ich bin mit meinem Problem an anderer stelle auf TestDisk gestoßen und habe schon etwas damit versucht, komme aber nicht weiter:
Situation: Ich habe auf einem Netbook (Asus Eee PC 1005AHG) alle Daten auf der zweiten Partition gesichert um dann das Betriebssystem neu aufzuspielen. Die mitgelieferte Win7 Starter DVD hat jedoch (entgegen den Aussagen des Handbuchs) einfach das komplette System in den Auslieferungszustand gebracht, heißt auch die zweite Partition (im Schnelldurchgang) formartiert.
Das Filesystem (NTFS), dessen Einstellungen und die Größe der Partition haben sich also nicht geändert, sie ist aber leer.
Bisheriges Vorgehen: Ich habe ein vollständiges Image der Partition gemacht (CloneZilla mit der Einstellung "-q1 only dd", sollte also jedes einzelne Bit gesichert haben)
Mit photorec habe ich erstmal eine Menge Dateien (~50GB) wiederhergestellt (auf eine externe Festplatte), diese sind aber teils beschädigt und natürlich unsortiert
Ich bin weiterhin der Anleitung für TestDisk gefolgt wie man vorgeht wenn die Partition in ein anderes Dateisystem formartiert wurde, nach RebuildBS kommt diese Meldung
Danach auf List:Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Partition Start End Size in sec
2 P HPFS - NTFS 10443 117 43 18149 159 58 123799552
filesystem size 123799552 123799552
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 7737471 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
Full TestDisk Log (Pastebin):Can't open filesystem. Filesystem seems damaged.
Code: Select all
Sat Jul 11 14:30:57 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=85899345920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=63385370624
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512
Drive C: - 85 GB / 80 GiB - CHS 10443 255 63, sector size=512
Drive D: - 63 GB / 59 GiB - CHS 7706 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sda - 160 GB / 149 GiB
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 10443/117/43
FAT32 at 18149/159/59
Info: size boot_sector 20971520, partition 20971520
FAT1 : 4118-14346
FAT2 : 14347-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-20971519
sectors : 20971520
cluster_size : 16
no_of_cluster : 1309184 (2 - 1309185)
fat_length 10229 calculated 10229
set_FAT_info: name from BS used
check_part_i386 4 type EF: no test
1 * HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
2 P HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
3 P hid. FAT32 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
4 P EFI (FAT-12/16/32) 19455 11 13 19457 21 20 32768
ntfs_boot_sector
2 P HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
NTFS at 10443/117/43
NTFS at 10443/117/43
filesystem size 123799552
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Code: Select all
Sat Jul 11 15:50:35 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107861504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107861504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=85899345920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=63385370624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500107797504
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 85 GB / 80 GiB - CHS 10443 255 63, sector size=512
Drive D: - 63 GB / 59 GiB - CHS 7706 255 63, sector size=512
Drive E: - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sda - 160 GB / 149 GiB
Partition table type: Intel
Analyse Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 10443/117/43
FAT32 at 18149/159/59
Info: size boot_sector 20971520, partition 20971520
FAT1 : 4118-14346
FAT2 : 14347-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-20971519
sectors : 20971520
cluster_size : 16
no_of_cluster : 1309184 (2 - 1309185)
fat_length 10229 calculated 10229
set_FAT_info: name from BS used
check_part_i386 4 type EF: no test
Current partition structure:
1 * HPFS - NTFS 0 32 33 10443 117 42 167772160
2 P HPFS - NTFS 10443 117 43 18149 159 58 123799552
3 P hid. FAT32 18149 159 59 19455 11 12 20971520 [NO NAME]
4 P EFI (FAT-12/16/32) 19455 11 13 19457 21 20 32768
search_part()
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/32/33
filesystem size 167772160
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
NTFS at 10443/117/43
filesystem size 123799552
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
FAT32 at 18149/159/59
FAT1 : 4118-14346
FAT2 : 14347-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-20971519
sectors : 20971520
cluster_size : 16
no_of_cluster : 1309184 (2 - 1309185)
fat_length 10229 calculated 10229
set_FAT_info: name from BS used
FAT32 at 18149/159/59
FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
file_pread(4,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(4,1,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(4,1,buffer,312582143(19457/86/21)) lseek err Invalid argument
file_pread(4,14,buffer,312582145(19457/86/23)) lseek err Invalid argument
file_pread(4,3,buffer,312582159(19457/86/37)) lseek err Invalid argument
file_pread(4,3,buffer,312582206(19457/87/21)) lseek err Invalid argument
file_pread(4,8,buffer,312582222(19457/87/37)) lseek err Invalid argument
file_pread(4,11,buffer,312582269(19457/88/21)) lseek err Invalid argument
file_pread(4,2,buffer,312584191(19457/118/53)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
P HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
P FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
dir_partition inode=5
* HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 .
