USB drive pictures

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
SirGraves
Posts: 6
Joined: 11 Nov 2023, 16:07

USB drive pictures

#1 Post by SirGraves »

Hi all My daughter gave me her 2Tb Passport drive to see if I can retrieve her information on it. Windows 10 wanted me to format the drive instead, I used PhotoRec to recover the files on the drive(hopefully all of them) and now I am trying to recover the drive without losing anything on it just in case I didn't get all of the information on the drive.
I have downloaded TestDisk and I am trying to use it. I am not really good at this kind of thing so I could use some help please. I have tried to use the program. I checked the boot sector and it says it is ok and the backup is ok sectors identical. It says Can't read Fat boot sector 1 PMS DATA 2048 3906961407 3906959360

It also states A valid NTFS Boot sector must be present in order to access any data even if partition not bootable.
. Analyse Cylinder 368/243196 00% Read error at 367/254/63 (1ba=5911919 )

Thanks.

recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: USB drive pictures

#2 Post by recuperation »


SirGraves
Posts: 6
Joined: 11 Nov 2023, 16:07

Re: USB drive pictures

#3 Post by SirGraves »

I have tried reading the notes and tried to use TestDisk. What some of the information i got was the boot sectors seem to be okay. I looked at the Log file once and it had gotten so big that Windows said it was too big for it to open it. I think it was 789234321 kb. I do not know how I got the log file to be that large. I deleted the file. thought I was going to run out of disk space.
I am not the best when it comes to understanding what procedure I am suppose to follow that is why I posted what information I got in my first post. Hopefully some of it would be helpful in helping me. I will try doing some more reading and try to use the program some more.

Thanks for your time

recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: USB drive pictures

#4 Post by recuperation »

Use a hex editor like Hxd and copy roughly the first 10.000 bytes out of the log file and post them here.

SirGraves
Posts: 6
Joined: 11 Nov 2023, 16:07

Re: USB drive pictures

#5 Post by SirGraves »

Hope this is what you want I didn't know how to copy from hex editor

Thanks for the quick reply.

