TestDisk crash

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
DavidO
Posts: 1
Joined: 23 Apr 2014, 16:53

TestDisk crash

#1 Post by DavidO »

Hi,
I wanted to use TestDisk to repair a corrupted USB flash drive (32GB, NTFS formated). After an USB hub failed, Windows reported that this disk is not formated.

TestDisk opened the disk, but after going to Advanced/Boot/List or Advanced/Boot/RepairMFT it crashed (both in 32 as well as 64bit version). The system is Windows7 Enterprise, SP1, 64bit.

I used a low-level disk editor and went into MFT debugging and have found there is a problem in the $MFT and $MFTmirr records. Three bits were incorrect. After correcting them, TestDisk does not crash.
In my particular case, this was wrong:
$MFT record + 0x14 (Offset to the First Attribute) was 0x18 should be 0x38
$MFT record + 0x40 (first attribute, Non-resident flag) was 0x40 should be 0x00 (I bet the $STANDARD_INFORMATION attribute is resident)
$MFTmirr record + 0x14 (Offset to the First Attribute) was 0x18 should be 0x38

After patching these three bits, Windows are OK with the stick and use it well (seems all the contents is there like before the hub failure). Also, TestDisk does not crash and walking through the structure (via Advanced/List or Advanced/Boot/List) is OK. Advanced/Boot/RepairMFT says "MFT and MFT mirror are bad. Failed to repair them." which still signalizes an unresolved (and in TestDisk unresolvable) problem, but at least TestDisk does not crash.

I tested a little with grabbing the image.dd and patching it and it seems that if any of the three mentioned bits is toggled bad, TestDisk crashes. I suppose it would probably behave similarly if any other "structural" data is corrupted. Attached is the stackdump from 32bit version, the x64 did not create it.

Hope this can help to improve TestDisk in future versions. It is really very nice tool!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: TestDisk crash

#2 Post by cgrenier »

The bug is in ntfsprogs 2.0. I have published a new TestDisk 7.0-WIP for Windows 32 bits that uses ntfs-3g_ntfsprogs where the bug is corrected. The Windows 64 bit version is still affected.

Locked