Page 1 of 2

need to recover lost data

Posted: 24 Mar 2012, 10:03
by tuxx
hi all,

i wanted to write an android image file to a bootable SD card using "Win32 image writer" software (https://wiki.ubuntu.com/Win32DiskImager). Instead of pointing to the SD card, i by mistake pointed to the external hard disk and i believe the boot sector was over written. i am no tech geek, but that is what i believe must have happened.

i had over 500 gb data on external hd. is there any way, i can recover the data. please let me know the steps.

tuxx.

Re: need to recover lost data

Posted: 24 Mar 2012, 10:16
by Fiona
Do you have an idea how far did you write into your file system from your accidentally chosen disk?
The boot sector means 512 Byte.
In this case a diagnose using TestDisk might be possible and you could get your data directly back.
If you wrote into your file system, it might be damaged and you'd need datarecovery software.

Do you have any idea?

Re: need to recover lost data

Posted: 24 Mar 2012, 10:36
by tuxx
im confused. im not tech savvy. i am sorry.

now when i connect my ext hd it shows up as two drives on my computer

local disk G- 186 mb free of 189 mb
local disk H - 1.30 gb free of 1.30 gb

i cannot view the 1.5 tb drive. i feel that the data (500 gb) should be there. but i cannot be seen. please check the attachments and let me know.

will it help to rebuild the bs?

any help would be greatly appreciated.

Re: need to recover lost data

Posted: 24 Mar 2012, 11:04
by Fiona
A boot sector diagnose doesn't help.
You should have a look for your previous partitions first, before you diagnose any boot sector.
I'd need infos form Analyse, Quick and Deeper Search.
Analyse is your current partition table and displayes your current partitions.
Also if something would be wrong.
Quick Search scans your disk for partitions using the boot sector.
Deeper Search searches additional for partitions using a backup from your boot sector.

Do you have any idea how many partitions did you have before and what kind of?
Because I've seen some Linux-partitions in TestDisk in the menu Advanced also.

Re: need to recover lost data

Posted: 24 Mar 2012, 11:36
by tuxx
I have a win7 laptop. i was gifted a iomega 1.5 tb ext hdd by my brother. backed up lot of movies, photos, videos and other personal data.

since i have always been on windows, you can safely assume that i must have formatted that drive in either fat32/ntfs format. so there was just one partition.

as mentioned before, i was using win32 imagewriter software last night to burn an android img file to my SD card, by mistake directed it my external hdd.

so the imagewrite wrote to the boot sector of the ext hdd and now around 500 gb of imp data is not available to me.

the testdisk log file picked up lot of data after i ran analyse test. (see below). Just check if that helps.

as requested by you, i will run the other diagnositc tests and send the log file as attachments.

thanks.......


-----------------------------------------



Sat Mar 24 16:03:00 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=75392614400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=158306664448
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=16251879424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=200000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1400000000
file_pread(4,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500BEVS-60UST0, S/N:2020202057202d44585758453730303332383432, FW:01.01A01
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - SAMSUNG HD154UI, S/N:801130168383

Partition table type (auto): Intel
Disk /dev/sdb - 1500 GB / 1397 GiB - SAMSUNG HD154UI
Partition table type: Intel
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=240 sector=63
FAT32 at 0/0/2
Info: size boot_sector 390625, partition 390625
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used
FAT32 at 303/239/62
Info: size boot_sector 2734375, partition 2734375
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used
Current partition structure:
1 * FAT32 LBA 0 0 2 24 80 26 390625 [NO NAME]
2 P Linux 24 80 27 121 146 63 1562500
3 P Linux 121 147 1 303 239 61 2929687
4 P FAT32 LBA 303 239 62 474 37 47 2734375 [NO NAME]

Re: need to recover lost data

Posted: 24 Mar 2012, 11:46
by Fiona
Now I've got infos about your partition table.
Looks like it's messed up with win32 image writer.

If TestDisk finds partitions, please check them and press p to have try to list your files.
If you receive an error mesage please let me know.
Currently we're trying to recover your data directly.
If it's not working, the next step might be data recovery software.

Re: need to recover lost data

Posted: 24 Mar 2012, 12:01
by tuxx
have a look at this......

only 7 % completed...

btw.. i have already tried recovery software ...Recuva, PC Inspector.. but nothing !

Re: need to recover lost data

Posted: 24 Mar 2012, 12:10
by Fiona
Nothing useful until yet.
Important is after the scan your result!
More important might be probably Deeper Search, because if your boot sector is overridden, then to have a try to find your partition using its backup.

Re: need to recover lost data

Posted: 25 Mar 2012, 05:38
by tuxx
i tried the quick search.. but it got stuck after a while.. with a read access error.
tried it a few times.. no use.

test disk as of now. i am doing the deeper search now. will let you know the results later.