Sat Nov 11 14:02:14 2023
Command line: TestDisk

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 after end of fi
00000010 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 le.file_win32_pr
00000020 65 61 64 28 35 35 32 2C 31 2C 62 75 66 66 65 72 ead(552,1,buffer
00000030 2C 32 36 36 34 28 30 2F 34 32 2F 31 39 29 29 20 ,2664(0/42/19))
00000040 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 read err: read a
00000050 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 fter end of file
00000060 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 .file_win32_prea
00000070 64 28 35 35 32 2C 31 2C 62 75 66 66 65 72 2C 32 d(552,1,buffer,2
00000080 36 36 35 28 30 2F 34 32 2F 32 30 29 29 20 72 65 665(0/42/20)) re
00000090 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 ad err: read aft
000000A0 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 er end of file.f
000000B0 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 ile_win32_pread(
000000C0 35 35 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 36 552,1,buffer,266
000000D0 36 28 30 2F 34 32 2F 32 31 29 29 20 72 65 61 64 6(0/42/21)) read
000000E0 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 err: read after
000000F0 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C end of file.fil
00000100 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 e_win32_pread(55
00000110 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 36 37 28 2,1,buffer,2667(
00000120 30 2F 34 32 2F 32 32 29 29 20 72 65 61 64 20 65 0/42/22)) read e
00000130 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 rr: read after e
00000140 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F nd of file.file_
00000150 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C win32_pread(552,
00000160 31 2C 62 75 66 66 65 72 2C 32 36 36 38 28 30 2F 1,buffer,2668(0/
00000170 34 32 2F 32 33 29 29 20 72 65 61 64 20 65 72 72 42/23)) read err
00000180 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 6E 64 : read after end
00000190 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 of file.file_wi
000001A0 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C 31 2C n32_pread(552,1,
000001B0 62 75 66 66 65 72 2C 32 36 36 39 28 30 2F 34 32 buffer,2669(0/42
000001C0 2F 32 34 29 29 20 72 65 61 64 20 65 72 72 3A 20 /24)) read err:
000001D0 72 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 6F read after end o
000001E0 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 f file.file_win3
000001F0 32 5F 70 72 65 61 64 28 35 35 32 2C 31 36 2C 62 2_pread(552,16,b
00000200 75 66 66 65 72 2C 32 36 37 30 28 30 2F 34 32 2F uffer,2670(0/42/
00000210 32 35 29 29 20 72 65 61 64 20 65 72 72 3A 20 72 25)) read err: r
00000220 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 6F 66 ead after end of
00000230 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 file.file_win32
00000240 5F 70 72 65 61 64 28 35 35 32 2C 31 2C 62 75 66 _pread(552,1,buf
00000250 66 65 72 2C 32 36 37 30 28 30 2F 34 32 2F 32 35 fer,2670(0/42/25
00000260 29 29 20 72 65 61 64 20 65 72 72 3A 20 72 65 61 )) read err: rea
00000270 64 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 66 d after end of f
00000280 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 ile.file_win32_p
00000290 72 65 61 64 28 35 35 32 2C 31 36 2C 62 75 66 66 read(552,16,buff
000002A0 65 72 2C 32 36 37 31 28 30 2F 34 32 2F 32 36 29 er,2671(0/42/26)
000002B0 29 20 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 ) read err: read
000002C0 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 after end of fi
000002D0 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 le.file_win32_pr
000002E0 65 61 64 28 35 35 32 2C 31 2C 62 75 66 66 65 72 ead(552,1,buffer
000002F0 2C 32 36 37 31 28 30 2F 34 32 2F 32 36 29 29 20 ,2671(0/42/26))
00000300 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 read err: read a
00000310 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 fter end of file
00000320 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 .file_win32_prea
00000330 64 28 35 35 32 2C 31 36 2C 62 75 66 66 65 72 2C d(552,16,buffer,
00000340 32 36 37 32 28 30 2F 34 32 2F 32 37 29 29 20 72 2672(0/42/27)) r
00000350 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 ead err: read af
00000360 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A ter end of file.
00000370 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 file_win32_pread
00000380 28 35 35 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 (552,1,buffer,26
00000390 37 32 28 30 2F 34 32 2F 32 37 29 29 20 72 65 61 72(0/42/27)) rea
000003A0 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 d err: read afte
000003B0 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 r end of file.fi
000003C0 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 le_win32_pread(5
000003D0 35 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 37 33 52,1,buffer,2673
000003E0 28 30 2F 34 32 2F 32 38 29 29 20 72 65 61 64 20 (0/42/28)) read
000003F0 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 20 err: read after
00000400 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 end of file.file
00000410 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 32 _win32_pread(552
00000420 2C 31 2C 62 75 66 66 65 72 2C 32 36 37 34 28 30 ,1,buffer,2674(0
00000430 2F 34 32 2F 32 39 29 29 20 72 65 61 64 20 65 72 /42/29)) read er
00000440 72 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 6E r: read after en
00000450 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 d of file.file_w
00000460 69 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C 31 in32_pread(552,1
00000470 2C 62 75 66 66 65 72 2C 32 36 37 35 28 30 2F 34 ,buffer,2675(0/4
00000480 32 2F 33 30 29 29 20 72 65 61 64 20 65 72 72 3A 2/30)) read err:
00000490 20 72 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 read after end
000004A0 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E of file.file_win
000004B0 33 32 5F 70 72 65 61 64 28 35 35 32 2C 31 2C 62 32_pread(552,1,b
000004C0 75 66 66 65 72 2C 32 36 37 36 28 30 2F 34 32 2F uffer,2676(0/42/
000004D0 33 31 29 29 20 72 65 61 64 20 65 72 72 3A 20 72 31)) read err: r
000004E0 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 6F 66 ead after end of
000004F0 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 file.file_win32
00000500 5F 70 72 65 61 64 28 35 35 32 2C 31 2C 62 75 66 _pread(552,1,buf
00000510 66 65 72 2C 32 36 37 37 28 30 2F 34 32 2F 33 32 fer,2677(0/42/32
00000520 29 29 20 72 65 61 64 20 65 72 72 3A 20 72 65 61 )) read err: rea
00000530 64 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 66 d after end of f
00000540 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 ile.file_win32_p
00000550 72 65 61 64 28 35 35 32 2C 31 36 2C 62 75 66 66 read(552,16,buff
