Recuperer une partition avec testdisk

Comment utiliser TestDisk pour récupérer une partition perdue
Locked
Message
Author
parisien
Posts: 3
Joined: 02 Jan 2013, 21:26

Recuperer une partition avec testdisk

#1 Post by parisien »

Bonjour.

En voulant changer la taille d'une partition avec paragon, celle ci c'est retrouvée en raw.

Quand je vais dans le gestionnaire de disques de windows, je le vois sur le disque (N:) :
Image

Donc si windows le voit, testdisk devrait le voir.

Mais lorsque je scan les partitions, je ne trouve aucune partition de la même taille.
Image

la taille chaque ligne fait :
NTFS 33GB / 31 GiB
FAT 442 KB / 432 KiB
NTFS 419 GB / 390 GiB
NTFS 292 GB / 272 GiB

voici le log :

Code: Select all


Wed Jan  2 19:41:34 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive6
filewin32_getfilesize(\\.\PhysicalDrive7) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive7) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive7
filewin32_getfilesize(\\.\PhysicalDrive8) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive8) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive8
filewin32_getfilesize(\\.\PhysicalDrive9) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive9) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive9
filewin32_getfilesize(\\.\PhysicalDrive10) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive10) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive10
filewin32_getfilesize(\\.\PhysicalDrive11) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive11) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive11
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1000097185792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4189749248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=458206740480
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=292579966976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=188622045184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=644140236800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=419430400000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=487290044416
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=512107741184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=644244045824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=33690746880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=0
Warning: can't get size for \\.\V:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=0
Warning: can't get size for \\.\W:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=0
Warning: can't get size for \\.\X:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=0
Warning: can't get size for \\.\Y:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=0
Warning: can't get size for \\.\Z:
file_pread(4,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(7,1,buffer,1953525599(2713229/59/12)) lseek err Invalid argument
file_pread(8,1,buffer,1565576833(364801/254/63)) lseek err Invalid argument
file_pread(9,1,buffer,3907040129(243201/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1002FAEX-00Z3A0, S/N:2020202057202d44435754413952353132333537, FW:05.01D05
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500630AS, S/N:2020202020202020202020205136304737385a34, FW:3.AAK
Disk /dev/sdc - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - SAMSUNG SSD 830 Series, S/N:30533059454e4341303636323933202020202020, FW:CXM03B1Q
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 2713229 60 12, sector size=512 - SAMSUNG HD103UJ, S/N:31535033394a5343303330363633202020202020, FW:1AA01113
Disk /dev/sde - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00DC0B0, S/N:2020202057202d444d5731433054363333343830, FW:80.00A80
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:2020202057202d444d575a413141353637383732, FW:51.0AB51
Drive D: - 4189 MB / 3995 MiB - CHS 998 64 32, sector size=2048 - HL-DT-ST BD-RE  BH10LS30, FW:1.00
Drive U: - 33 GB / 31 GiB - CHS 4096 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdf - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel
file_pread(9,1,buffer,3907040129(243201/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 12/223/20
NTFS at 78325/33/45
heads/cylinder 135 (NTFS) != 255 (HD)
sect/track 14 (NTFS) != 63 (HD)
check_part_i386 failed for partition type 07
NTFS at 129318/25/52
Current partition structure:
 1 P HPFS - NTFS             12 223 20 78325  33 44 1258086400 [deb2012]
Warning: Incorrect number of heads/cylinder 135 (NTFS) != 255 (HD)
Warning: Incorrect number of sectors per track 14 (NTFS) != 63 (HD)
 2 P HPFS - NTFS          78325  33 45 129317 248 19  819200000 [Nouveau nom]
 3 E extended LBA         129317 248 20 164888 235 19  571447296
Invalid NTFS or EXFAT boot
 4 P HPFS - NTFS          164888 235 20 224131 228 33  951738368
 4 P HPFS - NTFS          164888 235 20 224131 228 33  951738368
No partition is bootable
   X extended             129318  25 51 164888 235 19  571445249
 5 L HPFS - NTFS          129318  25 52 164888 235 19  571445248 [ANCIEN C1]
Je viens de lancer le deeper search.

Mais j'ai peu d'espoir.

Qu'en pensez vous ?

parisien
Posts: 3
Joined: 02 Jan 2013, 21:26

Re: Recuperer une partition avec testdisk

#2 Post by parisien »

je viens de finir le deeper search.

voici la capture :
Image

et la taille indiqué quand je vais sur chacune des lignes :

NTFS, 33 GB / 31 GiB
NTFS, 104 GB / 100 GiB
NTFS, 104 GB / 100 GiB
NTFS, 644 GB / 599 GiB
NTFS found using backup sector!, 2000 GB / 1862 GiB
FAT12, 442 KB / 431 KiB
NTFS, 419 GB / 390 GiB
NTFS, 292 GB / 272 GiB

(donc rien qui semble avoir la taille de la partition raw)

Je trouve quand même etonnant qu'un soft si évolué que testdisk ne voit pas une partition que windows peut voir. J'en déduis que c'est moi qui ai du faire mal quelque chose peut etre !!!!

et voici le nouveau log aprés le deep search :