Sat Mar 24 16:03:00 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=75392614400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=158306664448
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=16251879424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=200000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1400000000
file_pread(4,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500BEVS-60UST0, S/N:2020202057202d44585758453730303332383432, FW:01.01A01
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - SAMSUNG HD154UI, S/N:801130168383

Partition table type (auto): Intel
Disk /dev/sdb - 1500 GB / 1397 GiB - SAMSUNG HD154UI
Partition table type: Intel
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=240 sector=63
FAT32 at 0/0/2
Info: size boot_sector 390625, partition 390625
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used
FAT32 at 303/239/62
Info: size boot_sector 2734375, partition 2734375
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used
Current partition structure:
1 * FAT32 LBA 0 0 2 24 80 26 390625 [NO NAME]
2 P Linux 24 80 27 121 146 63 1562500
3 P Linux 121 147 1 303 239 61 2929687
4 P FAT32 LBA 303 239 62 474 37 47 2734375 [NO NAME]



Sat Mar 24 18:43:46 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=75392614400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=158306664448
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=16251879424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=200000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1400000000
file_pread(4,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500BEVS-60UST0, S/N:2020202057202d44585758453730303332383432, FW:01.01A01
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - SAMSUNG HD154UI, S/N:801130168383

Partition table type (auto): Intel
Disk /dev/sdb - 1500 GB / 1397 GiB - SAMSUNG HD154UI
Partition table type: Intel
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=240 sector=63
FAT32 at 0/0/2
Info: size boot_sector 390625, partition 390625
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used
FAT32 at 303/239/62
Info: size boot_sector 2734375, partition 2734375
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used
Current partition structure:
1 * FAT32 LBA 0 0 2 24 80 26 390625 [NO NAME]
2 P Linux 24 80 27 121 146 63 1562500
3 P Linux 121 147 1 303 239 61 2929687
4 P FAT32 LBA 303 239 62 474 37 47 2734375 [NO NAME]
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182402 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182402 255 63
FAT32 at 0/0/2
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used

FAT32 at 0/0/2
FAT32 0 0 2 24 80 26 390625 [NO NAME]
FAT32, 200 MB / 190 MiB

recover_EXT2: s_block_group_nr=0/95, s_mnt_count=6/30, s_blocks_per_group=8192, s_inodes_per_group=4072
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 781250
recover_EXT2: part_size 1562500
Linux 24 80 27 121 146 63 1562500
EXT4 Sparse superblock Recover, 800 MB / 762 MiB

recover_EXT2: s_block_group_nr=0/178, s_mnt_count=7/30, s_blocks_per_group=8192, s_inodes_per_group=4096
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 1464843
recover_EXT2: part_size 2929686
Linux 121 147 1 303 239 60 2929686
EXT4 Sparse superblock Recover, 1499 MB / 1430 MiB
FAT32 at 303/239/62
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used

FAT32 at 303/239/62
FAT32 303 239 62 474 37 47 2734375 [NO NAME]
FAT32, 1400 MB / 1335 MiB
Search for partition aborted

Results
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
Linux 24 80 27 121 254 63 1569304
EXT4 Sparse superblock Recover, 803 MB / 766 MiB
Linux 121 147 1 303 254 63 2930634
EXT4 Sparse superblock Recover, 1500 MB / 1430 MiB
FAT32 303 239 62 474 254 63 2748062 [NO NAME]
FAT32, 1407 MB / 1341 MiB


dir_partition inode=0
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
fat_copy dst=/testdisk-6.13/_OUTPU~1 first_cluster=1754 (8564) size=282624

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182402 255 63
FAT32 at 0/0/2
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used

FAT32 at 0/0/2
FAT32 0 0 2 24 80 26 390625 [NO NAME]
FAT32, 200 MB / 190 MiB

recover_EXT2: s_block_group_nr=0/95, s_mnt_count=6/30, s_blocks_per_group=8192, s_inodes_per_group=4072
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 781250
recover_EXT2: part_size 1562500
Linux 24 80 27 121 146 63 1562500
EXT4 Sparse superblock Recover, 800 MB / 762 MiB

recover_EXT2: s_block_group_nr=0/178, s_mnt_count=7/30, s_blocks_per_group=8192, s_inodes_per_group=4096
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 1464843
recover_EXT2: part_size 2929686
Linux 121 147 1 303 239 60 2929686
EXT4 Sparse superblock Recover, 1499 MB / 1430 MiB
FAT32 at 303/239/62
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used

FAT32 at 303/239/62
FAT32 303 239 62 474 37 47 2734375 [NO NAME]
FAT32, 1400 MB / 1335 MiB
Search for partition aborted

Results
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
Linux 24 80 27 121 254 63 1569304
EXT4 Sparse superblock Recover, 803 MB / 766 MiB
Linux 121 147 1 303 254 63 2930634
EXT4 Sparse superblock Recover, 1500 MB / 1430 MiB
FAT32 303 239 62 474 254 63 2748062 [NO NAME]
FAT32, 1407 MB / 1341 MiB


dir_partition inode=0
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.