00000560 65 72 2C 32 36 37 38 28 30 2F 34 32 2F 33 33 29 er,2678(0/42/33)
00000570 29 20 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 ) read err: read
00000580 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 after end of fi
00000590 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 le.file_win32_pr
000005A0 65 61 64 28 35 35 32 2C 31 2C 62 75 66 66 65 72 ead(552,1,buffer
000005B0 2C 32 36 37 38 28 30 2F 34 32 2F 33 33 29 29 20 ,2678(0/42/33))
000005C0 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 read err: read a
000005D0 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 fter end of file
000005E0 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 .file_win32_prea
000005F0 64 28 35 35 32 2C 31 36 2C 62 75 66 66 65 72 2C d(552,16,buffer,
00000600 32 36 37 39 28 30 2F 34 32 2F 33 34 29 29 20 72 2679(0/42/34)) r
00000610 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 ead err: read af
00000620 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A ter end of file.
00000630 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 file_win32_pread
00000640 28 35 35 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 (552,1,buffer,26
00000650 37 39 28 30 2F 34 32 2F 33 34 29 29 20 72 65 61 79(0/42/34)) rea
00000660 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 d err: read afte
00000670 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 r end of file.fi
00000680 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 le_win32_pread(5
00000690 35 32 2C 31 36 2C 62 75 66 66 65 72 2C 32 36 38 52,16,buffer,268
000006A0 30 28 30 2F 34 32 2F 33 35 29 29 20 72 65 61 64 0(0/42/35)) read
000006B0 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 err: read after
000006C0 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C end of file.fil
000006D0 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 e_win32_pread(55
000006E0 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 38 30 28 2,1,buffer,2680(
000006F0 30 2F 34 32 2F 33 35 29 29 20 72 65 61 64 20 65 0/42/35)) read e
00000700 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 rr: read after e
00000710 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F nd of file.file_
00000720 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C win32_pread(552,
00000730 31 2C 62 75 66 66 65 72 2C 32 36 38 31 28 30 2F 1,buffer,2681(0/
00000740 34 32 2F 33 36 29 29 20 72 65 61 64 20 65 72 72 42/36)) read err
00000750 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 6E 64 : read after end
00000760 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 of file.file_wi
00000770 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C 31 2C n32_pread(552,1,
00000780 62 75 66 66 65 72 2C 32 36 38 32 28 30 2F 34 32 buffer,2682(0/42
00000790 2F 33 37 29 29 20 72 65 61 64 20 65 72 72 3A 20 /37)) read err:
000007A0 72 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 6F read after end o
000007B0 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 f file.file_win3
000007C0 32 5F 70 72 65 61 64 28 35 35 32 2C 31 2C 62 75 2_pread(552,1,bu
000007D0 66 66 65 72 2C 32 36 38 33 28 30 2F 34 32 2F 33 ffer,2683(0/42/3
000007E0 38 29 29 20 72 65 61 64 20 65 72 72 3A 20 72 65 8)) read err: re
000007F0 61 64 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 ad after end of
00000800 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F file.file_win32_
00000810 70 72 65 61 64 28 35 35 32 2C 31 2C 62 75 66 66 pread(552,1,buff
00000820 65 72 2C 32 36 38 34 28 30 2F 34 32 2F 33 39 29 er,2684(0/42/39)
00000830 29 20 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 ) read err: read
00000840 20 61 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 after end of fi
00000850 6C 65 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 le.file_win32_pr
00000860 65 61 64 28 35 35 32 2C 31 2C 62 75 66 66 65 72 ead(552,1,buffer
00000870 2C 32 36 38 35 28 30 2F 34 32 2F 34 30 29 29 20 ,2685(0/42/40))
00000880 72 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 read err: read a
00000890 66 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 fter end of file
000008A0 0A 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 .file_win32_prea
000008B0 64 28 35 35 32 2C 31 36 2C 62 75 66 66 65 72 2C d(552,16,buffer,
000008C0 32 36 38 36 28 30 2F 34 32 2F 34 31 29 29 20 72 2686(0/42/41)) r
000008D0 65 61 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 ead err: read af
000008E0 74 65 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A ter end of file.
000008F0 66 69 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 file_win32_pread
00000900 28 35 35 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 (552,1,buffer,26
00000910 38 36 28 30 2F 34 32 2F 34 31 29 29 20 72 65 61 86(0/42/41)) rea
00000920 64 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 d err: read afte
00000930 72 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 r end of file.fi
00000940 6C 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 le_win32_pread(5
00000950 35 32 2C 31 36 2C 62 75 66 66 65 72 2C 32 36 38 52,16,buffer,268
00000960 37 28 30 2F 34 32 2F 34 32 29 29 20 72 65 61 64 7(0/42/42)) read
00000970 20 65 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 err: read after
00000980 20 65 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C end of file.fil
00000990 65 5F 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 e_win32_pread(55
000009A0 32 2C 31 2C 62 75 66 66 65 72 2C 32 36 38 37 28 2,1,buffer,2687(
000009B0 30 2F 34 32 2F 34 32 29 29 20 72 65 61 64 20 65 0/42/42)) read e
000009C0 72 72 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 rr: read after e
000009D0 6E 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F nd of file.file_
000009E0 77 69 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C win32_pread(552,
000009F0 31 36 2C 62 75 66 66 65 72 2C 32 36 38 38 28 30 16,buffer,2688(0
00000A00 2F 34 32 2F 34 33 29 29 20 72 65 61 64 20 65 72 /42/43)) read er
00000A10 72 3A 20 72 65 61 64 20 61 66 74 65 72 20 65 6E r: read after en
00000A20 64 20 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 d of file.file_w
00000A30 69 6E 33 32 5F 70 72 65 61 64 28 35 35 32 2C 31 in32_pread(552,1
00000A40 2C 62 75 66 66 65 72 2C 32 36 38 38 28 30 2F 34 ,buffer,2688(0/4
00000A50 32 2F 34 33 29 29 20 72 65 61 64 20 65 72 72 3A 2/43)) read err:
00000A60 20 72 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 read after end
00000A70 6F 66 20 66 69 6C 65 0A 66 69 6C 65 5F 77 69 6E of file.file_win
00000A80 33 32 5F 70 72 65 61 64 28 35 35 32 2C 31 2C 62 32_pread(552,1,b
00000A90 75 66 66 65 72 2C 32 36 38 39 28 30 2F 34 32 2F uffer,2689(0/42/
00000AA0 34 34 29 29 20 72 65 61 64 20 65 72 72 3A 20 72 44)) read err: r
00000AB0 65 61 64 20 61 66 74 65 72 20 65 6E 64 20 6F 66 ead after end of

Post Reply