Fri Nov 14 10:15:12 2014
Command line: PhotoRec /debug /log /logname /var/log/photorec /d /opt/data/tmp_carving/Charlie-usb-work_carved/carved_data /cmd /tmp/mount_dir.PVvcUS/ewf1 options,keep_corrupted_file_no,fileopt,everything,enable,freespace,search
PhotoRec 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <
grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-70-generic (#105-Ubuntu SMP Wed Sep 24 19:49:16 UTC 2014) x86_64
Compiler: GCC 4.4
Compilation date: 2014-11-13T19:10:45
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, ewf lib: 20120504, libjpeg: libjpeg-turbo-1.3.1
Hard disk list
Disk /tmp/mount_dir.PVvcUS/ewf1 - 1048 MB / 1000 MiB - CHS 128 255 63 (RO), sector size=512
Partition table type (auto): Intel
Geometry from i386 MBR: head=255 sector=63
Disk /tmp/mount_dir.PVvcUS/ewf1 - 1048 MB / 1000 MiB (RO)
Partition table type: Intel
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/1/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
Info: size boot_sector 2047878, partition 2047878
FAT1 : 32-2027
FAT2 : 2028-4023
start_rootdir : 4024 root cluster : 2
Data : 4024-2047871
sectors : 2047878
cluster_size : 8
no_of_cluster : 255481 (2 - 255482)
fat_length 1996 calculated 1996
heads/cylinder 128 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
No partition 0 0 1 127 122 59 2048000 [Whole disk]
1 P FAT32 0 1 1 127 121 63 2047878 [JO FAVORITE]
FAT32, blocksize=4096, 1048 MB / 999 MiB
New options :
Paranoid : Yes
Brute force : No
Keep corrupted files : No
ext2/ext3 mode : No
Expert mode : No
Low memory : No
Interface File Select
fat32_remove_used_space
630 first-level signatures enabled
Analyse
1 P FAT32 0 1 1 127 121 63 2047878 [JO FAVORITE]
FAT32, blocksize=4096, 1048 MB / 999 MiB
Pass 0 (blocksize=4096) STATUS_FIND_OFFSET
blocksize=4096, offset=3584
Elapsed time 0h00m00s
Pass 1 (blocksize=4096) STATUS_EXT2_OFF
* 4223-4294: (null)
4503-4630: (null)
4639-4646: (null)
5031-5046: (null)
5063-5070: (null)
5079-5094: (null)
5111-5118: (null)
5143-5182: (null)
5311-5334: (null)
5343-5350: (null)
135887-135982: (null)
135991-136070: (null)
136079-136198: (null)
463687-463966: (null)
464095-470102: (null)
470119-2047942: (null)
1584736 sectors contains unknown data, 0 invalid files found and rejected.
/opt/data/tmp_carving/Charlie-usb-work_carved/carved_data.1/f0004160.gz 4223-4294 4503-4630 4639-4646 5031-5046 5063-5070 5079-5094 5111-5118 5143-5182 5311-5334 5343-5350
Sector 135887
16477 drwxr-xr-x 0 0 0 20-Nov-2009 10:25 .
3 drwxr-xr-x 0 0 0 20-Nov-2009 10:25 ..
/opt/data/tmp_carving/Charlie-usb-work_carved/carved_data.1/f0135824.fat 135887-135894
PhotoRec has been stopped
Elapsed time 0h04m28s
Pass 1 +1 file
gz: 1/1 recovered
Total: 1 file found
135895-135982: (null)
135991-136070: (null)
136079-136198: (null)
463687-463966: (null)
464095-470102: (null)
470119-2047942: (null)
1584400 sectors contains unknown data, 0 invalid files found and rejected.
PhotoRec exited normally.