Re: Festplatte plötzlich RAW
Posted: 15 Aug 2015, 13:31
Fiona? Bist du noch da???
TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/
Sun Aug 16 18:04:32 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=161067400704
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=26847281664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=312190469120
filewin32_getfilesize(\\.\F:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=640135028736
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512
Drive C: - 161 GB / 150 GiB - CHS 19581 255 63, sector size=512
Drive D: - 26 GB / 25 GiB - CHS 3263 255 63, sector size=512
Drive E: - 312 GB / 290 GiB - CHS 37954 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdb - 640 GB / 596 GiB
Partition table type: Intel
Analyse Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=106 sector=52
BAD_RS LBA=1380404564 216152
check_part_i386 failed for partition type 07
BAD_RS LBA=1309281536 5870947
check_part_i386 2 type 69: no test
BAD_RS LBA=1735554131 4633953
check_part_i386 3 type 6D: no test
BAD_RS LBA=2978742282 5980572
check_part_i386 4 type 66: no test
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 85926 53 36 200213 18 49 1836018464
1 * HPFS - NTFS 85926 53 36 200213 18 49 1836018464
Warning: Bad starting sector (CHS and LBA don't match)
2 * Novell 81499 1 39 203112 174 43 1953723749
Bad relative sector.
3 * Sys=6D 108033 63 18 229617 137 22 1953251627
Bad relative sector.
4 * Sys=66 185418 33 34 185421 145 15 55233
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
2 * Novell 81499 1 39 203112 174 43 1953723749
1 * HPFS - NTFS 85926 53 36 200213 18 49 1836018464
Space conflict between the following two partitions
1 * HPFS - NTFS 85926 53 36 200213 18 49 1836018464
3 * Sys=6D 108033 63 18 229617 137 22 1953251627
Space conflict between the following two partitions
3 * Sys=6D 108033 63 18 229617 137 22 1953251627
4 * Sys=66 185418 33 34 185421 145 15 55233
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
BAD_RS LBA=2453970758 9256023
file_pread(5,1,buffer,2453970758(152752/156/51)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 152752 156 51 222874 226 50 1126514340
This partition ends after the disk limits. (start=2453970758, size=1126514340, end=3580485097, disk end=1250263728)
NTFS at 77824/254/63
filesystem size 882803880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 55175242
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
NTFS at 77824/254/63
filesystem size 882803880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 55175242
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,1024,buffer,1256553152(78216/208/9)) lseek err Invalid argument
file_pread(5,1,buffer,1256553152(78216/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 77824 254 63 132776 254 62 882803880
NTFS, blocksize=4096, 451 GB / 420 GiB
This partition ends after the disk limits. (start=1250258624, size=882803880, end=2133062503, disk end=1250263728)
file_pread(5,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,1250263833(77825/82/43)) lseek err Invalid argument
file_pread(5,1,buffer,1250263833(77825/82/43)) lseek err Invalid argument
file_pread(5,8,buffer,1250263961(77825/84/45)) lseek err Invalid argument
file_pread(5,8,buffer,1250264089(77825/86/47)) lseek err Invalid argument
file_pread(5,8,buffer,1250264217(77825/88/49)) lseek err Invalid argument
file_pread(5,8,buffer,1250264345(77825/90/51)) lseek err Invalid argument
file_pread(5,8,buffer,1250264473(77825/92/53)) lseek err Invalid argument
file_pread(5,8,buffer,1250264601(77825/94/55)) lseek err Invalid argument
file_pread(5,8,buffer,1250264729(77825/96/57)) lseek err Invalid argument
file_pread(5,8,buffer,1250264857(77825/98/59)) lseek err Invalid argument
file_pread(5,8,buffer,1250264985(77825/100/61)) lseek err Invalid argument
file_pread(5,1,buffer,1250265087(77825/102/37)) lseek err Invalid argument
file_pread(5,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,14,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(5,3,buffer,1250265103(77825/102/53)) lseek err Invalid argument
file_pread(5,3,buffer,1250265150(77825/103/37)) lseek err Invalid argument
file_pread(5,8,buffer,1250265166(77825/103/53)) lseek err Invalid argument
file_pread(5,11,buffer,1250265213(77825/104/37)) lseek err Invalid argument
file_pread(5,2,buffer,1250267135(77825/135/6)) lseek err Invalid argument
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (640 GB / 596 GiB) seems too small! (< 1833 GB / 1707 GiB)
The following partitions can't be recovered:
HPFS - NTFS 77824 254 63 132776 254 62 882803880
NTFS, blocksize=4096, 451 GB / 420 GiB
HPFS - NTFS 152752 156 51 222874 226 50 1126514340
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
Not an exFAT boot sector.
* HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
* HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 22873 0 1 77824 254 63 882803880
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
file_pread(5,16,buffer,5993204(373/15/15)) ReadFile Datenfehler (CRC-Prüfung)
file_pread(5,1,buffer,5993204(373/15/15)) ReadFile Datenfehler (CRC-Prüfung)
file_pread(5,2,buffer,5993267(373/16/15)) ReadFile Die Anforderung konnte wegen eines E/A-Gerätefehlers nicht ausgeführt werden.
file_pread(5,2,buffer,5993330(373/17/15)) ReadFile Die Anforderung konnte wegen eines E/A-Gerätefehlers nicht ausgeführt werden.
BAD_RS LBA=2453970758 9256023
file_pread(5,1,buffer,2453970758(152752/156/51)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 152752 156 51 222874 226 50 1126514340
This partition ends after the disk limits. (start=2453970758, size=1126514340, end=3580485097, disk end=1250263728)
NTFS at 77824/254/63
filesystem size 882803880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 55175242
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
NTFS at 77824/254/63
filesystem size 882803880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 55175242
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,1024,buffer,1256553152(78216/208/9)) lseek err Invalid argument
file_pread(5,1,buffer,1256553152(78216/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 77824 254 63 132776 254 62 882803880
NTFS, blocksize=4096, 451 GB / 420 GiB
This partition ends after the disk limits. (start=1250258624, size=882803880, end=2133062503, disk end=1250263728)
file_pread(5,2,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,1250263833(77825/82/43)) lseek err Invalid argument
file_pread(5,1,buffer,1250263833(77825/82/43)) lseek err Invalid argument
file_pread(5,8,buffer,1250263961(77825/84/45)) lseek err Invalid argument
file_pread(5,8,buffer,1250264089(77825/86/47)) lseek err Invalid argument
file_pread(5,8,buffer,1250264217(77825/88/49)) lseek err Invalid argument
file_pread(5,8,buffer,1250264345(77825/90/51)) lseek err Invalid argument
file_pread(5,8,buffer,1250264473(77825/92/53)) lseek err Invalid argument
file_pread(5,8,buffer,1250264601(77825/94/55)) lseek err Invalid argument
file_pread(5,8,buffer,1250264729(77825/96/57)) lseek err Invalid argument
file_pread(5,8,buffer,1250264857(77825/98/59)) lseek err Invalid argument
file_pread(5,8,buffer,1250264985(77825/100/61)) lseek err Invalid argument
file_pread(5,1,buffer,1250265087(77825/102/37)) lseek err Invalid argument
file_pread(5,1,buffer,1250265088(77825/102/38)) lseek err Invalid argument
file_pread(5,14,buffer,1250265089(77825/102/39)) lseek err Invalid argument
file_pread(5,3,buffer,1250265103(77825/102/53)) lseek err Invalid argument
file_pread(5,3,buffer,1250265150(77825/103/37)) lseek err Invalid argument
file_pread(5,8,buffer,1250265166(77825/103/53)) lseek err Invalid argument
file_pread(5,11,buffer,1250265213(77825/104/37)) lseek err Invalid argument
file_pread(5,2,buffer,1250267135(77825/135/6)) lseek err Invalid argument
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (640 GB / 596 GiB) seems too small! (< 1833 GB / 1707 GiB)
The following partitions can't be recovered:
HPFS - NTFS 77824 254 63 132776 254 62 882803880
NTFS, blocksize=4096, 451 GB / 420 GiB
HPFS - NTFS 152752 156 51 222874 226 50 1126514340
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
Not an exFAT boot sector.
* HPFS - NTFS 22873 0 1 77824 254 63 882803880
NTFS found using backup sector, blocksize=4096, 451 GB / 420 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 22873 0 1 77824 254 63 882803880
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.