3 NTFS Partitionen weg, nur zwei gefunden + Zylinderproblem

TestDisk benutzen um verlorene Partitionen wiederherzustellen
Forum rules
Your help is welcome: there are currently few answers or none to most message posted in the German forum!
If you want to post a request for help, please consider using the English forum.
Locked
Message
Author
User avatar
fooamp
Posts: 2
Joined: 04 Jan 2016, 16:16

3 NTFS Partitionen weg, nur zwei gefunden + Zylinderproblem

#1 Post by fooamp »

(Sorry für den merkwürdigen Betreff)

Guten Tag liebe Festplattenprofis,


ich hoffe hier Hilfe zu finden, nachdem ich selbst schon über die Grenzen meines bisherigen Wissen gegangen bin und erfolglos blieb. Ich habe versucht, alle relevanten Informationen für euch zusammenzutragen.

Das Problem:
Ein Video-Render hat unter Windows den Rechner (wahrscheinlich) in den Hitzetod getrieben und dabei eine der drei SATA Festplatten mitgerissen. Merkwürdigerweise nicht die Systemplatte, auch nicht die schnelle Arbeitsplatte mit der Auslagerungsdatei, sondern die große und langsame Backup-Platte, die einfach nur mit am System hing.

Die Platte ursprünglich:
2 TB mit drei primären Partitionen, keine davon als Bootpartition.

Die Partitionen ursprünglich:
Alle NTFS mit ca. 1 TB [Video], 500 GB [Backup 2], 500 GB [Audio Backup].

Ich habe mich soweit an die Anleitungen im Wiki gehalten und dabei bereits einiges gelernt. (Danke schon mal dafür!)

Mein Vorgehen:
  • Die Platte hängt via USB-Adapter an einem Notebook.
  • Programm mit Administratorrechten gestartet.
  • Erste Runde quick search mit den erkannten Einstellungen.
  • Am Ende hieß es, ich solle die Heads per Zylinder von 255 auf 16 ändern.
  • Habe ich gemacht und dann die zweite Runde quick search (bei vorheriger "Bad ending head"-Warnung).
  • Beide Durchläufe brachen bei etwas über 50 % der durchsuchten Zylinder ab.
Was letztlich herausgekommen ist, sind jeweils die zwei "gefundenen" 500 GB Partitionen mit auflistbaren Dateien.

Meine Fragen:
Mit welchen Einstellungen soll ich jetzt weiter nach der ersten 1 TB Partition suchen? Mit welchen Werten soll ich die gefundenen Partitionen wieder herstellen? Oder soll ich was ganz anderes machen?

Alles, was ich bisher verstanden habe, habe ich umgesetzt, weiß jetzt aber nicht mehr weiter. Ich will nichts auf die Platte schreiben lassen, was sich als fatal erweisen könnte.

Die log-Datei über den gesamten Prozess (wie hier beschrieben) folgt unten. (Aus Längegründen habe ich die Inhalte der Unterverzeichnisse rausgekürzt und nur die "dir_partition inode="-Werte gelassen. Das riesige Ding namens "vol" in der einen Partition ist ein VeraCrypt-Volume in einer Datei.)


