Lost Partition, unable to restore, no result with second scan

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
maro
Posts: 4
Joined: 17 Oct 2016, 19:28

Lost Partition, unable to restore, no result with second scan

#1 Post by maro »

Hello,
i got a corrupted hdd without any data.
With a deep search the preview showed some files and folders from the lost partition.
I tried to recover the partition and boot sector, but after the reboot the hdd was shown in windows as CD/DVD-drive without any data.
I did a deep search again and did not find anything anymore.

Can I recreate the partition table with the information of the logfile below? Is the information useful at all? What did I wrong for the recovery?

Thanks and regards

Code: Select all

-- First Scan

Sun Oct 16 23:18:56 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249557607936
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500693504
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\H:
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30340 255 63, sector size=512
Drive G: - 500 MB / 477 MiB - CHS 60 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 16450559
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 60801  80 63  976773167

Bad relative sector.
No partition is bootable

search_part()
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 60800/254/63
filesystem size           976766017
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 60800 254 63  976766017
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size           976766017
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          60800 254 63 121601 222 30  976766017
     NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976766017, end=1953534080, disk end=976773168)
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
     HPFS - NTFS          60800 254 63 121601 222 30  976766017
     NTFS, blocksize=4096, 500 GB / 465 GiB

Results
   * HPFS - NTFS              0  32 33 60801  15 14  976766976
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS filesystem need to be repaired.


dir_partition inode=5
   * HPFS - NTFS              0  32 33 60801  15 14  976766976
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 17-Aug-2016 13:39 .
       5 dr-xr-xr-x     0      0         0 17-Aug-2016 13:39 ..
  121303 dr-xr-xr-x     0      0         0 24-Dec-2015 23:44 Foobar File
   54663 dr-xr-xr-x     0      0         0 15-Jun-2015 15:51 Foobar File
  155000 dr-xr-xr-x     0      0         0  2-Nov-2015 12:31 Foobar File
  170675 dr-xr-xr-x     0      0         0 22-Dec-2015 14:17 Foobar File
   68210 dr-xr-xr-x     0      0         0 10-Jul-2016 12:06 Foobar File
  149855 dr-xr-xr-x     0      0         0 27-Apr-2016 14:39 Foobar File
  124661 dr-xr-xr-x     0      0         0 27-Apr-2016 14:31 Foobar File
  120995 dr-xr-xr-x     0      0         0  2-Sep-2013 18:57 Foobar File
  124658 dr-xr-xr-x     0      0         0  4-Dec-2013 11:53 Foobar File
  139193 dr-xr-xr-x     0      0         0  4-Jul-2014 09:18 Foobar File
   68023 dr-xr-xr-x     0      0         0 12-Nov-2013 16:10 Foobar File
   22376 dr-xr-xr-x     0      0         0 16-Sep-2011 16:25 Foobar File
   68234 dr-xr-xr-x     0      0         0  3-Dec-2012 14:51 Foobar File
   26869 dr-xr-xr-x     0      0         0  2-Sep-2013 18:33 Foobar File
  150060 dr-xr-xr-x     0      0         0  3-Jul-2015 12:17 Foobar File
   46920 dr-xr-xr-x     0      0         0  6-Jun-2012 12:15 Foobar File
   86745 dr-xr-xr-x     0      0         0 26-May-2013 12:16 Foobar File
   68022 dr-xr-xr-x     0      0         0  2-Sep-2013 18:33 Foobar File
  172554 dr-xr-xr-x     0      0         0 10-Jul-2016 12:17 Foobar File
      41 dr-xr-xr-x     0      0         0 10-May-2014 12:29 Foobar File
  157259 dr-xr-xr-x     0      0         0  9-Dec-2015 23:18 Foobar File
   26863 dr-xr-xr-x     0      0         0  9-Jan-2012 14:35 Foobar File
  139215 dr-xr-xr-x     0      0         0 28-Aug-2014 20:45 Foobar File
      36 dr-xr-xr-x     0      0         0 21-Aug-2016 20:14 Foobar File
  139214 dr-xr-xr-x     0      0         0 15-Jul-2015 13:56 Foobar File
  172661 dr-xr-xr-x     0      0         0 17-Aug-2016 14:01 Foobar File
  150973 dr-xr-xr-x     0      0         0 31-May-2015 22:33 Foobar File
  172660 dr-xr-xr-x     0      0         0 10-Aug-2016 11:14 Foobar File
   22371 -r--r--r--     0      0   5506400 20-Jun-2014 11:25 Foobar File
   22372 -r--r--r--     0      0    813408 20-Jun-2014 11:25 Foobar File
      35 -r--r--r--     0      0   6726910  2-Sep-2011 09:29 Foobar File
  170670 -r--r--r--     0      0 880878828 10-Dec-2015 14:45 Foobar File
  170674 -r--r--r--     0      0 962730957 14-Dec-2015 23:57 Foobar File
  120992 -r--r--r--     0      0      6144  2-Sep-2013 18:33 Foobar File
  120992 -r--r--r--     0      0         0  2-Sep-2013 18:33 Foobar File

