NTFS Partition auf defekter Plattewieder herstellen

TestDisk benutzen um verlorene Partitionen wiederherzustellen
Forum rules
Your help is welcome: there are currently few answers or none to most message posted in the German forum!
If you want to post a request for help, please consider using the English forum.
Locked
Message
Author
yhaa12
Posts: 1
Joined: 19 Jun 2016, 10:02

NTFS Partition auf defekter Plattewieder herstellen

#1 Post by yhaa12 »

Hallo Leute,

in den vorhandenen Foreneinträgen bin ich nicht fündig geworden.

Ich kann auf eine externe 2TB Festplatte (HP Desktop HD BD07 USB 3.0 mit HP Simple save SW) nicht mehr zugreifen.

Es geht um /dev/sdb.

Testdisk Lauf mit Intel/Analyse ergab folgendes Bild:

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511060213760
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000393601024
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 511 GB / 475 GiB - CHS 62132 255 63, sector size=512
Drive E: - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 32 33 243200 203 11 3907018752
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 32 33 243200 203 11 3907018752
1 P FAT16 >32M 0 32 33 243200 203 11 3907018752
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63

recover_EXT2: s_block_group_nr=0/17, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=7984
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 574288
recover_EXT2: part_size 4594304
Linux 58105 179 59 58391 175 24 4594304
ext2 blocksize=4096 Large_file Sparse_SB, 2352 MB / 2243 MiB
BAD_RS LBA=934852439 10172856
file_pread(5,3,buffer,934852439(325541/56/43)) lseek err Invalid argument
file_pread(5,1,buffer,934852439(325541/56/43)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 325541 56 43 332979 4 48 119488200
This partition ends after the disk limits. (start=5229819735, size=119488200, end=5349307934, disk end=3907024896)
BAD_RS LBA=117865727 3567058
file_pread(5,3,buffer,117865727(274686/38/40)) lseek err Invalid argument
file_pread(5,1,buffer,117865727(274686/38/40)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 274686 38 40 363799 101 20 1431604295
This partition ends after the disk limits. (start=4412833023, size=1431604295, end=5844437317, disk end=3907024896)
file_pread(5,2,buffer,3907024896(243201/13/13)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,3907024896(243201/13/13)) ReadFile The drive cannot find the sector requested.

file_pread(5,2,buffer,3907026112(243201/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,3907026112(243201/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,3907026113(243201/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,3907026176(243201/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,3907026176(243201/33/33)) lseek err Invalid argument
file_pread(5,14,buffer,3907024897(243201/13/14)) lseek err Invalid argument
file_pread(5,1,buffer,3907024897(243201/13/14)) lseek err Invalid argument
file_pread(5,8,buffer,3907024903(243201/13/20)) lseek err Invalid argument
file_pread(5,3,buffer,3907024911(243201/13/28)) lseek err Invalid argument
file_pread(5,3,buffer,3907024958(243201/14/12)) lseek err Invalid argument
file_pread(5,8,buffer,3907024974(243201/14/28)) lseek err Invalid argument
file_pread(5,11,buffer,3907025021(243201/15/12)) lseek err Invalid argument
file_pread(5,2,buffer,3907026943(243201/45/44)) lseek err Invalid argument
file_pread(5,2,buffer,3907024896(243201/13/13)) ReadFile The drive cannot find the sector requested.

file_pread(5,14,buffer,3907024898(243201/13/15)) lseek err Invalid argument
file_pread(5,1,buffer,3907024914(243201/13/31)) lseek err Invalid argument
file_pread(5,1,buffer,3907024961(243201/14/15)) lseek err Invalid argument
file_pread(5,1,buffer,3907024982(243201/14/36)) lseek err Invalid argument
file_pread(5,1,buffer,3907025032(243201/15/23)) lseek err Invalid argument
file_pread(5,1,buffer,3907026945(243201/45/46)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 2992 GB / 2786 GiB)
The following partitions can't be recovered:
FAT32 274686 38 40 363799 101 20 1431604295
FAT16 >32M 325541 56 43 332979 4 48 119488200

Results
* Linux 58105 179 59 58391 197 46 4595712
ext2 blocksize=4096 Large_file Sparse_SB, 2353 MB / 2244 MiB
SIGINT detected! TestDisk has been killed.



Da ich kein FAT32 erwarte, sondern nur eine einzige NTFS Partition auf der Platte habe ich den zweiten testdisk Lauf mit dem Modus "Advanced"07 (HP-NTFS)"
durchgeführt und nun folgendes Ergebnis.
Ich kann die korrekte Directory-Struktur sehen.


TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511060213760
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000393601024
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 511 GB / 475 GiB - CHS 62132 255 63, sector size=512
Drive E: - 2000 GB / 1863 GiB - CHS 243200 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 32 33 243200 203 11 3907018752
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
1 P FAT16 >32M 0 32 33 243200 203 11 3907018752
Change partition type:
1 P HPFS - NTFS 0 32 33 243200 203 11 3907018752

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243200 203 11 3907018752
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 3907018752 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Extrapolated boot sector and current boot sector are different.
filesystem size 3907018752 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0

Directory /
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 .
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 ..
19116 dr-xr-xr-x 0 0 0 5-Sep-2012 17:23 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 25-Feb-2012 12:33 Backup Files
259 dr-xr-xr-x 0 0 0 22-Feb-2011 17:59 Documentation
22946 dr-xr-xr-x 0 0 0 1-Dec-2015 13:30 Elibook8460p
18993 dr-xr-xr-x 0 0 0 4-Dec-2012 15:06 Filme
312 dr-xr-xr-x 0 0 0 25-Feb-2012 12:33 HP SimpleSave Application
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 Laptop_rdhaase
308 dr-xr-xr-x 0 0 0 16-Jun-2016 19:30 System Volume Information
257 dr-xr-xr-x 0 0 0 22-Feb-2011 17:59 autorun
19114 -r--r--r-- 0 0 0 25-Feb-2012 13:02 ArcBackupedFlag
311 -r--r--r-- 0 0 1066904 26-May-2011 15:14 HPSimpleSave.exe
255 -r--r--r-- 0 0 36 14-Aug-2010 03:14 autorun.inf
Directory /Laptop_rdhaase
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 .
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 ..
19015 dr-xr-xr-x 0 0 0 28-Mar-2016 09:49 Acronis_Images
18991 dr-xr-xr-x 0 0 0 16-Jun-2016 06:48 Data Backup
Directory /Laptop_rdhaase/Data Backup
18991 dr-xr-xr-x 0 0 0 16-Jun-2016 06:48 .
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 ..
24732 -r--r--r-- 0 0 120348284416 27-Jun-2015 20:38 rdhaase_ganze_C_Platte2015-06-27.tib
26420 -r--r--r-- 0 0 64585349632 25-Sep-2015 21:44 rdhaase_ganze_C_Platte2015-09-25.tib
42357 -r--r--r-- 0 0 97704223744 28-Mar-2016 15:41 rdhaase_user_data2016-03-28.tib
49431 -r--r--r-- 0 0 1588488192 20-Apr-2016 10:04 rdhaase_user_data2016-04-20.tib
35164 -r--r--r-- 0 0 1166016512 16-Jun-2016 07:37 rdhaase_user_data2016-06-16(2).tib
Directory /Laptop_rdhaase
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 .
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 ..
19015 dr-xr-xr-x 0 0 0 28-Mar-2016 09:49 Acronis_Images
18991 dr-xr-xr-x 0 0 0 16-Jun-2016 06:48 Data Backup
Directory /Laptop_rdhaase/Acronis_Images
19015 dr-xr-xr-x 0 0 0 28-Mar-2016 09:49 .
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 ..
19017 -r--r--r-- 0 0 43428663296 26-Feb-2012 10:35 First_Image_rdhaase_PC.tib
26671 -r--r--r-- 0 0 145044678144 24-Sep-2015 21:54 Image_rdhaase_PC_2015-09-24(1).tib
24102 -r--r--r-- 0 0 146269606912 28-Mar-2016 11:07 Image_rdhaase_PC_2016-03-28.tib
Directory /Laptop_rdhaase
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 .
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 ..
19015 dr-xr-xr-x 0 0 0 28-Mar-2016 09:49 Acronis_Images
18991 dr-xr-xr-x 0 0 0 16-Jun-2016 06:48 Data Backup
Directory /
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 .
5 dr-xr-xr-x 0 0 0 30-May-2016 08:26 ..
19116 dr-xr-xr-x 0 0 0 5-Sep-2012 17:23 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 25-Feb-2012 12:33 Backup Files
259 dr-xr-xr-x 0 0 0 22-Feb-2011 17:59 Documentation
22946 dr-xr-xr-x 0 0 0 1-Dec-2015 13:30 Elibook8460p
18993 dr-xr-xr-x 0 0 0 4-Dec-2012 15:06 Filme
312 dr-xr-xr-x 0 0 0 25-Feb-2012 12:33 HP SimpleSave Application
22791 dr-xr-xr-x 0 0 0 29-Oct-2012 12:56 Laptop_rdhaase
308 dr-xr-xr-x 0 0 0 16-Jun-2016 19:30 System Volume Information
257 dr-xr-xr-x 0 0 0 22-Feb-2011 17:59 autorun
19114 -r--r--r-- 0 0 0 25-Feb-2012 13:02 ArcBackupedFlag
311 -r--r--r-- 0 0 1066904 26-May-2011 15:14 HPSimpleSave.exe
255 -r--r--r-- 0 0 36 14-Aug-2010 03:14 autorun.inf
filesystem size 3907018752 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243200 203 11 3907018752
filesystem size 1
sectors_per_cluster 0
mft_lcn 0
mftmirr_lcn 0
clusters_per_mft_record 0
clusters_per_index_record 0
Boot sector
Status: Bad


Backup boot sector
Status: Bad


Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.


Ich verstehe, dass ich einen NTFS boot sector für die Wiederherstellung brauche. Beide sind im Status "bad".

Meine Fragen:
Welche Möglichkeit habe ich den Bootsektor wiederherzustellen?
Wie kann ich das NTFS Filesystem retten oder ein einzelnes Acronis .tib retten?

Locked