i got a corrupted hdd without any data.
With a deep search the preview showed some files and folders from the lost partition.
I tried to recover the partition and boot sector, but after the reboot the hdd was shown in windows as CD/DVD-drive without any data.
I did a deep search again and did not find anything anymore.
Can I recreate the partition table with the information of the logfile below? Is the information useful at all? What did I wrong for the recovery?
Thanks and regards
Code: Select all
-- First Scan
Sun Oct 16 23:18:56 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249557607936
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500693504
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\H:
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30340 255 63, sector size=512
Drive G: - 500 MB / 477 MiB - CHS 60 255 63, sector size=512
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 16450559
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 60801 80 63 976773167
Bad relative sector.
No partition is bootable
search_part()
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 60800/254/63
filesystem size 976766017
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 60800 254 63 976766017
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size 976766017
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 60800 254 63 121601 222 30 976766017
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976766017, end=1953534080, disk end=976773168)
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60800 254 63 121601 222 30 976766017
NTFS, blocksize=4096, 500 GB / 465 GiB
Results
* HPFS - NTFS 0 32 33 60801 15 14 976766976
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS filesystem need to be repaired.
dir_partition inode=5
* HPFS - NTFS 0 32 33 60801 15 14 976766976
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Directory /
5 dr-xr-xr-x 0 0 0 17-Aug-2016 13:39 .
5 dr-xr-xr-x 0 0 0 17-Aug-2016 13:39 ..
121303 dr-xr-xr-x 0 0 0 24-Dec-2015 23:44 Foobar File
54663 dr-xr-xr-x 0 0 0 15-Jun-2015 15:51 Foobar File
155000 dr-xr-xr-x 0 0 0 2-Nov-2015 12:31 Foobar File
170675 dr-xr-xr-x 0 0 0 22-Dec-2015 14:17 Foobar File
68210 dr-xr-xr-x 0 0 0 10-Jul-2016 12:06 Foobar File
149855 dr-xr-xr-x 0 0 0 27-Apr-2016 14:39 Foobar File
124661 dr-xr-xr-x 0 0 0 27-Apr-2016 14:31 Foobar File
120995 dr-xr-xr-x 0 0 0 2-Sep-2013 18:57 Foobar File
124658 dr-xr-xr-x 0 0 0 4-Dec-2013 11:53 Foobar File
139193 dr-xr-xr-x 0 0 0 4-Jul-2014 09:18 Foobar File
68023 dr-xr-xr-x 0 0 0 12-Nov-2013 16:10 Foobar File
22376 dr-xr-xr-x 0 0 0 16-Sep-2011 16:25 Foobar File
68234 dr-xr-xr-x 0 0 0 3-Dec-2012 14:51 Foobar File
26869 dr-xr-xr-x 0 0 0 2-Sep-2013 18:33 Foobar File
150060 dr-xr-xr-x 0 0 0 3-Jul-2015 12:17 Foobar File
46920 dr-xr-xr-x 0 0 0 6-Jun-2012 12:15 Foobar File
86745 dr-xr-xr-x 0 0 0 26-May-2013 12:16 Foobar File
68022 dr-xr-xr-x 0 0 0 2-Sep-2013 18:33 Foobar File
172554 dr-xr-xr-x 0 0 0 10-Jul-2016 12:17 Foobar File
41 dr-xr-xr-x 0 0 0 10-May-2014 12:29 Foobar File
157259 dr-xr-xr-x 0 0 0 9-Dec-2015 23:18 Foobar File
26863 dr-xr-xr-x 0 0 0 9-Jan-2012 14:35 Foobar File
139215 dr-xr-xr-x 0 0 0 28-Aug-2014 20:45 Foobar File
36 dr-xr-xr-x 0 0 0 21-Aug-2016 20:14 Foobar File
139214 dr-xr-xr-x 0 0 0 15-Jul-2015 13:56 Foobar File
172661 dr-xr-xr-x 0 0 0 17-Aug-2016 14:01 Foobar File
150973 dr-xr-xr-x 0 0 0 31-May-2015 22:33 Foobar File
172660 dr-xr-xr-x 0 0 0 10-Aug-2016 11:14 Foobar File
22371 -r--r--r-- 0 0 5506400 20-Jun-2014 11:25 Foobar File
22372 -r--r--r-- 0 0 813408 20-Jun-2014 11:25 Foobar File
35 -r--r--r-- 0 0 6726910 2-Sep-2011 09:29 Foobar File
170670 -r--r--r-- 0 0 880878828 10-Dec-2015 14:45 Foobar File
170674 -r--r--r-- 0 0 962730957 14-Dec-2015 23:57 Foobar File
120992 -r--r--r-- 0 0 6144 2-Sep-2013 18:33 Foobar File
120992 -r--r--r-- 0 0 0 2-Sep-2013 18:33 Foobar File
interface_write()
1 * HPFS - NTFS 0 32 33 60801 15 14 976766976
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 60801 15 14 976766976
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
filesystem size 1 0
sectors_per_cluster 0 255
mft_lcn 0 4294967295
mftmirr_lcn 0 4294967295
clusters_per_mft_record 0 -1
clusters_per_index_record 0 -1
Boot sector
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 6291456
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 976766976 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Extrapolated boot sector and current boot sector are different.
filesystem size 976766976 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
NTFS filesystem need to be repaired.