Vielen herzlichen Dank für eure Hilfe,

fooamp

Code: Select all

Mon Jan  4 13:02:32 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80023233024
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000398934016
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 10337 240 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096
Drive C: - 80 GB / 74 GiB - CHS 10336 240 63, sector size=512
Drive E: - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 30400 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   1  1 121599 254 63 1953503937
 1 P HPFS - NTFS              0   1  1 121599 254 63 1953503937
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          121600   0  1 182400 254 63  976768065
 2 P HPFS - NTFS          121600   0  1 182400 254 63  976768065
Invalid NTFS or EXFAT boot
 3 P HPFS - NTFS          182401   0  1 243200 254 63  976752000
 3 P HPFS - NTFS          182401   0  1 243200 254 63  976752000
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 30400 255 63
NTFS at 15200/0/1
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976768065
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61048004
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          15200   0  1 22800  31 56  122096008
     NTFS, blocksize=4096, 500 GB / 465 GiB
NTFS at 22800/31/56
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976752000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61046999
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB
file_pread(5,1,buffer,488378880(30400/45/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378648(30400/42/3)) lseek err Invalid argument
file_pread(5,2,buffer,488378664(30400/42/19)) lseek err Invalid argument
file_pread(5,2,buffer,488378680(30400/42/35)) lseek err Invalid argument
file_pread(5,2,buffer,488378696(30400/42/51)) lseek err Invalid argument
file_pread(5,2,buffer,488378712(30400/43/4)) lseek err Invalid argument
file_pread(5,2,buffer,488378728(30400/43/20)) lseek err Invalid argument
file_pread(5,2,buffer,488378744(30400/43/36)) lseek err Invalid argument
file_pread(5,2,buffer,488378760(30400/43/52)) lseek err Invalid argument
file_pread(5,2,buffer,488378776(30400/44/5)) lseek err Invalid argument
file_pread(5,2,buffer,488378792(30400/44/21)) lseek err Invalid argument
file_pread(5,2,buffer,488378808(30400/44/37)) lseek err Invalid argument
file_pread(5,2,buffer,488378824(30400/44/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378840(30400/45/6)) lseek err Invalid argument
file_pread(5,2,buffer,488378856(30400/45/22)) lseek err Invalid argument
file_pread(5,2,buffer,488378872(30400/45/38)) lseek err Invalid argument
file_pread(5,1,buffer,488378879(30400/45/45)) lseek err Invalid argument
file_pread(5,1,buffer,488378880(30400/45/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378880(30400/45/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378881(30400/45/47)) lseek err Invalid argument
file_pread(5,2,buffer,488378887(30400/45/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378889(30400/45/55)) lseek err Invalid argument
file_pread(5,2,buffer,488378895(30400/45/61)) lseek err Invalid argument
file_pread(5,2,buffer,488379135(30400/49/49)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 16.

Results
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB


dir_partition inode=5
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 .
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 ..
    7804 dr-xr-xr-x     0      0         0 23-Dec-2015 19:29 Backup 2
     166 dr-xr-xr-x     0      0         0  8-Dec-2015 13:09 Musikfilm
      31 dr-xr-xr-x     0      0         0 22-Apr-2014 15:32 RECYCLER
   11563 dr-xr-xr-x     0      0         0  5-Nov-2015 13:18 Serien
      27 dr-xr-xr-x     0      0         0 19-Apr-2014 11:18 System Volume Information
     850 dr-xr-xr-x     0      0         0 20-Oct-2015 19:52 VeraCrypt
     185 -r--r--r--     0      0 268435456000 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol

dir_partition inode=7804
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=166
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=11563
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=850
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB


dir_partition inode=5
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 .
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 ..
   29045 dr-xr-xr-x     0      0         0 14-Jun-2014 16:16 Audio Backup
   28804 dr-xr-xr-x     0      0         0 21-Apr-2014 22:03 RECYCLER
      27 dr-xr-xr-x     0      0         0 19-Apr-2014 11:18 System Volume Information
   30764 dr-xr-xr-x     0      0         0  8-Dec-2015 11:20 Zeugs

dir_partition inode=29045
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=34
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB


interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New geometry
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63 sector_size=4096

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
file_pread(5,1,buffer,1953504000(1938000/0/1)) lseek err Invalid argument
check_part_i386 failed for partition type 07
file_pread(5,1,buffer,2930272065(2907015/15/1)) lseek err Invalid argument
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   1  1 1937999  15 63 1953503937
 1 P HPFS - NTFS              0   1  1 1937999  15 63 1953503937

Warning: Bad ending head (CHS and LBA don't match)
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          1938000   0  1 2907015  14 63  976768065
 2 P HPFS - NTFS          1938000   0  1 2907015  14 63  976768065

Warning: Bad starting head (CHS and LBA don't match)
Invalid NTFS or EXFAT boot
 3 P HPFS - NTFS          2907015  15  1 3876015  14 63  976752000
 3 P HPFS - NTFS          2907015  15  1 3876015  14 63  976752000

