Code: Select all
Wed Mar 2 01:20:01 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=960197124096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=960197124096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104264105984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1843243008
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=855338123264
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=524271222784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=475915091968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=1895504543744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=104857600000
Hard disk list
Disk /dev/sda - 960 GB / 894 GiB - CHS 116737 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdd - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 104 GB / 97 GiB - CHS 12676 255 63, sector size=512
Drive D: - 1843 MB / 1757 MiB - CHS 439 64 32, sector size=2048
Drive G: - 855 GB / 796 GiB - CHS 103988 255 63, sector size=512
Drive I: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive T: - 524 GB / 488 GiB - CHS 63739 255 63, sector size=512
Drive U: - 475 GB / 443 GiB - CHS 57860 255 63, sector size=512
Drive Y: - 1895 GB / 1765 GiB - CHS 230448 255 63, sector size=512
Drive Z: - 104 GB / 97 GiB - CHS 12748 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB
Partition table type: Intel
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 4177/117/37
filesystem size 1886408704
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 117900543
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4177 117 37 121600 247 55 1886408704
NTFS, blocksize=4096, 965 GB / 899 GiB
BAD_RS LBA=3052784328 2274753
file_pread(6,3,buffer,3052784328(190027/9/7)) lseek err Invalid argument
file_pread(6,1,buffer,3052784328(190027/9/7)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 190027 9 7 273415 196 31 1339640026
This partition ends after the disk limits. (start=3052784328, size=1339640026, end=4392424353, disk end=1953525168)
NTFS at 121600/247/55
filesystem size 1886408704
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 117900543
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4177 117 37 121600 247 55 1886408704
NTFS found using backup sector, blocksize=4096, 965 GB / 899 GiB
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2248 GB / 2094 GiB)
The following partition can't be recovered:
FAT16 <32M 190027 9 7 273415 196 31 1339640026
Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 4177 117 37 121600 247 55 1886408704
NTFS, blocksize=4096, 965 GB / 899 GiB
SIGHUP detected! TestDisk has been killed.