Sat Mar 24 23:12:34 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=75392614400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=158306664448
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=16251879424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=200000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1400000000
file_pread(4,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500BEVS-60UST0, S/N:2020202057202d44585758453730303332383432, FW:01.01A01
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - SAMSUNG HD154UI, S/N:801130168383

Partition table type (auto): Intel
Disk /dev/sdb - 1500 GB / 1397 GiB - SAMSUNG HD154UI
Partition table type: Intel
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=240 sector=63
FAT32 at 0/0/2
Info: size boot_sector 390625, partition 390625
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used
FAT32 at 303/239/62
Info: size boot_sector 2734375, partition 2734375
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used
Current partition structure:
1 * FAT32 LBA 0 0 2 24 80 26 390625 [NO NAME]
2 P Linux 24 80 27 121 146 63 1562500
3 P Linux 121 147 1 303 239 61 2929687
4 P FAT32 LBA 303 239 62 474 37 47 2734375 [NO NAME]



Sun Mar 25 01:04:18 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=75392614400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=158306664448
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=16251879424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=200000000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1400000000
file_pread(4,1,buffer,488408129(30401/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - WDC WD2500BEVS-60UST0, S/N:2020202057202d44585758453730303332383432, FW:01.01A01
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - SAMSUNG HD154UI, S/N:801130168383

Partition table type (auto): Intel
Disk /dev/sdb - 1500 GB / 1397 GiB - SAMSUNG HD154UI
Partition table type: Intel
file_pread(5,1,buffer,2930288129(182401/254/63)) lseek err Invalid argument

Interface Advanced
Geometry from i386 MBR: head=240 sector=63
FAT32 at 0/0/2
Info: size boot_sector 390625, partition 390625
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used
FAT32 at 303/239/62
Info: size boot_sector 2734375, partition 2734375
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used
1 * FAT32 LBA 0 0 2 24 80 26 390625 [NO NAME]
FAT32, 200 MB / 190 MiB
2 P Linux 24 80 27 121 146 63 1562500
EXT4 Sparse superblock Recover, 800 MB / 762 MiB
3 P Linux 121 147 1 303 239 61 2929687
EXT4 Sparse superblock Recover, 1499 MB / 1430 MiB
4 P FAT32 LBA 303 239 62 474 37 47 2734375 [NO NAME]
FAT32, 1400 MB / 1335 MiB

Analyse Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=240 sector=63
FAT32 at 0/0/2
Info: size boot_sector 390625, partition 390625
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used
FAT32 at 303/239/62
Info: size boot_sector 2734375, partition 2734375
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used
Current partition structure:
1 * FAT32 LBA 0 0 2 24 80 26 390625 [NO NAME]
2 P Linux 24 80 27 121 146 63 1562500
3 P Linux 121 147 1 303 239 61 2929687
4 P FAT32 LBA 303 239 62 474 37 47 2734375 [NO NAME]
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182402 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182402 255 63
FAT32 at 0/0/2
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used

FAT32 at 0/0/2
FAT32 0 0 2 24 80 26 390625 [NO NAME]
FAT32, 200 MB / 190 MiB

recover_EXT2: s_block_group_nr=0/95, s_mnt_count=6/30, s_blocks_per_group=8192, s_inodes_per_group=4072
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 781250
recover_EXT2: part_size 1562500
Linux 24 80 27 121 146 63 1562500
EXT4 Sparse superblock Recover, 800 MB / 762 MiB

recover_EXT2: s_block_group_nr=0/178, s_mnt_count=7/30, s_blocks_per_group=8192, s_inodes_per_group=4096
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 1464843
recover_EXT2: part_size 2929686
Linux 121 147 1 303 239 60 2929686
EXT4 Sparse superblock Recover, 1499 MB / 1430 MiB
FAT32 at 303/239/62
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used

FAT32 at 303/239/62
FAT32 303 239 62 474 37 47 2734375 [NO NAME]
FAT32, 1400 MB / 1335 MiB
Search for partition aborted

