Now, the Deeper scan / search is 75%. I would let it finish the search, I saw many Linux and small number of MS Data partitions in the existing list of found partitions.
Code: Select all
Wed Feb 13 16:07:33 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248470433280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=250214350848
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA MK5065GSXN, S/N:81NFC638T, FW:GH101M
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM 001-1CH166, S/N:0000AB1238A4, FW:0425
Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM 001-1CH166
Partition table type: Intel
Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295
Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 476533504
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 16 113 34 237319 39 32 3812268032 [New Volume]
NTFS, blocksize=4096, 1951 GB / 1817 GiB
NTFS at 237319/39/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 255999744
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 237319 39 33 364801 33 32 2047997952 [New Volume]
NTFS, blocksize=4096, 1048 GB / 976 GiB
NTFS at 364801/66/1
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 364801 66 1 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364801/66/1
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,5866823685(365192/225/31)) lseek err Invalid argument
file_pread(5,1,buffer,5866823685(365192/225/31)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 364801 66 1 729586 18 31 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860532223, size=5860268032, end=11720800254, disk end=5860533168)
file_pread(5,2,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,8,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,5860533376(364801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,5860533504(364801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,5860533632(364801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,5860533760(364801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,5860533888(364801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,5860534016(364801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,5860534144(364801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534280(364801/98/42)) lseek err Invalid argument
file_pread(5,3,buffer,5860534288(364801/98/50)) lseek err Invalid argument
file_pread(5,3,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534351(364801/99/50)) lseek err Invalid argument
file_pread(5,11,buffer,5860534398(364801/100/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860536320(364801/131/3)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partition can't be recovered:
HPFS - NTFS 364801 66 1 729586 18 31 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Results
HPFS - NTFS 16 113 34 237319 39 32 3812268032 [New Volume]
NTFS, blocksize=4096, 1951 GB / 1817 GiB
HPFS - NTFS 16 113 34 364801 66 1 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
HPFS - NTFS 237319 39 33 364801 33 32 2047997952 [New Volume]
NTFS, blocksize=4096, 1048 GB / 976 GiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295
Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable
Backup partition structure
partition_save
search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 476533504
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 16 113 34 237319 39 32 3812268032 [New Volume]
NTFS, blocksize=4096, 1951 GB / 1817 GiB
NTFS at 237319/39/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 255999744
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 237319 39 33 364801 33 32 2047997952 [New Volume]
NTFS, blocksize=4096, 1048 GB / 976 GiB
NTFS at 364801/66/1
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 364801 66 1 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364801/66/1
filesystem size 5860268032
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,5866823685(365192/225/31)) lseek err Invalid argument
file_pread(5,1,buffer,5866823685(365192/225/31)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 364801 66 1 729586 18 31 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860532223, size=5860268032, end=11720800254, disk end=5860533168)
file_pread(5,2,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534271(364801/98/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534334(364801/99/33)) lseek err Invalid argument
file_pread(5,2,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,1,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,1,buffer,5860534397(364801/100/33)) lseek err Invalid argument
file_pread(5,8,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,5860533248(364801/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,5860533376(364801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,5860533504(364801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,5860533632(364801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,5860533760(364801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,5860533888(364801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,5860534016(364801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,5860534144(364801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534280(364801/98/42)) lseek err Invalid argument
file_pread(5,3,buffer,5860534288(364801/98/50)) lseek err Invalid argument
file_pread(5,3,buffer,5860534335(364801/99/34)) lseek err Invalid argument
file_pread(5,8,buffer,5860534351(364801/99/50)) lseek err Invalid argument
file_pread(5,11,buffer,5860534398(364801/100/34)) lseek err Invalid argument
file_pread(5,2,buffer,5860536320(364801/131/3)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partition can't be recovered:
HPFS - NTFS 364801 66 1 729586 18 31 5860268032
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Results
HPFS - NTFS 16 113 34 237319 39 32 3812268032 [New Volume]
NTFS, blocksize=4096, 1951 GB / 1817 GiB
HPFS - NTFS 16 113 34 364801 66 1 5860268032
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
HPFS - NTFS 237319 39 33 364801 33 32 2047997952 [New Volume]
NTFS, blocksize=4096, 1048 GB / 976 GiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
First results were somehow correct (and my mistake - I did not use the "P" function - list files immediately).
As mentioned, I'll wait for the Deep scan finish.