RAW parts, MFT fault...

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
lomba
Posts: 4
Joined: 23 Aug 2012, 09:25

RAW parts, MFT fault...

#1 Post by lomba »

Hi,

I'm facing since several days to a massive data loss, and I'm trying to recover them before going to a disk doctor. I tried some actions with testdisk, but I need your help because I reached my limits.
For the history, I lost access to Windows without any warning, probably due to many electrical stops (fan problem). This disk was encrypted but it seems I could unencrypt it before loosing access (Windows was indicating "disk unencrypted").

When I mount this disk in a new notebook, Windows asks me to format the disk. This is a Seagate 500GB. The original partitions was the following :
- P1 : Boot, NTFS, "Reserved to system", 100 MB
- P2 : Main, NTFS, "System", 78 GB
- P3 : Main, NTFS, "Data", 220 GB
- P4 : Main, FAT32, "HP_Tools", 2 GB
The other space is free space.

When I mount this disk through my USB dock, Windows displays the following parts :
Image

H: and I: (which were C: and D:) are displayed like RAW partitions.
I'm using Testdisk 6.14 in Windows. It perfectly detects my disk /dev/sdb. The partitions are displayed :
Image

First problem : P2 is "invalid NTFS boot" ; P3 appears twice.
I run Quick Scan on partitions. Here is the result :
Image

The third part is not visible. I try to browse P2 content :
Image

Content is not valid ! I run a Deeper Scan. Result :
Image

Same problem : the partitions I want to recover are not readable. I do again analysis of P2 :
Image
I just add the, for this part, the initial status was "OK" for boot and "Bad" for the copy. I did a Rebuild BS.

P3 partition :
Image

At this point, I'm blocked. I don't know what to do. I tried some recovery tools (GetDataBack, OnTrack) but none can't see data.

Here is the Testdisk log :

Code: Select all


Fri Aug 24 09:22:05 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, July 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-08-14T11:59:29
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive2
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=102604210176
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=395248140288
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2147483648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=83781222400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=234027483136
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=2147483648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500420AS, S/N:2020202020202020202020205635424a4350444a, FW:0006HPM1
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST950042 3AS, FW:SDM5

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - ST950042 3AS
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 failed for partition type 07
FAT32 at 38650/233/48
Info: size boot_sector 4194304, partition 4194304
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081
Current partition structure:
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
 2 P HPFS - NTFS             12 223 20 10198 177 27  163635200
Invalid NTFS or EXFAT boot
 3 P HPFS - NTFS          10198 177 28 38650 233 47  457084928
 3 P HPFS - NTFS          10198 177 28 38650 233 47  457084928
 4 P FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           163635200
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
FAT32 at 38650/233/48
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081

FAT32 at 38650/233/48
     FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,14,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(5,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(5,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(5,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(5,2,buffer,976777216(60801/145/17)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
   P HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
   P FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
Not an exFAT boot sector.

   P HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
 2 P HPFS - NTFS             12 223 20 10198 177 27  163635200
 3 P FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/19
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size           163635200
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
NTFS at 10198/177/27
filesystem size           163635200
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS found using backup sector, blocksize=4096, 83 GB / 78 GiB
FAT32 at 38650/233/48
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081

FAT32 at 38650/233/48
     FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT32 at 38650/233/54
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081
set_FAT_info: name from BS used

FAT32 at 38650/233/54
     FAT32 LBA            38650 233 48 38911 254 63    4194304 [NO NAME]
     FAT found using backup sector!, 2147 MB / 2048 MiB
NTFS at 38912/97/33
filesystem size           4184064
sectors_per_cluster       8
mft_lcn                   174336
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          38651 238 52 38912  97 33    4184064
     NTFS found using backup sector, blocksize=4096, 2142 MB / 2043 MiB
NTFS at 38913/5/4
filesystem size           461295616
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          10198 177 28 38913   5  4  461295616
     NTFS found using backup sector, blocksize=4096, 236 GB / 219 GiB
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
NTFS at 10198/177/27
filesystem size           163635200
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1

Results
   * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
     HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
     HPFS - NTFS          10198 177 27 20384 131 34  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
     HPFS - NTFS          10198 177 28 38913   5  4  461295616
     NTFS found using backup sector, blocksize=4096, 236 GB / 219 GiB
     FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
     HPFS - NTFS          38651 238 52 38912  97 33    4184064
     NTFS found using backup sector, blocksize=4096, 2142 MB / 2043 MiB


dir_partition inode=5
   * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
Directory /
       5 dr-xr-xr-x     0      0         0 23-Aug-2012 09:57 .
       5 dr-xr-xr-x     0      0         0 23-Aug-2012 09:57 ..
     100 dr-xr-xr-x     0      0         0 22-Aug-2012 12:13 $RECYCLE.BIN
      35 dr-xr-xr-x     0      0         0  3-Aug-2011 15:14 Boot
      86 -r--r--r--     0      0    383786 20-Nov-2010 13:40 bootmgr
      97 -r--r--r--     0      0      8192  3-Aug-2011 15:14 BOOTSECT.BAK
      98 dr-xr-xr-x     0      0         0  3-Apr-2012 13:02 System Volume Information
Not an exFAT boot sector.

     HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

     HPFS - NTFS          10198 177 27 20384 131 34  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

     HPFS - NTFS          10198 177 28 38913   5  4  461295616
     NTFS found using backup sector, blocksize=4096, 236 GB / 219 GiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
     FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT: cluster=2(0x2), pos=620943360
Directory /
       3 drwxr-xr-x     0      0         0 29-Aug-2011 10:49 Hewlett-Packard
    1058 drwxr-xr-x     0      0         0 29-Aug-2011 11:46 $RECYCLE.BIN
  458757 drwxr-xr-x     0      0         0 12-Jun-2012 11:00 System Volume Information
X      6 drwxr-xr-x     0      0      4096 23-Aug-2012 09:57 MSI8f2e3.tmp
X      6 drwxr-xr-x     0      0      4096 22-Aug-2012 00:50 628d2f1c-c44b
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:27 MSI4e42a.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:31 MSI2a23a.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:31 MSI2a241.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:32 MSI3ac95.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:40 MSI2f3f1.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:48 MSI4b77f.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:48 MSI5235a.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:49 MSI644bf.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:51 MSI83c75.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:53 MSI9b4c0.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 14:54 MSIaabf9.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 15:11 MSI5b0aa.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 15:11 MSI5b0af.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 15:11 MSI5b0b4.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 15:12 _SI62608.TMP
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 16:53 MSI4894e.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 16:54 _SI48951.TMP
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 16:54 MSI613e0.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 16:56 MSI50ccb.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 16:58 MSI91db0.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 16:59 MSIa8bec.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:01 MSIc172b.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:05 MSIfe581.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:05 MSIfe584.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:05 MSI50cec.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:07 MSI15d4f.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:10 MSI4a009.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:12 MSI5c20a.tmp
X   1061 drwxr-xr-x     0      0      4096 29-Aug-2011 17:21 MSIe3130.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 17:46 MSIaae1.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 17:47 MSI1404d.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:20 MSIf30e3.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:20 _115199_
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:20 MSIf30ea.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:21 MSIf30f0.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:21 MSIf30f5.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:21 MSIf30fa.tmp
X      2 drwxr-xr-x     0      0      4096 29-Aug-2011 18:26 MSIf3100.tmp
X    532 drwxr-xr-x     0      0      4096 29-Aug-2011 18:26 MSIf3109.tmp
X    532 drwxr-xr-x     0      0      4096 29-Aug-2011 18:26 MSIf3111.tmp
X    532 drwxr-xr-x     0      0      4096 16-Sep-2011 20:51 MSI5a139.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:53 _671078_
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:58 MSI2f187.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:58 MSI2f19f.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:58 MSI2f1b6.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:59 MSI2f1bf.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:59 _012268_
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 10:59 MSI2f1c7.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:07 MSI2f1e6.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:07 MSI2f1ff.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:07 MSI2f209.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:07 MSI2f223.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:08 MSI2f233.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:08 MSI2f24b.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:09 MSI2f259.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:09 MSI2f263.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:10 MSI2f27e.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:10 MSI2f288.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:10 MSI2f298.tmp
X    532 drwxr-xr-x     0      0      4096 18-Sep-2011 11:11 MSI2f2b0.tmp
X    532 drwxr-xr-x     0      0      4096  3-Oct-2011 09:32 _207654_
NTFS filesystem need to be repaired.


dir_partition inode=5
     HPFS - NTFS          38651 238 52 38912  97 33    4184064
     NTFS found using backup sector, blocksize=4096, 2142 MB / 2043 MiB
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0  3-Aug-2011 14:54 .
       5 dr-xr-xr-x     0      0         0  3-Aug-2011 14:54 ..