Warning: Bad starting head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63
NTFS at 242250/0/1
heads/cylinder 255 (NTFS) != 16 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976768065
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61048004
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          242250   0  1 363376  15 56  122096008
     NTFS, blocksize=4096, 500 GB / 465 GiB
NTFS at 363376/15/56
heads/cylinder 255 (NTFS) != 16 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976752000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61046999
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB
file_pread(5,1,buffer,488378880(484502/13/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378648(484502/10/3)) lseek err Invalid argument
file_pread(5,2,buffer,488378664(484502/10/19)) lseek err Invalid argument
file_pread(5,2,buffer,488378680(484502/10/35)) lseek err Invalid argument
file_pread(5,2,buffer,488378696(484502/10/51)) lseek err Invalid argument
file_pread(5,2,buffer,488378712(484502/11/4)) lseek err Invalid argument
file_pread(5,2,buffer,488378728(484502/11/20)) lseek err Invalid argument
file_pread(5,2,buffer,488378744(484502/11/36)) lseek err Invalid argument
file_pread(5,2,buffer,488378760(484502/11/52)) lseek err Invalid argument
file_pread(5,2,buffer,488378776(484502/12/5)) lseek err Invalid argument
file_pread(5,2,buffer,488378792(484502/12/21)) lseek err Invalid argument
file_pread(5,2,buffer,488378808(484502/12/37)) lseek err Invalid argument
file_pread(5,2,buffer,488378824(484502/12/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378840(484502/13/6)) lseek err Invalid argument
file_pread(5,2,buffer,488378856(484502/13/22)) lseek err Invalid argument
file_pread(5,2,buffer,488378872(484502/13/38)) lseek err Invalid argument
file_pread(5,2,buffer,488378880(484502/13/46)) lseek err Invalid argument
file_pread(5,1,buffer,488378882(484502/13/48)) lseek err Invalid argument
file_pread(5,2,buffer,488378887(484502/13/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378889(484502/13/55)) lseek err Invalid argument
file_pread(5,3,buffer,488378895(484502/13/61)) lseek err Invalid argument
file_pread(5,1,buffer,488379136(484503/1/50)) lseek err Invalid argument
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB


dir_partition inode=5
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 .
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 ..
    7804 dr-xr-xr-x     0      0         0 23-Dec-2015 19:29 Backup 2
     166 dr-xr-xr-x     0      0         0  8-Dec-2015 13:09 Musikfilm
      31 dr-xr-xr-x     0      0         0 22-Apr-2014 15:32 RECYCLER
   11563 dr-xr-xr-x     0      0         0  5-Nov-2015 13:18 Serien
      27 dr-xr-xr-x     0      0         0 19-Apr-2014 11:18 System Volume Information
     850 dr-xr-xr-x     0      0         0 20-Oct-2015 19:52 VeraCrypt
     185 -r--r--r--     0      0 268435456000 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol
     185 -r--r--r--     0      0         0 20-Oct-2015 19:17 vol

dir_partition inode=7804
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=166
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=11563
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=850
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB


dir_partition inode=5
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 .
       5 dr-xr-xr-x     0      0         0 20-Dec-2015 16:46 ..
   29045 dr-xr-xr-x     0      0         0 14-Jun-2014 16:16 Audio Backup
   28804 dr-xr-xr-x     0      0         0 21-Apr-2014 22:03 RECYCLER
      27 dr-xr-xr-x     0      0         0 19-Apr-2014 11:18 System Volume Information
   30764 dr-xr-xr-x     0      0         0  8-Dec-2015 11:20 Zeugs

dir_partition inode=29045
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB

dir_partition inode=34
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB


interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
edit: typo

User avatar
fooamp
Posts: 2
Joined: 04 Jan 2016, 16:16

Re: 3 NTFS Partitionen weg, nur zwei gefunden + Zylinderprob

#2 Post by fooamp »

So, ich habe jetzt mit beiden Einstellungen (heads per cylinder 255 und 16) je ein deep search veranstaltet und bin so schlau wie vorher.

Das einzig neue ist, dass mir gesagt wird, die Festplatte sei zu klein (?). Könnte das der Grund sein, dass er nur zwei von drei Partitionen überhaupt findet?

Code: Select all

Mon Jan 11 15:01:46 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80023233024
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000398934016
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 10337 240 63, sector size=512
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096
Drive C: - 80 GB / 74 GiB - CHS 10336 240 63, sector size=512
Drive E: - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 30400 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   1  1 121599 254 63 1953503937
 1 P HPFS - NTFS              0   1  1 121599 254 63 1953503937
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          121600   0  1 182400 254 63  976768065
 2 P HPFS - NTFS          121600   0  1 182400 254 63  976768065
Invalid NTFS or EXFAT boot
 3 P HPFS - NTFS          182401   0  1 243200 254 63  976752000
 3 P HPFS - NTFS          182401   0  1 243200 254 63  976752000
No partition is bootable

