Can see files from one partition but not the other
Posted: 30 Mar 2016, 08:53
Hello,
I have a 1tb WD Blue that was split into two partitions (Win 7 on one, data on the other) both in NTFS. The drive died and I'm trying to recover what I can. Using TestDisk, I was able to view and copy some files from the smaller OS partition but not the data partition. I get the error "Filesystem seems damaged". I also can't repair the MFT or NTFS BS, those details are in the log.
Other info: I'm using Pmagic 32 with default, RAM-loaded settings. I haven't have better luck running in LIVE mode. The HDD is in the laptop I'm using, attached via SATA.
If I can easily files from one, shouldn't I be able to get files from the other?
LOG:
Wed Mar 30 00:44:45 2016
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.3.2-pmagic (#1 SMP Fri Dec 11 11:01:04 CST 2015) i686
Compiler: GCC 4.9
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: 20140608, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10JPVT-22A1YT0, S/N:WD-WX31A23H7280, FW:01.01A01
Disk /dev/sdb - 15 GB / 14 GiB - CHS 14907 64 32, sector size=512 - SanDisk Cruzer Switch
Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10JPVT-22A1YT0
Partition table type: Intel
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 12748/53/42
file_pread(4,1023,buffer,211094529(13140/6/52)) read err: Input/output error
NTFS: Can't read MFT
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 204593152
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,1024,buffer,211094528(13140/6/51)) read err: Input/output error
file_pread(4,1,buffer,211094528(13140/6/51)) read err: Input/output error
NTFS: Can't read MFT
HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sda 2048" | dmsetup create test0
echo "0 204593152 linear /dev/sda 206848" | dmsetup create test1
echo "0 1748721664 linear /dev/sda 204800000" | dmsetup create test2
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 12748/53/42
file_pread(4,1024,buffer,211094528(13140/6/51)) read err: Input/output error
file_pread(4,1,buffer,211094528(13140/6/51)) read err: Input/output error
NTFS: Can't read MFT
1 * HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,16,buffer,211091456(13139/213/3)) read err: Input/output error
file_pread(4,1,buffer,211091456(13139/213/3)) read err: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,1,buffer,211091457(13139/213/4)) read err: Input/output error
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
file_pread(4,16,buffer,211091466(13139/213/13)) read err: Input/output error
file_pread(4,1,buffer,211091466(13139/213/13)) read err: Input/output error
NTFS Can't read "root directory" in MFT
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 12748/53/42
file_pread(4,1023,buffer,211094529(13140/6/52)) read err: Input/output error
NTFS: Can't read MFT
file_pread(4,4094,buffer,211091458(13139/213/5)) read err: Input/output error
Can't read NTFS MFT.
Can't read NTFS MFT.
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Can't open filesystem. Filesystem seems damaged.
TestDisk exited normally.
I have a 1tb WD Blue that was split into two partitions (Win 7 on one, data on the other) both in NTFS. The drive died and I'm trying to recover what I can. Using TestDisk, I was able to view and copy some files from the smaller OS partition but not the data partition. I get the error "Filesystem seems damaged". I also can't repair the MFT or NTFS BS, those details are in the log.
Other info: I'm using Pmagic 32 with default, RAM-loaded settings. I haven't have better luck running in LIVE mode. The HDD is in the laptop I'm using, attached via SATA.
If I can easily files from one, shouldn't I be able to get files from the other?
LOG:
Wed Mar 30 00:44:45 2016
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.3.2-pmagic (#1 SMP Fri Dec 11 11:01:04 CST 2015) i686
Compiler: GCC 4.9
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: 20140608, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10JPVT-22A1YT0, S/N:WD-WX31A23H7280, FW:01.01A01
Disk /dev/sdb - 15 GB / 14 GiB - CHS 14907 64 32, sector size=512 - SanDisk Cruzer Switch
Partition table type (auto): Intel
Disk /dev/sda - 1000 GB / 931 GiB - WDC WD10JPVT-22A1YT0
Partition table type: Intel
Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 12748/53/42
file_pread(4,1023,buffer,211094529(13140/6/52)) read err: Input/output error
NTFS: Can't read MFT
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 204593152
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,1024,buffer,211094528(13140/6/51)) read err: Input/output error
file_pread(4,1,buffer,211094528(13140/6/51)) read err: Input/output error
NTFS: Can't read MFT
HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 204800 linear /dev/sda 2048" | dmsetup create test0
echo "0 204593152 linear /dev/sda 206848" | dmsetup create test1
echo "0 1748721664 linear /dev/sda 204800000" | dmsetup create test2
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
NTFS at 12748/53/42
file_pread(4,1024,buffer,211094528(13140/6/51)) read err: Input/output error
file_pread(4,1,buffer,211094528(13140/6/51)) read err: Input/output error
NTFS: Can't read MFT
1 * HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 12 223 20 12748 53 41 204593152
NTFS, blocksize=4096, 104 GB / 97 GiB
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,16,buffer,211091456(13139/213/3)) read err: Input/output error
file_pread(4,1,buffer,211091456(13139/213/3)) read err: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
file_pread(4,1,buffer,211091457(13139/213/4)) read err: Input/output error
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
file_pread(4,16,buffer,211091466(13139/213/13)) read err: Input/output error
file_pread(4,1,buffer,211091466(13139/213/13)) read err: Input/output error
NTFS Can't read "root directory" in MFT
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 12748/53/42
file_pread(4,1023,buffer,211094529(13140/6/52)) read err: Input/output error
NTFS: Can't read MFT
file_pread(4,4094,buffer,211091458(13139/213/5)) read err: Input/output error
Can't read NTFS MFT.
Can't read NTFS MFT.
ntfs_boot_sector
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
NTFS at 12748/53/42
NTFS at 12748/53/42
filesystem size 1748721664
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
Error reading $MFT: Input/output error
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
3 P HPFS - NTFS 12748 53 42 121601 25 24 1748721664
NTFS, blocksize=4096, 895 GB / 833 GiB
Can't open filesystem. Filesystem seems damaged.
TestDisk exited normally.