interface_write()
 1 * HPFS - NTFS              0  32 33 60801  15 14  976766976
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

ntfs_boot_sector
 1 * HPFS - NTFS              0  32 33 60801  15 14  976766976
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
filesystem size           1 0
sectors_per_cluster       0 255
mft_lcn                   0 4294967295
mftmirr_lcn               0 4294967295
clusters_per_mft_record   0 -1
clusters_per_index_record 0 -1
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 6291456
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: mft_record_size     1024
ntfs_find_mft: index_block_size    4096
             New / Current boot sector
filesystem size           976766976 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Extrapolated boot sector and current boot sector are different.
filesystem size           976766976 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
NTFS filesystem need to be repaired.

Directory /
       5 dr-xr-xr-x     0      0         0 17-Aug-2016 13:39 .
       5 dr-xr-xr-x     0      0         0 17-Aug-2016 13:39 ..
  121303 dr-xr-xr-x     0      0         0 24-Dec-2015 23:44 Foobar file 
   54663 dr-xr-xr-x     0      0         0 15-Jun-2015 15:51 Foobar file 
  155000 dr-xr-xr-x     0      0         0  2-Nov-2015 12:31 Foobar file 
  170675 dr-xr-xr-x     0      0         0 22-Dec-2015 14:17 Foobar file 
   68210 dr-xr-xr-x     0      0         0 10-Jul-2016 12:06 Foobar file 
  149855 dr-xr-xr-x     0      0         0 27-Apr-2016 14:39 Foobar file 
  124661 dr-xr-xr-x     0      0         0 27-Apr-2016 14:31 Foobar file 
  120995 dr-xr-xr-x     0      0         0  2-Sep-2013 18:57 Foobar file 
  124658 dr-xr-xr-x     0      0         0  4-Dec-2013 11:53 Foobar file 
  139193 dr-xr-xr-x     0      0         0  4-Jul-2014 09:18 Foobar file 
   68023 dr-xr-xr-x     0      0         0 12-Nov-2013 16:10 Foobar file
   22376 dr-xr-xr-x     0      0         0 16-Sep-2011 16:25 Foobar file 
   68234 dr-xr-xr-x     0      0         0  3-Dec-2012 14:51 Foobar file 
   26869 dr-xr-xr-x     0      0         0  2-Sep-2013 18:33 Foobar file 
  150060 dr-xr-xr-x     0      0         0  3-Jul-2015 12:17 Foobar file 
   46920 dr-xr-xr-x     0      0         0  6-Jun-2012 12:15 Foobar file 
   86745 dr-xr-xr-x     0      0         0 26-May-2013 12:16 Foobar file 
   68022 dr-xr-xr-x     0      0         0  2-Sep-2013 18:33 Foobar file 
  172554 dr-xr-xr-x     0      0         0 10-Jul-2016 12:17 Foobar file 
      41 dr-xr-xr-x     0      0         0 10-May-2014 12:29 Foobar file 
  157259 dr-xr-xr-x     0      0         0  9-Dec-2015 23:18 Foobar file 
   26863 dr-xr-xr-x     0      0         0  9-Jan-2012 14:35 Foobar file 
  139215 dr-xr-xr-x     0      0         0 28-Aug-2014 20:45 Foobar file 
      36 dr-xr-xr-x     0      0         0 21-Aug-2016 20:14 Foobar file 
  139214 dr-xr-xr-x     0      0         0 15-Jul-2015 13:56 Foobar file 
  172661 dr-xr-xr-x     0      0         0 17-Aug-2016 14:01 Foobar file 
  150973 dr-xr-xr-x     0      0         0 31-May-2015 22:33 Foobar file 
  172660 dr-xr-xr-x     0      0         0 10-Aug-2016 11:14 Foobar file 
   22371 -r--r--r--     0      0   5506400 20-Jun-2014 11:25 Foobar file 
   22372 -r--r--r--     0      0    813408 20-Jun-2014 11:25 Foobar file 
      35 -r--r--r--     0      0   6726910  2-Sep-2011 09:29 Foobar file 
  170670 -r--r--r--     0      0 880878828 10-Dec-2015 14:45 Foobar file 
  170674 -r--r--r--     0      0 962730957 14-Dec-2015 23:57 Foobar file 
  120992 -r--r--r--     0      0      6144  2-Sep-2013 18:33 Foobar file 
  120992 -r--r--r--     0      0         0  2-Sep-2013 18:33 Foobar file 
filesystem size           976766976 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Write new boot!