*** deep search mit heads per cylinder 255 ***

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 30400 255 63
NTFS at 15200/0/1
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976768065
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61048004
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          15200   0  1 22800  31 56  122096008
     NTFS, blocksize=4096, 500 GB / 465 GiB
BAD_RS LBA=2361735886 9747614
file_pread(5,1,buffer,2361735886(147011/66/14)) lseek err Invalid argument
check_part_i386 failed for partition type 07
     HPFS - NTFS          147011  66 14 174299 144 24  438386645
This partition ends after the disk limits. (start=2361735886, size=438386645, end=2800122530, disk end=488378646)
NTFS at 22800/31/56
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976752000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61046999
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB
BAD_RS LBA=2370373624 9693681
file_pread(5,1,buffer,2370373624(147548/238/11)) lseek err Invalid argument
check_part_i386 failed for partition type 07
     HPFS - NTFS          147548 238 11 354680   9 34 3327561177
This partition ends after the disk limits. (start=2370373624, size=3327561177, end=5697934800, disk end=488378646)
file_pread(5,1,buffer,488378880(30400/45/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378648(30400/42/3)) lseek err Invalid argument
file_pread(5,2,buffer,488378664(30400/42/19)) lseek err Invalid argument
file_pread(5,2,buffer,488378680(30400/42/35)) lseek err Invalid argument
file_pread(5,2,buffer,488378696(30400/42/51)) lseek err Invalid argument
file_pread(5,2,buffer,488378712(30400/43/4)) lseek err Invalid argument
file_pread(5,2,buffer,488378728(30400/43/20)) lseek err Invalid argument
file_pread(5,2,buffer,488378744(30400/43/36)) lseek err Invalid argument
file_pread(5,2,buffer,488378760(30400/43/52)) lseek err Invalid argument
file_pread(5,2,buffer,488378776(30400/44/5)) lseek err Invalid argument
file_pread(5,2,buffer,488378792(30400/44/21)) lseek err Invalid argument
file_pread(5,2,buffer,488378808(30400/44/37)) lseek err Invalid argument
file_pread(5,2,buffer,488378824(30400/44/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378840(30400/45/6)) lseek err Invalid argument
file_pread(5,2,buffer,488378856(30400/45/22)) lseek err Invalid argument
file_pread(5,2,buffer,488378872(30400/45/38)) lseek err Invalid argument
file_pread(5,1,buffer,488378879(30400/45/45)) lseek err Invalid argument
file_pread(5,1,buffer,488378880(30400/45/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378880(30400/45/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378881(30400/45/47)) lseek err Invalid argument
file_pread(5,2,buffer,488378887(30400/45/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378889(30400/45/55)) lseek err Invalid argument
file_pread(5,2,buffer,488378895(30400/45/61)) lseek err Invalid argument
file_pread(5,2,buffer,488379135(30400/49/49)) lseek err Invalid argument
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 30400 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 23 TB / 21 TiB)
The following partitions can't be recovered:
     HPFS - NTFS          147011  66 14 174299 144 24  438386645
     HPFS - NTFS          147548 238 11 354680   9 34 3327561177
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 16.

Results
     HPFS - NTFS          15200   0  1 22800 254 63  122110065
     NTFS, blocksize=4096, 500 GB / 465 GiB
     HPFS - NTFS          22800  31 56 30400  31 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.



Thu Jan 14 08:35:29 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80023233024
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000398934016
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 10337 240 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096
Drive C: - 80 GB / 74 GiB - CHS 10336 240 63, sector size=512
Drive E: - 2000 GB / 1863 GiB - CHS 30400 255 63, sector size=4096

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB
Partition table type: Intel
New geometry
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63 sector_size=4096

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   1  1 1937999  15 63 1953503937
 1 P HPFS - NTFS              0   1  1 1937999  15 63 1953503937

Warning: Bad ending head (CHS and LBA don't match)
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          1938000   0  1 2907015  14 63  976768065
 2 P HPFS - NTFS          1938000   0  1 2907015  14 63  976768065

Warning: Bad starting head (CHS and LBA don't match)
Invalid NTFS or EXFAT boot
 3 P HPFS - NTFS          2907015  15  1 3876015  14 63  976752000
 3 P HPFS - NTFS          2907015  15  1 3876015  14 63  976752000

