undelete files from SSD not working with resulting 00 content files

[Nubber]

Hi all,

I try to recover some deleted files on a SSD from yesterday. I quite fast forced power off with switch.
So I'd like to know if I had any chance to recover these files.

Recovery-Test-Failed.png (95.01 KiB) Viewed 8346 times

One weird thing is that all files share the same inode apparently.
Can I somehow solve that issue?

Code: Select all

Sun Dec  1 17:11:33 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, November 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=510652142592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=119664541696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=367001600
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=8001427603456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=104857600
filewin32_getfilesize(\\.\K:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\K:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\K:
filewin32_getfilesize(\\.\L:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\L:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=449990123520
Hard disk list
Disk /dev/sda - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - ST8000AS0002-1NA17Z, S/N:Z84029XK, FW:AR13
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - USB 3.0 , S/N:2017101901F4, FW:0101
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EFRX-68AX9N0, S/N:WD-WMC1T2337098, FW:80.00A80
Disk /dev/sdd - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - OCZ-VERTEX3 MI, S/N:OCZ-APCC97S3G873IJHG, FW:2.25
Disk /dev/sde - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 950 PRO 512GB, S/N:0025_3853_5B16_3796., FW:2B0QBXX7

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - USB 3.0 
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 18446744073709551615
NTFS at 0/32/33
NTFS at 12/223/20
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
 2 P HPFS - NTFS             12 223 20 54721  14 61  878886960 [Windows 7]
     NTFS, blocksize=4096, 449 GB / 419 GiB


Files with potentially recoverable content: 65899
 2 P HPFS - NTFS             12 223 20 54721  14 61  878886960 [Windows 7]
     NTFS, blocksize=4096, 449 GB / 419 GiB  
....
list of files
....
ERROR: Couldn't set the file's date and time for inode_910647
ERROR: Couldn't set the file's date and time for inode_910647
ERROR: Couldn't set the file's date and time for inode_910647
....

Lots of error messages at the end of logfile. So how can I recover these files? That means I can recover them but apperently they have something like null values in them.
The recovered file have the correct size and everything. But apparently no content in them, only Hex 00.

Would be nice if somebody had a glue, how to solve that.

I think possibly that was a trim action, does that mean, there is completely no chance any more?

Thank you.

Nubber

[recuperation]

Read here:

viewtopic.php?f=4&t=9636

Are you running Testdisk from /dev/sdb?

[Nubber]

Hi, no testdisk is not run from sdb but from another disk.

[Nubber]

And @recuperation thank you for the parallel forum task, but I switched off computer immediately, like I already wrote. All actions I forgot to mention is by accessing SSD by testdisk having it in a USB mounting device .

[recuperation]

Try running Photorec.

What I don't understand is the "inode"-labeling in your linked picture. The report suggests that it's probably NTFS, the partition label "Windows 7" is an additional indicator for NTFS.
NTFS uses entries in the MFT which are not called inodes and there is typically one entry per file.
So even if the inode-labeling is a generalized description there should not be the same inode number for different files.

[Nubber]

Ok, but I am not sure, possibly wear leveling did it's work here already. If not, possibly, how can I do a recovery of eml files with photorec?

[Nubber]

Yes, it is a NTFS file system.

[recuperation]

If your eml file means Microsoft Email file, I just read about the content on a third party site:
Those eml files seem to be txt files.

Unfortunately I expect lots of false positives when searching for txt files, because only a few txt files will be genuine eml files.