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 ..
2902 dr-xr-xr-x 0 0 0 10-Jul-2015 17:45 $RECYCLE.BIN
56038 dr-xr-xr-x 0 0 0 11-Jul-2015 03:20 Boot
79424 dr-xr-xr-x 0 0 0 11-Jul-2015 15:43 Config.Msi
11192 dr-xr-xr-x 0 0 0 14-Jul-2009 06:53 Documents and Settings
56604 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Dokumente und Einstellungen
35 dr-xr-xr-x 0 0 0 16-Oct-2009 12:39 Intel
51 dr-xr-xr-x 0 0 0 14-Jul-2009 04:37 PerfLogs
53 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 Program Files
1410 dr-xr-xr-x 0 0 0 11-Jul-2015 15:38 ProgramData
56614 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Programme
56617 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Recovery
18487 dr-xr-xr-x 0 0 0 11-Jul-2015 15:36 System Volume Information
1553 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Users
1935 dr-xr-xr-x 0 0 0 11-Jul-2015 15:19 Windows
337 -r--r--r-- 0 0 135 11-Jul-2015 15:19 DelUS.bat
11186 -r--r--r-- 0 0 24 10-Jun-2009 23:42 autoexec.bat
56088 -r--r--r-- 0 0 383562 14-Jul-2009 03:38 bootmgr
11189 -r--r--r-- 0 0 10 10-Jun-2009 23:42 config.sys
24352 -r--r--r-- 0 0 1603723264 11-Jul-2015 10:10 hiberfil.sys
18493 -r--r--r-- 0 0 2138300416 11-Jul-2015 10:10 pagefile.sys
dir_partition inode=5
P HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 .
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 ..
37 dr-xr-xr-x 0 0 0 10-Jul-2015 17:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 10-Jul-2015 17:21 System Volume Information
dir_partition inode=0
P FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
FAT: cluster=2(0x2), pos=291598336
Directory /
3 drwxr-xr-x 0 0 0 10-Jul-2015 17:00 RECOVERY
5 drwxr-xr-x 0 0 0 10-Jul-2015 17:00 SOURCES
X 6 -rwxr-xr-x 0 0 2080 10-Jul-2015 17:00 _IMC4F.TMP
6 dr-xr-xr-x 0 0 0 23-May-2009 13:31 BOOT
8 -r-xr-xr-x 0 0 383454 7-May-2009 22:58 BOOTMGR
interface_write()
1 * HPFS - NTFS 0 32 33 10443 117 42 167772160
2 P HPFS - NTFS 10443 117 43 18149 159 58 123799552
3 P FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
search_part()
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/32/33
filesystem size 167772160
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
NTFS at 9727/0/1
filesystem size 156264255
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 9766515
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 9727 0 1 19453 254 63 156264255
NTFS, blocksize=4096, 80 GB / 74 GiB
NTFS at 10443/117/42
filesystem size 167772160
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS found using backup sector, blocksize=4096, 85 GB / 80 GiB
NTFS at 10443/117/43
filesystem size 123799552
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
NTFS at 18149/159/58
filesystem size 123799552
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS found using backup sector, blocksize=4096, 63 GB / 59 GiB
FAT32 at 18149/159/59
FAT1 : 4118-14346
FAT2 : 14347-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-20971519
sectors : 20971520
cluster_size : 16
no_of_cluster : 1309184 (2 - 1309185)
fat_length 10229 calculated 10229
set_FAT_info: name from BS used
FAT32 at 18149/159/59
FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
FAT32 at 18149/160/2
FAT1 : 4118-14346
FAT2 : 14347-24575
start_rootdir : 24576 root cluster : 2
Data : 24576-20971519
sectors : 20971520
cluster_size : 16
no_of_cluster : 1309184 (2 - 1309185)
fat_length 10229 calculated 10229
set_FAT_info: name from BS used
FAT32 at 18149/160/2
FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
file_pread(4,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(4,1,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(4,1,buffer,312582143(19457/86/21)) lseek err Invalid argument
file_pread(4,14,buffer,312582145(19457/86/23)) lseek err Invalid argument
file_pread(4,3,buffer,312582159(19457/86/37)) lseek err Invalid argument
file_pread(4,3,buffer,312582206(19457/87/21)) lseek err Invalid argument
file_pread(4,8,buffer,312582222(19457/87/37)) lseek err Invalid argument
file_pread(4,11,buffer,312582269(19457/88/21)) lseek err Invalid argument
file_pread(4,2,buffer,312584191(19457/118/53)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
HPFS - NTFS 9727 0 1 19453 254 63 156264255
NTFS, blocksize=4096, 80 GB / 74 GiB
HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
dir_partition inode=5
HPFS - NTFS 0 32 33 10443 117 42 167772160
NTFS, blocksize=4096, 85 GB / 80 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 .
