Will TestDisk 7.1 Beta (download Windows 7 64bit) work on a Windows 7 64bir Ultimate guest on Windows 7 Pro 64bit host.
Maybe I should be using TestDisk 7.0 windows Download, rather than TestDisk 7.1 Beta with Windows64 download.
The Guest is a 42GB partition (38.9GiB).
The TestDisk.log shows:
The harddisk (42 GB / 40 GiB) seems too small! (< 85 GB / 79 GiB)
The following partition can't be recovered:
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
I am using VMWare Workstation 11.
This test was to exercise TestDisk before trying to recover Window 7 Master File Table (MFT) on a failing computer that keeps get Blue Screen BSOD)
The Windows 7 Guest has been running successfully since 2012 and is used for testingour newly developed applications.
VMWare Workstation 11 guest Windows 7
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: VMWare Workstation 11 guest Windows 7
You can use the 7.1-WIP version.
An NTFS partition found using its backup boot sector should be listed on the next screen, TestDisk has been stopped too early.
An NTFS partition found using its backup boot sector should be listed on the next screen, TestDisk has been stopped too early.
Re: VMWare Workstation 11 guest Windows 7
Here is the full testdisk.log. Most relavent message is possibly:
"This partition ends after the disk limits."
David
=======================
Mon Jun 10 16:08:51 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=42949672960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=42949672960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=42842718208
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63, sector size=512 - VMware, VMware Virtual S, FW:1.0
Partition table type (auto): Intel
Disk /dev/sda - 42 GB / 40 GiB - VMware, VMware Virtual S
Partition table type: Intel
Analyse Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 5221 137 36 83677184
search_part()
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
file_pread(4,2,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,2,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,2,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,1,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,2,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,8,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,14,buffer,83886082(5221/170/8)) lseek err Invalid argument
file_pread(4,3,buffer,83886096(5221/170/22)) lseek err Invalid argument
file_pread(4,3,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,8,buffer,83886159(5221/171/22)) lseek err Invalid argument
file_pread(4,11,buffer,83886206(5221/172/6)) lseek err Invalid argument
file_pread(4,2,buffer,83888128(5221/202/38)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 5221 137 36 83677184
search_part()
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
NTFS at 5221/137/36
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS found using backup sector, blocksize=4096, 42 GB / 39 GiB
NTFS at 5221/137/36
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,2,buffer,90175493(5613/42/3)) lseek err Invalid argument
file_pread(4,1,buffer,90175493(5613/42/3)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
This partition ends after the disk limits. (start=83884031, size=83677184, end=167561214, disk end=83886080)
file_pread(4,2,buffer,83886079(5221/170/5)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,2,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,2,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,1,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,2,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,7,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,8,buffer,83886088(5221/170/14)) lseek err Invalid argument
file_pread(4,3,buffer,83886096(5221/170/22)) lseek err Invalid argument
file_pread(4,3,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,8,buffer,83886159(5221/171/22)) lseek err Invalid argument
file_pread(4,11,buffer,83886206(5221/172/6)) lseek err Invalid argument
file_pread(4,2,buffer,83888128(5221/202/38)) lseek err Invalid argument
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (42 GB / 40 GiB) seems too small! (< 85 GB / 79 GiB)
The following partition can't be recovered:
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
SIGINT detected! TestDisk has been killed.
"This partition ends after the disk limits."
David
=======================
Mon Jun 10 16:08:51 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=42949672960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=42949672960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=42842718208
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
Hard disk list
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63, sector size=512 - VMware, VMware Virtual S, FW:1.0
Partition table type (auto): Intel
Disk /dev/sda - 42 GB / 40 GiB - VMware, VMware Virtual S
Partition table type: Intel
Analyse Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 5221 137 36 83677184
search_part()
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
file_pread(4,2,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,2,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,2,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,1,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,2,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,8,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,14,buffer,83886082(5221/170/8)) lseek err Invalid argument
file_pread(4,3,buffer,83886096(5221/170/22)) lseek err Invalid argument
file_pread(4,3,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,8,buffer,83886159(5221/171/22)) lseek err Invalid argument
file_pread(4,11,buffer,83886206(5221/172/6)) lseek err Invalid argument
file_pread(4,2,buffer,83888128(5221/202/38)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
2 P HPFS - NTFS 12 223 20 5221 137 36 83677184
search_part()
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
NTFS at 5221/137/36
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS found using backup sector, blocksize=4096, 42 GB / 39 GiB
NTFS at 5221/137/36
filesystem size 83677184
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(4,2,buffer,90175493(5613/42/3)) lseek err Invalid argument
file_pread(4,1,buffer,90175493(5613/42/3)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
This partition ends after the disk limits. (start=83884031, size=83677184, end=167561214, disk end=83886080)
file_pread(4,2,buffer,83886079(5221/170/5)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,1,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,2,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886107(5221/170/33)) lseek err Invalid argument
file_pread(4,2,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,1,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,2,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886170(5221/171/33)) lseek err Invalid argument
file_pread(4,1,buffer,83886080(5221/170/6)) ReadFile Data error (cyclic redundancy check).
file_pread(4,7,buffer,83886081(5221/170/7)) lseek err Invalid argument
file_pread(4,8,buffer,83886088(5221/170/14)) lseek err Invalid argument
file_pread(4,3,buffer,83886096(5221/170/22)) lseek err Invalid argument
file_pread(4,3,buffer,83886143(5221/171/6)) lseek err Invalid argument
file_pread(4,8,buffer,83886159(5221/171/22)) lseek err Invalid argument
file_pread(4,11,buffer,83886206(5221/172/6)) lseek err Invalid argument
file_pread(4,2,buffer,83888128(5221/202/38)) lseek err Invalid argument
Disk /dev/sda - 42 GB / 40 GiB - CHS 5221 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (42 GB / 40 GiB) seems too small! (< 85 GB / 79 GiB)
The following partition can't be recovered:
HPFS - NTFS 5221 137 36 10430 51 52 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 5221 137 36 83677184
NTFS, blocksize=4096, 42 GB / 39 GiB
SIGINT detected! TestDisk has been killed.