These two 2Tb hard drives were originally basic drives and were later converted into dynamic drives in Windows 7.
They were originally used as internal hard drives. I have then changed to a laptop and tried to get access through a USB/SATA adaptor. Both hard drives are seen as "unvalid" in the disk management windows 7 software on my laptop. I have tried without success to recover the partitions with testdisk.
The first hard drive contained 2 volumes in 4 partitions
First volume was 598gb, in one partition.
Second volume was 1263gb, in three partitions (283gb, 390gb, 590gb).
The current partition structure after analysis in testdisk shows the two volumes I think:
From the result of the quick search it seems that I can only recover the first 598gb partition (confirmed after having listed the files in it through testdisk):Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 0 32 32 1985
2 * W2K Dynamic/SFS 0 32 33 78162 53 35 1255673856
3 P W2K Dynamic/SFS 78162 53 36 243201 48 31 2651351216
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4605 GB / 4289 GiB)
The following partitions can't be recovered:
HPFS - NTFS 166124 219 48 331163 114 23 2651344896
NTFS, blocksize=4096, 1357 GB / 1264 GiB
FAT16 LBA 170434 210 6 303570 232 16 2138831237
FAT12 454828 224 2 559925 61 18 1688373053
Results
* HPFS - NTFS 0 32 33 78162 53 35 1255673856
NTFS, blocksize=4096, 642 GB / 598 GiB
The second hard drive contained 2 volumes in 3 partitions
First volume was 1147gb, in two partitions (977gb, 170gb).
Second volume was 715gb, in one partitions.
Instead of showing 3 partitions, I get from the preliminary analysis:
After quick search, I get similar results to the first hard drive. Only the first 976gb partition can be read. (I can list all the files).Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 243201 48 31 3907027057
No partition is bootable
I have tried to understand from previous topics on this forum how to solve the fact that the partitions are seen as bigger as they really are ("seems to small" problem), but couldn't figure it out.
Should I try to change the geometry?
Should I rebuild the boot sector? Problem is that in the advanced menu, the option "boot" is not available (only "type", "image" and "quit")
I am a bit lost ... Could someone help me on this please?
Thanks!
First hard drive log file:
Code: Select all
Sun Jul 6 17:02:12 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104376303616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=22084059136
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG MZ7TD128HAFV-000, S/N:S14TNSADB23170, FW:DXT0
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL 003-9VT166
Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - ST2000DL 003-9VT166
Partition table type: Intel
Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=240 sector=63
check_part_i386 1 type 42: no test
check_part_i386 2 type 42: no test
check_part_i386 3 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 0 32 32 1985
2 * W2K Dynamic/SFS 0 32 33 78162 53 35 1255673856
3 P W2K Dynamic/SFS 78162 53 36 243201 48 31 2651351216
Backup partition structure
partition_save
search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 1255673856
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 78162 53 35 1255673856
NTFS, blocksize=4096, 642 GB / 598 GiB
BAD_RS LBA=2738035445 6499327
check_part_i386 failed for partition type 0E
FAT16 LBA 170434 210 6 303570 232 16 2138831237
This partition ends after the disk limits. (start=2738035445, size=2138831237, end=4876866681, disk end=3907029168)
NTFS at 166124/219/48
filesystem size 2651344896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 166124 219 48 331163 114 23 2651344896
NTFS, blocksize=4096, 1357 GB / 1264 GiB
This partition ends after the disk limits. (start=2668795904, size=2651344896, end=5320140799, disk end=3907029168)
BAD_RS LBA=3011858637 3341521
file_pread(5,3,buffer,3011858637(454828/224/2)) lseek err Invalid argument
file_pread(5,1,buffer,3011858637(454828/224/2)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 454828 224 2 559925 61 18 1688373053
This partition ends after the disk limits. (start=7306825933, size=1688373053, end=8995198985, disk end=3907029168)
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(5,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(5,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(5,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(5,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4605 GB / 4289 GiB)
The following partitions can't be recovered:
HPFS - NTFS 166124 219 48 331163 114 23 2651344896
NTFS, blocksize=4096, 1357 GB / 1264 GiB
FAT16 LBA 170434 210 6 303570 232 16 2138831237
FAT12 454828 224 2 559925 61 18 1688373053
Results
* HPFS - NTFS 0 32 33 78162 53 35 1255673856
NTFS, blocksize=4096, 642 GB / 598 GiB
dir_partition inode=5
* HPFS - NTFS 0 32 33 78162 53 35 1255673856
NTFS, blocksize=4096, 642 GB / 598 GiB
Directory /
5 dr-xr-xr-x 0 0 0 23-Mar-2014 12:15 .
5 dr-xr-xr-x 0 0 0 23-Mar-2014 12:15 ..
37 dr-xr-xr-x 0 0 0 6-Jul-2014 01:06 $RECYCLE.BIN
23011 dr-xr-xr-x 0 0 0 3-Jun-2013 03:03 FAMILLE_GALLAND
23014 dr-xr-xr-x 0 0 0 3-Jun-2013 07:50 FAMILLE_LIGER
23172 dr-xr-xr-x 0 0 0 20-Oct-2013 00:07 FILMS
1155 dr-xr-xr-x 0 0 0 19-Oct-2013 16:16 MONTAGE_DOMINIQUE
1332 dr-xr-xr-x 0 0 0 23-Mar-2014 12:15 Singing
35 dr-xr-xr-x 0 0 0 2-Jun-2013 06:09 System Volume Information
40 dr-xr-xr-x 0 0 0 17-Feb-2014 03:03 TV
1167 dr-xr-xr-x 0 0 0 19-Oct-2013 16:25 UQBIGBAND
1573 dr-xr-xr-x 0 0 0 5-Feb-2014 06:40 VIDEOS-GALLAND-1964-1965
1541 dr-xr-xr-x 0 0 0 3-Feb-2014 23:39 VIDEOS-GALLAND-2001-2013
1578 dr-xr-xr-x 0 0 0 5-Feb-2014 07:00 VIDEOS-LIGER-1973-1975
1586 dr-xr-xr-x 0 0 0 5-Feb-2014 08:47 VIDEOS-LIGER-1989-1996
1171 dr-xr-xr-x 0 0 0 20-Oct-2013 00:06 Video-MGTS7303
83 dr-xr-xr-x 0 0 0 6-Feb-2014 04:13 dd-rouge
1540 -r--r--r-- 0 0 379 10-Dec-2013 12:19 MULTIBOOT (G) - Raccourci.lnk
84 -r--r--r-- 0 0 1852895 7-Aug-2012 17:31 Matthieu.prproj
85 -r--r--r-- 0 0 1487990338 7-Aug-2012 16:38 Matthieu_1977-1982.avi
86 -r--r--r-- 0 0 156366421 7-Aug-2012 18:16 Matthieu_1977-1982_H264.mp4
87 -r--r--r-- 0 0 1450471202 7-Aug-2012 17:34 Matthieu_1989-1992.avi
88 -r--r--r-- 0 0 147998787 7-Aug-2012 19:26 Matthieu_1989-1992_H264.mp4
interface_write()
1 * HPFS - NTFS 0 32 33 78162 53 35 1255673856
Second hard-drive log file before quick search:
Code: Select all
Sun Jul 6 11:50:03 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-06-21T09:12:27
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104376303616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=22084059136
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG MZ7TD128HAFV-000, S/N:S14TNSADB23170, FW:DXT0
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-1CH164
Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - ST2000DM 001-1CH164
Partition table type: Intel
Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 243201 48 31 3907027057
No partition is bootable