Directory /
5 dr-xr-xr-x 0 0 0 17-Aug-2016 13:39 .
5 dr-xr-xr-x 0 0 0 17-Aug-2016 13:39 ..
121303 dr-xr-xr-x 0 0 0 24-Dec-2015 23:44 Foobar file
54663 dr-xr-xr-x 0 0 0 15-Jun-2015 15:51 Foobar file
155000 dr-xr-xr-x 0 0 0 2-Nov-2015 12:31 Foobar file
170675 dr-xr-xr-x 0 0 0 22-Dec-2015 14:17 Foobar file
68210 dr-xr-xr-x 0 0 0 10-Jul-2016 12:06 Foobar file
149855 dr-xr-xr-x 0 0 0 27-Apr-2016 14:39 Foobar file
124661 dr-xr-xr-x 0 0 0 27-Apr-2016 14:31 Foobar file
120995 dr-xr-xr-x 0 0 0 2-Sep-2013 18:57 Foobar file
124658 dr-xr-xr-x 0 0 0 4-Dec-2013 11:53 Foobar file
139193 dr-xr-xr-x 0 0 0 4-Jul-2014 09:18 Foobar file
68023 dr-xr-xr-x 0 0 0 12-Nov-2013 16:10 Foobar file
22376 dr-xr-xr-x 0 0 0 16-Sep-2011 16:25 Foobar file
68234 dr-xr-xr-x 0 0 0 3-Dec-2012 14:51 Foobar file
26869 dr-xr-xr-x 0 0 0 2-Sep-2013 18:33 Foobar file
150060 dr-xr-xr-x 0 0 0 3-Jul-2015 12:17 Foobar file
46920 dr-xr-xr-x 0 0 0 6-Jun-2012 12:15 Foobar file
86745 dr-xr-xr-x 0 0 0 26-May-2013 12:16 Foobar file
68022 dr-xr-xr-x 0 0 0 2-Sep-2013 18:33 Foobar file
172554 dr-xr-xr-x 0 0 0 10-Jul-2016 12:17 Foobar file
41 dr-xr-xr-x 0 0 0 10-May-2014 12:29 Foobar file
157259 dr-xr-xr-x 0 0 0 9-Dec-2015 23:18 Foobar file
26863 dr-xr-xr-x 0 0 0 9-Jan-2012 14:35 Foobar file
139215 dr-xr-xr-x 0 0 0 28-Aug-2014 20:45 Foobar file
36 dr-xr-xr-x 0 0 0 21-Aug-2016 20:14 Foobar file
139214 dr-xr-xr-x 0 0 0 15-Jul-2015 13:56 Foobar file
172661 dr-xr-xr-x 0 0 0 17-Aug-2016 14:01 Foobar file
150973 dr-xr-xr-x 0 0 0 31-May-2015 22:33 Foobar file
172660 dr-xr-xr-x 0 0 0 10-Aug-2016 11:14 Foobar file
22371 -r--r--r-- 0 0 5506400 20-Jun-2014 11:25 Foobar file
22372 -r--r--r-- 0 0 813408 20-Jun-2014 11:25 Foobar file
35 -r--r--r-- 0 0 6726910 2-Sep-2011 09:29 Foobar file
170670 -r--r--r-- 0 0 880878828 10-Dec-2015 14:45 Foobar file
170674 -r--r--r-- 0 0 962730957 14-Dec-2015 23:57 Foobar file
120992 -r--r--r-- 0 0 6144 2-Sep-2013 18:33 Foobar file
120992 -r--r--r-- 0 0 0 2-Sep-2013 18:33 Foobar file
filesystem size 976766976 1
sectors_per_cluster 8 0
mft_lcn 786432 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Write new boot!
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 60801 15 14 976766976
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 976766976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.
TestDisk exited normally.
-- Second Scan
Mon Oct 17 06:13:00 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249557607936
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=500693504
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\H:
Hard disk list
Disk \\.\PhysicalDrive0 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30340 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60800 255 63, sector size=512
Drive G: - 500 MB / 477 MiB - CHS 60 255 63, sector size=512
Partition table type (auto): None
Drive F: - 500 GB / 465 GiB
Partition table type: Intel
Interface Advanced
Analyse Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
Current partition structure:
No partition is bootable
search_part()
Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
NTFS at 60800/237/45
filesystem size 976766976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 60800 237 45 976766976
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Partition not added.
Search for partition aborted
Results
Can't open backup.log file: No such file or directory
interface_load
interface_write()
No partition found or selected for recovery
search_part()
Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
NTFS at 60800/237/45
filesystem size 976766976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 60800 237 45 976766976
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Partition not added.
Results
Can't open backup.log file: No such file or directory
interface_load
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Drive F: - 500 GB / 465 GiB - CHS 60800 255 63
Current partition structure:
No partition is bootable