Results
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
Linux 24 80 27 121 254 63 1569304
EXT4 Sparse superblock Recover, 803 MB / 766 MiB
Linux 121 147 1 303 254 63 2930634
EXT4 Sparse superblock Recover, 1500 MB / 1430 MiB
FAT32 303 239 62 474 254 63 2748062 [NO NAME]
FAT32, 1407 MB / 1341 MiB


dir_partition inode=0
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

dir_partition inode=3
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=3(0x3), pos=1561
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 .
0 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 ..
4 -rwxr-xr-x 0 0 129 24-Mar-2012 22:56 DESKTOP.INI
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

dir_partition inode=3
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=3(0x3), pos=1561
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 .
0 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 ..
4 -rwxr-xr-x 0 0 129 24-Mar-2012 22:56 DESKTOP.INI
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

dir_partition inode=3
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=3(0x3), pos=1561
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 .
0 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 ..
4 -rwxr-xr-x 0 0 129 24-Mar-2012 22:56 DESKTOP.INI
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN
interface_load
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182401 255 63 Sat Mar 24 15:50:55 2012
1 * FAT32 LBA 0 0 2 24 80 26 390625
2 P Linux 24 80 27 121 146 63 1562500
3 P Linux 121 147 1 303 239 61 2929687
4 P FAT32 LBA 303 239 62 474 37 47 2734375

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1500 GB / 1397 GiB - CHS 182402 255 63
FAT32 at 0/0/2
FAT1 : 32-793
FAT2 : 794-1555
start_rootdir : 1556 root cluster : 2
Data : 1556-390623
sectors : 390625
cluster_size : 4
no_of_cluster : 97267 (2 - 97268)
fat_length 762 calculated 760
set_FAT_info: name from BS used

FAT32 at 0/0/2
FAT32 0 0 2 24 80 26 390625 [NO NAME]
FAT32, 200 MB / 190 MiB

recover_EXT2: s_block_group_nr=0/95, s_mnt_count=6/30, s_blocks_per_group=8192, s_inodes_per_group=4072
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 781250
recover_EXT2: part_size 1562500
Linux 24 80 27 121 146 63 1562500
EXT4 Sparse superblock Recover, 800 MB / 762 MiB

recover_EXT2: s_block_group_nr=0/178, s_mnt_count=7/30, s_blocks_per_group=8192, s_inodes_per_group=4096
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 1464843
recover_EXT2: part_size 2929686
Linux 121 147 1 303 239 60 2929686
EXT4 Sparse superblock Recover, 1499 MB / 1430 MiB
FAT32 at 303/239/62
FAT1 : 32-2699
FAT2 : 2700-5367
start_rootdir : 5368 root cluster : 2
Data : 5368-2734367
sectors : 2734375
cluster_size : 8
no_of_cluster : 341125 (2 - 341126)
fat_length 2668 calculated 2666
set_FAT_info: name from BS used

FAT32 at 303/239/62
FAT32 303 239 62 474 37 47 2734375 [NO NAME]
FAT32, 1400 MB / 1335 MiB
Search for partition aborted

Results
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
Linux 24 80 27 121 254 63 1569304
EXT4 Sparse superblock Recover, 803 MB / 766 MiB
Linux 121 147 1 303 254 63 2930634
EXT4 Sparse superblock Recover, 1500 MB / 1430 MiB
FAT32 303 239 62 474 254 63 2748062 [NO NAME]
FAT32, 1407 MB / 1341 MiB


dir_partition inode=0
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

dir_partition inode=1740
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=1740(0x6cc), pos=8509
Directory /LOST.DIR
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .
0 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 ..
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

dir_partition inode=3
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=3(0x3), pos=1561
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 .
0 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 ..
4 -rwxr-xr-x 0 0 129 24-Mar-2012 22:56 DESKTOP.INI
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

dir_partition inode=3
FAT32 0 0 2 24 254 63 401624 [NO NAME]
FAT32, 205 MB / 196 MiB
FAT: cluster=3(0x3), pos=1561
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 .
0 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 ..
4 -rwxr-xr-x 0 0 129 24-Mar-2012 22:56 DESKTOP.INI
FAT: cluster=2(0x2), pos=1557
Directory /
1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:03 flashing_boot.img
111 -rwxr-xr-x 0 0 38356 25-Feb-2012 21:27 MLO
130 -rwxr-xr-x 0 0 179812 25-Feb-2012 21:27 u-boot.bin
218 -rwxr-xr-x 0 0 3115008 26-Feb-2012 02:18 boot.img
1740 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 LOST.DIR
1741 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 .android_secure
1742 drwxr-xr-x 0 0 0 6-Mar-2012 00:52 Android
X 1754 -rwxr-xr-x 0 0 282624 7-Mar-2012 02:27 _OUTPU~1
3 drwxr-xr-x 0 0 0 24-Mar-2012 22:56 $RECYCLE.BIN

interface_write()
1 P FAT32 0 0 2 24 254 63 401624 [NO NAME]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Re: need to recover lost data

Posted: 25 Mar 2012, 19:13
by tuxx
even the deeper search hangs around the same time. what should i do.. ?

what option do i have?