Ja soweit ich mich erinnere hatte ich nach der Analyse keine weiteren Scanmöglichkeiten. Also ging ich davon aus, dass es sich um den deep search handelt. Er wurde aufjedenfall Sektor für Sektor gesucht.
Seit gut 15 Stunden läuft derzeit photorec und Zeigt mir an dass noch 1500 Stunden verbleiben. Wirklich finden tut er nichts bisher. Ist diese Zeitspanne normal?
Ich füge mal gleich zwei Logfiles an. Das Erste stammt vom PC - später wechselte ich dann auf den Laptop.
Ich stellte ein RAW-Imgage der Platte her, bevor ich dann damit losgelegen habe.
Testdisk Logfile PC
Code: Select all
Mon Dec 14 23:52:00 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202657792
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive C: - 119 GB / 111 GiB - CHS 14580 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Partition table type default to Intel
Disk /dev/sdc - 320 GB / 298 GiB
Partition table type: Intel
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Analyse Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
file_pread(6,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
file_pread(6,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Interface Advanced
A new copy of MBR code has been written.
You have to reboot for the change to take effect.
Interface Advanced
SIGHUP detected! TestDisk has been killed.
Testdisk Logfile Laptop (Aktuellste)
Code: Select all
Tue Dec 15 00:39:34 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202657792
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive C: - 119 GB / 111 GiB - CHS 14580 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdc - 320 GB / 298 GiB
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
test_FAT()
1 P FAT16 >32M 0 32 33 38913 37 36 625137664
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
1 P FAT16 >32M 0 32 33 38913 37 36 625137664
FAT: Can't list files, bad cluster size.
Directory /
Analyse Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
test_FAT()
1 P FAT16 >32M 0 32 33 38913 37 36 625137664
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 38913 37 36 625137664
1 P FAT16 >32M 0 32 33 38913 37 36 625137664
No partition is bootable
search_part()
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 37150/147/54
FAT1 : 36-13849
FAT2 : 13850-27663
start_rootdir : 27664 root cluster : 2
Data : 27664-28318063
sectors : 28318064
cluster_size : 16
no_of_cluster : 1768150 (2 - 1768151)
fat_length 13814 calculated 13814
set_FAT_info: name from BS used
FAT32 at 37150/147/54
FAT32 LBA 37150 147 54 38913 75 58 28318064 [NO NAME]
FAT32, blocksize=8192, 14 GB / 13 GiB
file_pread(6,2,buffer,625144176(38913/108/28)) lseek err Invalid argument
file_pread(6,1,buffer,625144176(38913/108/28)) lseek err Invalid argument
file_pread(6,2,buffer,625144181(38913/108/33)) lseek err Invalid argument
file_pread(6,2,buffer,625144239(38913/109/28)) lseek err Invalid argument
file_pread(6,1,buffer,625144239(38913/109/28)) lseek err Invalid argument
file_pread(6,2,buffer,625144244(38913/109/33)) lseek err Invalid argument
file_pread(6,1,buffer,625144244(38913/109/33)) lseek err Invalid argument
file_pread(6,8,buffer,625142528(38913/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,625142528(38913/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,625142656(38913/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,625142784(38913/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,625142912(38913/88/24)) lseek err Invalid argument
file_pread(6,8,buffer,625143040(38913/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,625143168(38913/92/28)) lseek err Invalid argument
file_pread(6,8,buffer,625143296(38913/94/30)) lseek err Invalid argument
file_pread(6,8,buffer,625143424(38913/96/32)) lseek err Invalid argument
file_pread(6,8,buffer,625143552(38913/98/34)) lseek err Invalid argument
file_pread(6,8,buffer,625143680(38913/100/36)) lseek err Invalid argument
file_pread(6,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
Results
* FAT32 LBA 37150 147 54 38913 102 37 28319744 [NO NAME]
FAT32, blocksize=8192, 14 GB / 13 GiB
dir_partition inode=0
* FAT32 LBA 37150 147 54 38913 102 37 28319744 [NO NAME]
FAT32, blocksize=8192, 14 GB / 13 GiB
FAT: cluster=2(0x2), pos=596851728
Directory /
X 2 -rwxr-xr-x 0 0 290 2-Jan-2013 23:01 _OS.PAR
X 3 -rwxr-xr-x 0 0 175825020 2-Jan-2013 22:58 _OS.SAV
X 21468 -rwxr-xr-x 0 0 1200592 4-Dec-2006 14:08 _DISK.EXE
X 21663 -rwxr-xr-x 0 0 350336 15-Mar-2008 10:58 _AVEPART.EXE
X 21707 -rwxr-xr-x 0 0 7540 3-Jan-1997 14:53 _ELAY.EXE
3 drwxr-xr-x 0 0 0 8-Dec-2015 22:23 System Volume Information
5 drwxr-xr-x 0 0 0 8-Dec-2015 22:24 $RECYCLE.BIN
Change partition type:
No partition 0 0 1 38912 254 63 625137345
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Danke und Gruß!
medemirt