cgsecurity.org

Code: Select all

Tue Oct 17 22:16:23 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, July 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204885504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=235371757568
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=49336549376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=14684258304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=500105217024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=500106281472
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO, S/N:1SBDSNFA425071 A, FW:EXT0
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - SAMSUNG SSD PM830 mS, S/N:0SMXSNDA019200, FW:CXM1
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - SAMSUNG HD500LJ
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST350063 0AS
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Backup+ BK, S/N:NA540BVA, FW:0836

Partition table type (auto): Intel
Disk /dev/sde - 1000 GB / 931 GiB - Seagate Backup+ BK
Partition table type: Intel

Analyse Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.

search_part()
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953519616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(8,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(8,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(8,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(8,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(8,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(8,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(8,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(8,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(8,6,buffer,1953525762(121601/90/28)) lseek err Invalid argument
file_pread(8,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(8,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(8,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(8,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(8,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(8,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(8,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Not an exFAT boot sector.

   * HPFS - NTFS              0  32 33 121601  25 24 1953519616
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0  32 33 121601  25 24 1953519616
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.