damaged filesystem (NTFS turned into RAW), error: "the harddisk seems to small"

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
jendo
Posts: 1
Joined: 23 Jan 2017, 08:56

damaged filesystem (NTFS turned into RAW), error: "the harddisk seems to small"

#1 Post by jendo »

Hello,
I‘ve got a problem with my external harddrive. The file system was converted into RAW (from NTFS) and the disk is not accessable anymore – neither from Windows 8.1 nor from Ubuntu 16.04.

It seems to have 2 partitions, but the data should be stored in the second (see image, it‘s the „Datenträger 2“).
disk-management.png
disk-management.png (106.74 KiB) Viewed 2393 times
I was able to rescue a lot of files with Photorec :-). But .odt-files seem to be damaged.
I want to give it another try and I was wondering, if I could recover the structure of my data with Teskdisk.

When I start Teskdisk analysis, „no partition is bootable“ is the result.
analyse.jpg
analyse.jpg (68 KiB) Viewed 2393 times
The quick search is showing 2 partitions, but I was not able to view (and copy) files from the NTFS-partition (message: „file systems seems to be damaged“)
So I continued with a Deeper Search and finally got the message „The harddisk seems too small! Check the harddisk size….“
deeper-search.jpg
deeper-search.jpg (76.36 KiB) Viewed 2393 times
I got stuck here. Do you have any advice for me? Would be great!
I should add, that after the Deeper Search I could view the files of the NTFS partition in testdisk … a very looooong list. I could copy them to another harddrive. But how shall I continue?

I attach the teskdisk logfile. (I shorted it, since it‘s got thousends of entries saying „Can‘t open Bitmap“ and the list of data that could possibly be recovered)
Thanks a lot!


testdisk logfile

Code: Select all


Thu Jan 19 06:51:11 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=160694272000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000096367104
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 160 GB / 149 GiB - CHS 19536 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121588 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EF: no test
NTFS at 12/223/20
Current partition structure:
 1 P EFI (FAT-12/16/32)       0  32 33    12 223 19     204800
 2 P HPFS - NTFS             12 223 20 121600 254 63 1953313217
No partition is bootable
Failed to open inode: No such file or directory.

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 0/32/33
     FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           1953313217
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 121600 254 63 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
   * FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
   P HPFS - NTFS             12 223 20 121601  25 24 1953314816
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem need to be repaired.


dir_partition inode=5
   P HPFS - NTFS             12 223 20 121601  25 24 1953314816
     NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_dir: ntfs_inode_open failed
Directory /

interface_write()
 1 * FAT32                    0  32 33    12 223 19     204800 [NO NAME]
 2 P HPFS - NTFS             12 223 20 121601  25 24 1953314816
Failed to open inode: No such file or directory.

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 0/32/33
     FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
FAT32 at 0/32/39
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
FAT differs, FAT sectors=752-768/769
set_FAT_info: name from BS used

FAT32 at 0/32/39
     FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           1953313217
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 121600 254 63 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size           1953313217
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 121600 254 63 1953313217
     NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size           1953313217
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,1024,buffer,1959814592(121992/208/9)) lseek err Invalid argument
file_pread(5,1,buffer,1959814592(121992/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS          121600 254 63 243189  31 43 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953520064, size=1953313217, end=3906833280, disk end=1953525164)
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1862 GiB)
The following partition can't be recovered:
     HPFS - NTFS          121600 254 63 243189  31 43 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
   * FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
   P HPFS - NTFS             12 223 20 121601  25 24 1953314816
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem need to be repaired.


dir_partition inode=5
   P HPFS - NTFS             12 223 20 121601  25 24 1953314816
     NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_dir: ntfs_inode_open failed
Directory /

interface_write()
 1 * FAT32                    0  32 33    12 223 19     204800 [NO NAME]
 2 P HPFS - NTFS             12 223 20 121601  25 24 1953314816
Failed to open inode: No such file or directory.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EF: no test
NTFS at 12/223/20
 1 P EFI (FAT-12/16/32)       0  32 33    12 223 19     204800
 2 P HPFS - NTFS             12 223 20 121600 254 63 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem need to be repaired.

Couldn't open $Bitmap
Couldn't open $Bitmap
Couldn't open $Bitmap
Couldn't open $Bitmap

Files with potentially recoverable content: 5892
 2 P HPFS - NTFS             12 223 20 121600 254 63 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
  105917 -r--r--r--     0     0       544 14-Nov-2016 05:00 $RECYCLE.BIN/S-1-5-21-3954030634-3038621908-518970394-1004/$IMGSRPQ.autosave
   59112 -r--r--r--     0     0     78373 10-May-2015 15:36 +++ TO DOs +++/+++sammelsurium/akademie-der-kuenste_volo_2015-05-31/Volontariat_POE_3.PDF
   59112 -r--r--r--     0     0        26 10-May-2015 15:36 +++ TO DOs +++/+++sammelsurium/akademie-der-kuenste_volo_2015-05-31/Volontariat_POE_3.PDF:Zone.Identifier
   

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EF: no test
NTFS at 12/223/20
Current partition structure:
 1 P EFI (FAT-12/16/32)       0  32 33    12 223 19     204800
 2 P HPFS - NTFS             12 223 20 121600 254 63 1953313217
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 0/32/33
     FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           1953313217
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 121600 254 63 1953313217
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument

Results
   * FAT32                    0  32 33    12 223 19     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
   P HPFS - NTFS             12 223 20 121601  25 24 1953314816
     NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
 1 * FAT32                    0  32 33    12 223 19     204800 [NO NAME]
 2 P HPFS - NTFS             12 223 20 121601  25 24 1953314816
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: damaged filesystem (NTFS turned into RAW), error: "the harddisk seems to small"

#2 Post by cgrenier »

Read https://www.cgsecurity.org/testdisk.pdf chapter "Repairing filesystem"
- Repairing filesystems from Windows
- TestDisk: Repairing NTFS boot sector

Good luck

Locked