interface_write()
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 failed for partition type 07
FAT32 at 38650/233/48
Info: size boot_sector 4194304, partition 4194304
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
 2 P HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
 3 P HPFS - NTFS          10198 177 28 38650 233 47  457084928
 4 P FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
Change partition type:
 2 P HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB

ntfs_boot_sector
 1 * HPFS - NTFS              0  32 33    12 223 19     204800 [Réservé au système]
     NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
 2 P HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
NTFS at 12/223/20
NTFS at 12/223/20
filesystem size           163635200
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
 3 P HPFS - NTFS          10198 177 28 38650 233 47  457084928
filesystem size           4704045984691713348 2122442775132650031
sectors_per_cluster       206 54
mft_lcn                   911151509 3922555207
mftmirr_lcn               2401006066 895649204
clusters_per_mft_record   54 3
clusters_per_index_record 53 -31
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

fat32_boot_sector
 4 P FAT32 LBA            38650 233 48 38911 254 63    4194304 [HP_TOOLS]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT32 at 38650/233/48
Info: size boot_sector 4194304, partition 4194304
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081
FAT32 at 38650/233/48
Info: size boot_sector 4194304, partition 4194304
FAT1 : 8222-12302
FAT2 : 12303-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 522240 (2 - 522241)
fat_length 4081 calculated 4081
Boot sector
OK

Backup boot sector
OK

Sectors are identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Not an exFAT boot sector.
Not an exFAT boot sector.

 2 P HPFS - NTFS             12 223 20 10198 177 27  163635200
     NTFS, blocksize=4096, 83 GB / 78 GiB
Can't open filesystem. Filesystem seems damaged.
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

TestDisk exited normally.
If you have any idea, please feel free to ask me. Do you know a disk doctor could solve my problem ?

Thanks in advance.
Regards
Alexis
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: RAW parts, MFT fault...

#2 Post by Fiona »

Your second partition looks like the file system is faulty.
Your third partition indicates an invalid boot sector.
Can you diagnose your boot sector on this partition?
Start TestDisk, confirm at create a log with enter and select your affected disk.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
Please select your affected third partition.
Confirm at Boot.
Highlight Rebuild BS and hit Enter.
Rebuild your BS will be in progress.
Normally, it takes some minutes.
If it's finished, please post the info or upload a screen.
If you see a menu List, please highlight it and press enter.
Please let me know, do you see your data or an error message.
To get back to the previous screen, easily press q for Quit.

Infos will follow.

Fiona
Top
Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: RAW parts, MFT fault...

#3 Post by Lito »

The picture you uploaded of Windows Management, gives a clean bill of health to the partitions.
An alternative to fix the boot sector, may be to use FixMBR and /or Bootfix from Microsoft.
I think the disk would have to be in its original HP box, albeit for a short while.

There is a tool that you could download for free, and burn to a CD, to use now or at a later time,
from this site:
http://www.partitionwizard.com/
Download the free CD image (iso file) and burn with any tool. For example Nero (not free), ImgBurn (free), K3B (free with Linux), etc. I personally use this tool to quickly format or wipe clean my disks, and it does work. Mind i never have used it to solve a problem such as yours.

Bootfix and FixMBR are in the instalation disk for Windows XP. You will find instructions on how to use them in many sites. Is best to follow the advise of Microsoft, to avoid dodgie sites.

It may be worth your while to look at Redo - Backup and Recovery (includes a copy of PhotoRec). It also burns to a CD, and later you can boot from it. The main tasks that Redo performs is that allows you to make an image of the partitions on your drive (or the whole disk) for your pice of mind. Should anything go wrong, you will have a backup.
I have used this tool to recover files from a neighbours computer, (without having to hold their computer for days) and it does work. I did recover many of their lost pictures, working from images made with Redo. Partly using the included copy of PhtoRec, although using this tool from the CD was hard going, because it can only save files to root, and root is in memory.
Top
lomba
Posts: 4
Joined: 23 Aug 2012, 09:25

Re: RAW parts, MFT fault...

#4 Post by lomba »

Fiona, I tried to rebuild my partitions a lot of times : it lasts each time more than 12 hours and nothing change. I've no error message, but I can't access the data. There is nothing specific in the log file. That's the reason of my long delay to answer, because I tried many times to rebuild the part and I wasn't sure of the result (I wasn't each time in front of my computer due to the long rebuild time).
I think there is no more to do :(

Regards
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: RAW parts, MFT fault...

#5 Post by Fiona »

MFT (Master File Table) indicates that your file system is faulty.
If TestDisk doesn't find another partition displaying your data and rebuilding your boot sector doesn't work either, so it looks like that you need datarrcovery software.
PhotoRec migfht be an idea.
But it doesn't recover file names and directories.
Please let me know what kind of file types you'd like to recover.
Otherwise you'd need commercial datarecovery software.

Fiona
Top
Locked

Return to “Partition Recovery”