagex.exe
5201 -r--r--r-- 0 0 4293007160 11-Jan-2012 00:09 init.w01
5202 -r--r--r-- 0 0 4292989151 11-Jan-2012 00:15 init.w02
5203 -r--r--r-- 0 0 3295781930 11-Jan-2012 00:19 init.w03
5200 -r--r--r-- 0 0 4293002435 11-Jan-2012 00:19 init.wcl
5204 -r--r--r-- 0 0 44 11-Jan-2012 00:19 init.woo
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 26251 159 20 421525504
3 P HPFS - NTFS 26251 227 41 88157 48 19 994508592
4 P HPFS - NTFS 88157 48 20 91201 52 51 48902144
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
3 P HPFS - NTFS 26251 227 41 88157 48 19 994508592
NTFS found using backup sector, blocksize=4096, 509 GB / 474 GiB
NTFS at 26251/227/41
heads/cylinder 16 (NTFS) != 255 (HD)
NTFS at 26251/227/41
heads/cylinder 16 (NTFS) != 255 (HD)
filesystem size 994508592
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Status: OK
Backup boot sector
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.