ntfs_boot_sector
 1 * HPFS - NTFS              0  32 33 60801  15 14  976766976
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.

TestDisk exited normally.


-- Second Scan


Mon Oct 17 06:13:00 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249557607936
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500693504
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\H:
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30340 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60800 255 63, sector size=512
Drive G: - 500 MB / 477 MiB - CHS 60 255 63, sector size=512

Partition table type (auto): None
Drive F: - 500 GB / 465 GiB
Partition table type: Intel

Interface Advanced

Analyse Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
Current partition structure:
No partition is bootable

search_part()
Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
NTFS at 60800/237/45
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   0  1 60800 237 45  976766976
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Partition not added.
Search for partition aborted

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()
 
No partition found or selected for recovery

search_part()
Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
NTFS at 60800/237/45
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   0  1 60800 237 45  976766976
     NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Partition not added.

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
Current partition structure:
No partition is bootable

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Lost Partition, unable to restore, no result with second scan

#2 Post by cgrenier »

Run TestDisk, select Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB and choose Partition table type EFI GPT.
Please post the new results of the scan.

maro
Posts: 4
Joined: 17 Oct 2016, 19:28

Re: Lost Partition, unable to restore, no result with second scan

#3 Post by maro »

Thanks for the reply. Should I do it also, even if I know that the external disk was used with windows?

maro
Posts: 4
Joined: 17 Oct 2016, 19:28

Re: Lost Partition, unable to restore, no result with second scan

#4 Post by maro »

Hi,
thank you for the hint with the EFI GPT.
With this setting I was able to recover at least the files.
But if I go to write, the partition is not accessible via windows.


I still have two questions:
1. Can I recover the partition?
2. If not, can I delete the hdd and copy the files back? I didnt want to try it.

Thank you very much

Code: Select all


Wed Oct 19 21:29:53 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249557607936
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500693504
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=500104691712
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30340 255 63, sector size=512
Drive G: - 500 MB / 477 MiB - CHS 60 255 63, sector size=512
Drive I: - 500 GB / 465 GiB - CHS 60800 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive3 - 500 GB / 465 GiB
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive3 - 500 GB / 465 GiB - CHS 60801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                     2048  976769023  976766976

search_part()
Disk \\.\PhysicalDrive3 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=500104691712, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           976766976
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048  976769023  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB
file_win32_pread(96,11,buffer,976773162(60801/80/58)) read err: read after end of file
file_win32_pread(96,8,buffer,976773165(60801/80/61)) read err: read after end of file
file_win32_pread(96,14,buffer,976773156(60801/80/52)) read err: read after end of file
file_win32_pread(96,14,buffer,976773157(60801/80/53)) read err: read after end of file
file_win32_pread(96,14,buffer,976773158(60801/80/54)) read err: read after end of file
file_win32_pread(96,14,buffer,976773159(60801/80/55)) read err: read after end of file
file_win32_pread(96,14,buffer,976773160(60801/80/56)) read err: read after end of file
file_win32_pread(96,14,buffer,976773162(60801/80/58)) read err: read after end of file
file_win32_pread(96,14,buffer,976773164(60801/80/60)) read err: read after end of file
file_win32_pread(96,14,buffer,976773166(60801/80/62)) read err: read after end of file

Results
   P MS Data                     2048  976769023  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB

interface_write()
 1 P MS Data                     2048  976769023  976766976
write!
No extended partition
You will have to reboot for the change to take effect.
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P MS Data                     2048  976769023  976766976
     NTFS, blocksize=4096, 500 GB / 465 GiB

TestDisk exited normally.



Wed Oct 19 21:37:51 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401

maro
Posts: 4
Joined: 17 Oct 2016, 19:28

Re: Lost Partition, unable to restore, no result with second scan

#5 Post by maro »

any idea?

Locked