Warning: Bad starting head (CHS and LBA don't match)
No partition is bootable

*** deep search mit heads per cylinder 16 ***

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63
NTFS at 242250/0/1
heads/cylinder 255 (NTFS) != 16 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976768065
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61048004
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          242250   0  1 363376  15 56  122096008
     NTFS, blocksize=4096, 500 GB / 465 GiB
BAD_RS LBA=2361735886 623072
file_pread(5,1,buffer,2361735886(2342991/15/14)) lseek err Invalid argument
check_part_i386 failed for partition type 07
     HPFS - NTFS          2342991  15 14 2777899   5 24  438386645
This partition ends after the disk limits. (start=2361735886, size=438386645, end=2800122530, disk end=488379024)
NTFS at 363376/15/56
heads/cylinder 255 (NTFS) != 16 (HD)
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size           976752000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               61046999
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB
BAD_RS LBA=2370373624 614310
file_pread(5,1,buffer,2370373624(2351561/2/11)) lseek err Invalid argument
check_part_i386 failed for partition type 07
     HPFS - NTFS          2351561   2 11 5652713   1 34 3327561177
This partition ends after the disk limits. (start=2370373624, size=3327561177, end=5697934800, disk end=488379024)
file_pread(5,1,buffer,488378880(484502/13/46)) lseek err Invalid argument
file_pread(5,2,buffer,488378648(484502/10/3)) lseek err Invalid argument
file_pread(5,2,buffer,488378664(484502/10/19)) lseek err Invalid argument
file_pread(5,1,buffer,488378670(484502/10/25)) lseek err Invalid argument
file_pread(5,2,buffer,488378680(484502/10/35)) lseek err Invalid argument
file_pread(5,2,buffer,488378696(484502/10/51)) lseek err Invalid argument
file_pread(5,2,buffer,488378712(484502/11/4)) lseek err Invalid argument
file_pread(5,2,buffer,488378728(484502/11/20)) lseek err Invalid argument
file_pread(5,2,buffer,488378744(484502/11/36)) lseek err Invalid argument
file_pread(5,2,buffer,488378760(484502/11/52)) lseek err Invalid argument
file_pread(5,2,buffer,488378776(484502/12/5)) lseek err Invalid argument
file_pread(5,2,buffer,488378792(484502/12/21)) lseek err Invalid argument
file_pread(5,2,buffer,488378808(484502/12/37)) lseek err Invalid argument
file_pread(5,2,buffer,488378824(484502/12/53)) lseek err Invalid argument
file_pread(5,2,buffer,488378840(484502/13/6)) lseek err Invalid argument
file_pread(5,2,buffer,488378856(484502/13/22)) lseek err Invalid argument
file_pread(5,2,buffer,488378872(484502/13/38)) lseek err Invalid argument
file_pread(5,1,buffer,488378879(484502/13/45)) lseek err Invalid argument
file_pread(5,1,buffer,488378880(484502/13/46)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 484503 16 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 23 TB / 21 TiB)
The following partitions can't be recovered:
     HPFS - NTFS          2342991  15 14 2777899   5 24  438386645
     HPFS - NTFS          2351561   2 11 5652713   1 34 3327561177
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
     HPFS - NTFS          242250   0  1 363376  15 63  122096016
     NTFS, blocksize=4096, 500 GB / 465 GiB
     HPFS - NTFS          363376  15 56 484501  15 56  122094000
     NTFS, blocksize=4096, 500 GB / 465 GiB

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Ich hoffe sehr, dass sich jemand findet, der mir einen Anstoß zum weitersuchen geben kann.

Danke!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: 3 NTFS Partitionen weg, nur zwei gefunden + Zylinderprob

#3 Post by Fiona »

In deiner gegenwärtigen Partitionstabelle befinden sich Partitionen welche entweder falsch sind oder einen ungültigen Bootsektor aufweisen.
Mache mal an der Geometrie nichts und hattest du die tiefere Suche Deeper Search (nicht Quick Search) laufen lassen?
Hatte jetzt so auf der Schnelle in deiner Log keine Hinweise gefunden?
Bei NTFS ist der letzte Sektor einer Partition das Backup des Bootsektors und wird nur in der tieferen Suche Deeper Search gefunden, welche zusätzlich nach einem Backup vom Bootsektor sucht.
Kann somit mehr Partitionen finden.

Fiona

Locked