VMWare Workstation 11 guest Windows 7

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
DavidLee
Posts: 2
Joined: 10 Jun 2019, 08:53

VMWare Workstation 11 guest Windows 7

#1 Post by DavidLee »

Will TestDisk 7.1 Beta (download Windows 7 64bit) work on a Windows 7 64bir Ultimate guest on Windows 7 Pro 64bit host.

Maybe I should be using TestDisk 7.0 windows Download, rather than TestDisk 7.1 Beta with Windows64 download.

The Guest is a 42GB partition (38.9GiB).
The TestDisk.log shows:
The harddisk (42 GB / 40 GiB) seems too small! (< 85 GB / 79 GiB)
The following partition can't be recovered:
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB

I am using VMWare Workstation 11.
This test was to exercise TestDisk before trying to recover Window 7 Master File Table (MFT) on a failing computer that keeps get Blue Screen BSOD)
The Windows 7 Guest has been running successfully since 2012 and is used for testingour newly developed applications.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: VMWare Workstation 11 guest Windows 7

#2 Post by cgrenier »

You can use the 7.1-WIP version.
An NTFS partition found using its backup boot sector should be listed on the next screen, TestDisk has been stopped too early.

DavidLee
Posts: 2
Joined: 10 Jun 2019, 08:53

Re: VMWare Workstation 11 guest Windows 7

#3 Post by DavidLee »

Here is the full testdisk.log. Most relavent message is possibly:
"This partition ends after the disk limits."
David
=======================
Mon Jun 10 16:08:51 2019
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=42949672960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=42949672960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=42842718208
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63, sector size=512 - VMware, VMware Virtual S, FW:1.0

Partition table type (auto): Intel
Disk /dev/sda - 42 GB / 40 GiB - VMware, VMware Virtual S
Partition table type: Intel

Analyse Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 5221 137 36 83677184

search_part()
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
file_pread(4,2,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).

file_pread(4,2,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,2,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,1,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,2,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,8,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,14,buffer,83886082(5221/170/8)) lseek err Invalid argument
file_pread(4,3,buffer,83886096(5221/170/22)) lseek err Invalid argument
file_pread(4,3,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,8,buffer,83886159(5221/171/22)) lseek err Invalid argument
file_pread(4,11,buffer,83886206(5221/172/6)) lseek err Invalid argument
file_pread(4,2,buffer,83888128(5221/202/38)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 5221 137 36 83677184

search_part()
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
NTFS at 5221/137/36
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS found using backup sector, blocksize=4096, 42 GB / 39 GiB
NTFS at 5221/137/36
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,2,buffer,90175493(5613/42/3)) lseek err Invalid argument
file_pread(4,1,buffer,90175493(5613/42/3)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
This partition ends after the disk limits. (start=83884031, size=83677184, end=167561214, disk end=83886080)
file_pread(4,2,buffer,83886079(5221/170/5)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).

file_pread(4,1,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,2,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,2,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,1,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,2,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).

file_pread(4,7,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,8,buffer,83886088(5221/170/14)) lseek err Invalid argument
file_pread(4,3,buffer,83886096(5221/170/22)) lseek err Invalid argument
file_pread(4,3,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,8,buffer,83886159(5221/171/22)) lseek err Invalid argument
file_pread(4,11,buffer,83886206(5221/172/6)) lseek err Invalid argument
file_pread(4,2,buffer,83888128(5221/202/38)) lseek err Invalid argument
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (42 GB / 40 GiB) seems too small! (< 85 GB / 79 GiB)
The following partition can't be recovered:
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB

Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
SIGINT detected! TestDisk has been killed.

Locked