Code: Select all
Wed Aug 23 16:13:18 2017
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, July 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Funci�n incorrecta.
filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Funci�n incorrecta.
Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Funci�n incorrecta.
filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Funci�n incorrecta.
Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249465667584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=489387677184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=10717539840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 850 EVO 250GB, S/N:S2R6NB0J311770Z, FW:EMT02B6Q
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HDT725050VLA360, S/N:VFK401R427P10K, FW:V56OA7BA
Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - Hitachi HDT725050VLA360
Partition table type: Intel
Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 59498/0/1
Info: size boot_sector 20932694, partition 20932695
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Current partition structure:
1 * HPFS - NTFS 0 1 1 59497 254 63 955835307
2 P HPFS - NTFS 59498 0 1 60800 254 63 20932695 [FACTORY_IMAGE]
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 955835307
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 6555520
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 59497 254 63 955835307
NTFS, blocksize=4096, 489 GB / 455 GiB
NTFS at 59498/0/1
filesystem size 20932694
sectors_per_cluster 8
mft_lcn 170152
mftmirr_lcn 255229
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 59498 0 1 60800 254 62 20932694 [FACTORY_IMAGE]
NTFS, blocksize=4096, 10717 MB / 10221 MiB
NTFS at 60800/254/63
filesystem size 20932694
sectors_per_cluster 8
mft_lcn 170152
mftmirr_lcn 255229
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 59498 0 2 60800 254 63 20932694
NTFS found using backup sector, blocksize=4096, 10717 MB / 10221 MiB
NTFS at 60800/254/63
filesystem size 20932694
sectors_per_cluster 8
mft_lcn 170152
mftmirr_lcn 255229
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,978129286(60885/186/44)) lseek err Invalid argument
file_pread(5,1,buffer,978129286(60885/186/44)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 60800 254 63 62103 254 61 20932694
NTFS, blocksize=4096, 10717 MB / 10221 MiB
This partition ends after the disk limits. (start=976768064, size=20932694, end=997700757, disk end=976773168)
file_pread(5,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(5,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(5,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(5,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(5,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(5,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(5,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(5,8,buffer,976773226(60801/81/59)) lseek err Invalid argument
file_pread(5,1,buffer,976773234(60801/82/4)) lseek err Invalid argument
file_pread(5,8,buffer,976773354(60801/83/61)) lseek err Invalid argument
file_pread(5,1,buffer,976773362(60801/84/6)) lseek err Invalid argument
file_pread(5,8,buffer,976773482(60801/85/63)) lseek err Invalid argument
file_pread(5,1,buffer,976773490(60801/86/8)) lseek err Invalid argument
file_pread(5,8,buffer,976773610(60801/88/2)) lseek err Invalid argument
file_pread(5,1,buffer,976773618(60801/88/10)) lseek err Invalid argument
file_pread(5,8,buffer,976773738(60801/90/4)) lseek err Invalid argument
file_pread(5,1,buffer,976773746(60801/90/12)) lseek err Invalid argument
file_pread(5,8,buffer,976773866(60801/92/6)) lseek err Invalid argument
file_pread(5,1,buffer,976773874(60801/92/14)) lseek err Invalid argument
file_pread(5,8,buffer,976773994(60801/94/8)) lseek err Invalid argument
file_pread(5,1,buffer,976774002(60801/94/16)) lseek err Invalid argument
file_pread(5,8,buffer,976774122(60801/96/10)) lseek err Invalid argument
file_pread(5,1,buffer,976774130(60801/96/18)) lseek err Invalid argument
file_pread(5,8,buffer,976774250(60801/98/12)) lseek err Invalid argument
file_pread(5,1,buffer,976774258(60801/98/20)) lseek err Invalid argument
file_pread(5,8,buffer,976774378(60801/100/14)) lseek err Invalid argument
file_pread(5,1,buffer,976774386(60801/100/22)) lseek err Invalid argument
file_pread(5,8,buffer,976774506(60801/102/16)) lseek err Invalid argument
file_pread(5,1,buffer,976774514(60801/102/24)) lseek err Invalid argument
file_pread(5,8,buffer,976774634(60801/104/18)) lseek err Invalid argument
file_pread(5,1,buffer,976774642(60801/104/26)) lseek err Invalid argument
file_pread(5,8,buffer,976774762(60801/106/20)) lseek err Invalid argument
file_pread(5,1,buffer,976774770(60801/106/28)) lseek err Invalid argument
file_pread(5,8,buffer,976774890(60801/108/22)) lseek err Invalid argument
file_pread(5,1,buffer,976774898(60801/108/30)) lseek err Invalid argument
file_pread(5,8,buffer,976775018(60801/110/24)) lseek err Invalid argument
file_pread(5,1,buffer,976775026(60801/110/32)) lseek err Invalid argument
file_pread(5,8,buffer,976775146(60801/112/26)) lseek err Invalid argument
file_pread(5,1,buffer,976775154(60801/112/34)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 510 GB / 475 GiB)
The following partition can't be recovered:
HPFS - NTFS 60800 254 63 62103 254 61 20932694
NTFS, blocksize=4096, 10717 MB / 10221 MiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 59497 254 63 955835307
NTFS, blocksize=4096, 489 GB / 455 GiB
HPFS - NTFS 59498 0 1 60800 254 63 20932695 [FACTORY_IMAGE]
NTFS, blocksize=4096, 10717 MB / 10221 MiB
HPFS - NTFS 59498 0 2 60800 254 63 20932694
NTFS found using backup sector, blocksize=4096, 10717 MB / 10221 MiB
Not an exFAT boot sector.
* HPFS - NTFS 0 1 1 59497 254 63 955835307
NTFS, blocksize=4096, 489 GB / 455 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 1 1 59497 254 63 955835307
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 59498/0/1
Info: size boot_sector 20932694, partition 20932695
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
1 * HPFS - NTFS 0 1 1 59497 254 63 955835307
NTFS, blocksize=4096, 489 GB / 455 GiB
2 P HPFS - NTFS 59498 0 1 60800 254 63 20932695 [FACTORY_IMAGE]
NTFS, blocksize=4096, 10717 MB / 10221 MiB
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 59497 254 63 955835307
NTFS, blocksize=4096, 489 GB / 455 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 955835307
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 6555520
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
repair_MFT
NTFS at 0/1/1
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 59497 254 63 955835307
NTFS, blocksize=4096, 489 GB / 455 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 955835307
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 6555520
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
2 [main] testdisk_win 1708 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump