damaged filesystem (NTFS turned into RAW), error: "the harddisk seems to small"
Posted: 23 Jan 2017, 09:10
Hello,
I‘ve got a problem with my external harddrive. The file system was converted into RAW (from NTFS) and the disk is not accessable anymore – neither from Windows 8.1 nor from Ubuntu 16.04.
It seems to have 2 partitions, but the data should be stored in the second (see image, it‘s the „Datenträger 2“).
I was able to rescue a lot of files with Photorec . But .odt-files seem to be damaged.
I want to give it another try and I was wondering, if I could recover the structure of my data with Teskdisk.
When I start Teskdisk analysis, „no partition is bootable“ is the result.
The quick search is showing 2 partitions, but I was not able to view (and copy) files from the NTFS-partition (message: „file systems seems to be damaged“)
So I continued with a Deeper Search and finally got the message „The harddisk seems too small! Check the harddisk size….“
I got stuck here. Do you have any advice for me? Would be great!
I should add, that after the Deeper Search I could view the files of the NTFS partition in testdisk … a very looooong list. I could copy them to another harddrive. But how shall I continue?
I attach the teskdisk logfile. (I shorted it, since it‘s got thousends of entries saying „Can‘t open Bitmap“ and the list of data that could possibly be recovered)
Thanks a lot!
testdisk logfile
I‘ve got a problem with my external harddrive. The file system was converted into RAW (from NTFS) and the disk is not accessable anymore – neither from Windows 8.1 nor from Ubuntu 16.04.
It seems to have 2 partitions, but the data should be stored in the second (see image, it‘s the „Datenträger 2“).
I was able to rescue a lot of files with Photorec . But .odt-files seem to be damaged.
I want to give it another try and I was wondering, if I could recover the structure of my data with Teskdisk.
When I start Teskdisk analysis, „no partition is bootable“ is the result.
The quick search is showing 2 partitions, but I was not able to view (and copy) files from the NTFS-partition (message: „file systems seems to be damaged“)
So I continued with a Deeper Search and finally got the message „The harddisk seems too small! Check the harddisk size….“
I got stuck here. Do you have any advice for me? Would be great!
I should add, that after the Deeper Search I could view the files of the NTFS partition in testdisk … a very looooong list. I could copy them to another harddrive. But how shall I continue?
I attach the teskdisk logfile. (I shorted it, since it‘s got thousends of entries saying „Can‘t open Bitmap“ and the list of data that could possibly be recovered)
Thanks a lot!
testdisk logfile
Code: Select all
Thu Jan 19 06:51:11 2017
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=160694272000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000096367104
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 160 GB / 149 GiB - CHS 19536 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121588 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: Intel
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EF: no test
NTFS at 12/223/20
Current partition structure:
1 P EFI (FAT-12/16/32) 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 121600 254 63 1953313217
No partition is bootable
Failed to open inode: No such file or directory.
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 0/32/33
FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953313217
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121600 254 63 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Results
* FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem need to be repaired.
dir_partition inode=5
P HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_dir: ntfs_inode_open failed
Directory /
interface_write()
1 * FAT32 0 32 33 12 223 19 204800 [NO NAME]
2 P HPFS - NTFS 12 223 20 121601 25 24 1953314816
Failed to open inode: No such file or directory.
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 0/32/33
FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
FAT32 at 0/32/39
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
FAT differs, FAT sectors=752-768/769
set_FAT_info: name from BS used
FAT32 at 0/32/39
FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953313217
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121600 254 63 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953313217
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121600 254 63 1953313217
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121600/254/63
filesystem size 1953313217
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,1024,buffer,1959814592(121992/208/9)) lseek err Invalid argument
file_pread(5,1,buffer,1959814592(121992/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121600 254 63 243189 31 43 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953520064, size=1953313217, end=3906833280, disk end=1953525164)
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1862 GiB)
The following partition can't be recovered:
HPFS - NTFS 121600 254 63 243189 31 43 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
* FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem need to be repaired.
dir_partition inode=5
P HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_dir: ntfs_inode_open failed
Directory /
interface_write()
1 * FAT32 0 32 33 12 223 19 204800 [NO NAME]
2 P HPFS - NTFS 12 223 20 121601 25 24 1953314816
Failed to open inode: No such file or directory.
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EF: no test
NTFS at 12/223/20
1 P EFI (FAT-12/16/32) 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 121600 254 63 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem need to be repaired.
Couldn't open $Bitmap
Couldn't open $Bitmap
Couldn't open $Bitmap
Couldn't open $Bitmap
Files with potentially recoverable content: 5892
2 P HPFS - NTFS 12 223 20 121600 254 63 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
105917 -r--r--r-- 0 0 544 14-Nov-2016 05:00 $RECYCLE.BIN/S-1-5-21-3954030634-3038621908-518970394-1004/$IMGSRPQ.autosave
59112 -r--r--r-- 0 0 78373 10-May-2015 15:36 +++ TO DOs +++/+++sammelsurium/akademie-der-kuenste_volo_2015-05-31/Volontariat_POE_3.PDF
59112 -r--r--r-- 0 0 26 10-May-2015 15:36 +++ TO DOs +++/+++sammelsurium/akademie-der-kuenste_volo_2015-05-31/Volontariat_POE_3.PDF:Zone.Identifier
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type EF: no test
NTFS at 12/223/20
Current partition structure:
1 P EFI (FAT-12/16/32) 0 32 33 12 223 19 204800
2 P HPFS - NTFS 12 223 20 121600 254 63 1953313217
No partition is bootable
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 0/32/33
FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 1953313217
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 121600 254 63 1953313217
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Results
* FAT32 0 32 33 12 223 19 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 121601 25 24 1953314816
NTFS, blocksize=4096, 1000 GB / 931 GiB
interface_write()
1 * FAT32 0 32 33 12 223 19 204800 [NO NAME]
2 P HPFS - NTFS 12 223 20 121601 25 24 1953314816
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.