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 ..
2902 dr-xr-xr-x 0 0 0 10-Jul-2015 17:45 $RECYCLE.BIN
56038 dr-xr-xr-x 0 0 0 11-Jul-2015 03:20 Boot
79424 dr-xr-xr-x 0 0 0 11-Jul-2015 15:43 Config.Msi
11192 dr-xr-xr-x 0 0 0 14-Jul-2009 06:53 Documents and Settings
56604 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Dokumente und Einstellungen
35 dr-xr-xr-x 0 0 0 16-Oct-2009 12:39 Intel
51 dr-xr-xr-x 0 0 0 14-Jul-2009 04:37 PerfLogs
53 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 Program Files
1410 dr-xr-xr-x 0 0 0 11-Jul-2015 15:38 ProgramData
56614 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Programme
56617 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Recovery
18487 dr-xr-xr-x 0 0 0 11-Jul-2015 15:40 System Volume Information
1553 dr-xr-xr-x 0 0 0 10-Jul-2015 17:43 Users
1935 dr-xr-xr-x 0 0 0 11-Jul-2015 15:19 Windows
337 -r--r--r-- 0 0 135 11-Jul-2015 15:19 DelUS.bat
11186 -r--r--r-- 0 0 24 10-Jun-2009 23:42 autoexec.bat
56088 -r--r--r-- 0 0 383562 14-Jul-2009 03:38 bootmgr
11189 -r--r--r-- 0 0 10 10-Jun-2009 23:42 config.sys
24352 -r--r--r-- 0 0 1603723264 11-Jul-2015 10:10 hiberfil.sys
18493 -r--r--r-- 0 0 2138300416 11-Jul-2015 10:10 pagefile.sys
NTFS filesystem need to be repaired.
dir_partition inode=5
HPFS - NTFS 9727 0 1 19453 254 63 156264255
NTFS, blocksize=4096, 80 GB / 74 GiB
Directory /
5 dr-xr-xr-x 0 0 0 26-Sep-2009 00:40 .
5 dr-xr-xr-x 0 0 0 26-Sep-2009 00:40 ..
66 dr-xr-xr-x 0 0 0 21-Sep-2009 23:26 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 13-Jul-2009 15:39 RECYCLER
27 dr-xr-xr-x 0 0 0 8-May-2009 03:55 System Volume Information
dir_partition inode=5
HPFS - NTFS 10443 117 43 18149 159 58 123799552
NTFS, blocksize=4096, 63 GB / 59 GiB
Directory /
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 .
5 dr-xr-xr-x 0 0 0 11-Jul-2015 15:42 ..
37 dr-xr-xr-x 0 0 0 10-Jul-2015 17:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 10-Jul-2015 17:21 System Volume Information
dir_partition inode=0
FAT32 LBA 18149 159 59 19455 11 12 20971520 [NO NAME]
FAT32, blocksize=8192, 10 GB / 10 GiB
FAT: cluster=2(0x2), pos=291598336
Directory /
3 drwxr-xr-x 0 0 0 10-Jul-2015 17:00 RECOVERY
5 drwxr-xr-x 0 0 0 10-Jul-2015 17:00 SOURCES
X 6 -rwxr-xr-x 0 0 2080 10-Jul-2015 17:00 _IMC4F.TMP
6 dr-xr-xr-x 0 0 0 23-May-2009 13:31 BOOT
8 -r-xr-xr-x 0 0 383454 7-May-2009 22:58 BOOTMGR
interface_write()
No partition found or selected for recovery
http://i.imgur.com/MMTgiWu.jpg
Danach (Die Markierte ist die formartierte Partition)
http://i.imgur.com/avTr8he.jpg