Code: Select all


Wed Jan  2 19:41:34 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive6
filewin32_getfilesize(\\.\PhysicalDrive7) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive7) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive7
filewin32_getfilesize(\\.\PhysicalDrive8) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive8) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive8
filewin32_getfilesize(\\.\PhysicalDrive9) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive9) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive9
filewin32_getfilesize(\\.\PhysicalDrive10) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive10) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive10
filewin32_getfilesize(\\.\PhysicalDrive11) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\PhysicalDrive11) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\PhysicalDrive11
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1000097185792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4189749248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=458206740480
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=292579966976
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=188622045184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=644140236800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=419430400000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=487290044416
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=512107741184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=644244045824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=33690746880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=0
Warning: can't get size for \\.\V:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=0
Warning: can't get size for \\.\W:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=0
Warning: can't get size for \\.\X:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=0
Warning: can't get size for \\.\Y:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Z:)=0
Warning: can't get size for \\.\Z:
file_pread(4,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(7,1,buffer,1953525599(2713229/59/12)) lseek err Invalid argument
file_pread(8,1,buffer,1565576833(364801/254/63)) lseek err Invalid argument
file_pread(9,1,buffer,3907040129(243201/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD1002FAEX-00Z3A0, S/N:2020202057202d44435754413952353132333537, FW:05.01D05
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500630AS, S/N:2020202020202020202020205136304737385a34, FW:3.AAK
Disk /dev/sdc - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - SAMSUNG SSD 830 Series, S/N:30533059454e4341303636323933202020202020, FW:CXM03B1Q
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 2713229 60 12, sector size=512 - SAMSUNG HD103UJ, S/N:31535033394a5343303330363633202020202020, FW:1AA01113
Disk /dev/sde - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00DC0B0, S/N:2020202057202d444d5731433054363333343830, FW:80.00A80
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:2020202057202d444d575a413141353637383732, FW:51.0AB51
Drive D: - 4189 MB / 3995 MiB - CHS 998 64 32, sector size=2048 - HL-DT-ST BD-RE  BH10LS30, FW:1.00
Drive U: - 33 GB / 31 GiB - CHS 4096 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdf - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel
file_pread(9,1,buffer,3907040129(243201/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 12/223/20
NTFS at 78325/33/45
heads/cylinder 135 (NTFS) != 255 (HD)
sect/track 14 (NTFS) != 63 (HD)
check_part_i386 failed for partition type 07
NTFS at 129318/25/52
Current partition structure:
 1 P HPFS - NTFS             12 223 20 78325  33 44 1258086400 [deb2012]
Warning: Incorrect number of heads/cylinder 135 (NTFS) != 255 (HD)
Warning: Incorrect number of sectors per track 14 (NTFS) != 63 (HD)
 2 P HPFS - NTFS          78325  33 45 129317 248 19  819200000 [Nouveau nom]
 3 E extended LBA         129317 248 20 164888 235 19  571447296
Invalid NTFS or EXFAT boot
 4 P HPFS - NTFS          164888 235 20 224131 228 33  951738368
 4 P HPFS - NTFS          164888 235 20 224131 228 33  951738368
No partition is bootable
   X extended             129318  25 51 164888 235 19  571445249
 5 L HPFS - NTFS          129318  25 52 164888 235 19  571445248 [ANCIEN C1]
Computes LBA from CHS for Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdf - 2000 GB / 1863 GiB - CHS 243202 255 63
NTFS at 0/1/1
filesystem size           65818242
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  4096 254 63   65818242
     NTFS, 33 GB / 31 GiB
FAT12 at 66392/43/20
FAT1 : 1-1
FAT2 : 2-2
start_rootdir : 3
Data : 35-862
sectors : 864
cluster_size : 4
no_of_cluster : 207 (2 - 208)
fat_length 1 calculated 1
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 66392/43/20
     FAT12                66392  43 20 66392  57  1        864 [ANACONDA]
     FAT12, 442 KB / 432 KiB
NTFS at 78325/33/45
heads/cylinder 135 (NTFS) != 255 (HD)
sect/track 14 (NTFS) != 63 (HD)
filesystem size           819200000
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          78325  33 45 129317 248 19  819200000 [Nouveau nom]
     NTFS, 419 GB / 390 GiB
NTFS at 129318/25/52
filesystem size           571445248
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          129318  25 52 164888 235 19  571445248 [ANCIEN C1]
     NTFS, 292 GB / 272 GiB
file_pread(9,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(9,7,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(9,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(9,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(9,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(9,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(9,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(9,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0   1  1  4096 254 63   65818242
     NTFS, 33 GB / 31 GiB
   P FAT12                66392  43 20 66392  57  1        864 [ANACONDA]
     FAT12, 442 KB / 432 KiB
   P HPFS - NTFS          78325  33 45 129317 248 19  819200000 [Nouveau nom]
     NTFS, 419 GB / 390 GiB
   L HPFS - NTFS          129318  25 52 164888 235 19  571445248 [ANCIEN C1]
     NTFS, 292 GB / 272 GiB

interface_write()
 1 * HPFS - NTFS              0   1  1  4096 254 63   65818242
 2 P FAT12                66392  43 20 66392  57  1        864 [ANACONDA]
 3 P HPFS - NTFS          78325  33 45 129317 248 19  819200000 [Nouveau nom]
 4 E extended LBA         129318   0  1 243201 254 63 1829546460
 5 L HPFS - NTFS          129318  25 52 164888 235 19  571445248 [ANCIEN C1]
Si quelqu'un peut me donner une idée pour récuperer la partition je lui en serait vraiment très reconnaissant !!!!

Merci à tous.

Locked