I could use some help recovering some NTFS disks that went RAW on my Windows 7 Ultimate system. I don't know what happened, system was running very slow, after reboot I got a "disk read error" before anything started. I removed the disk and plugged in a USB-device attached to a different computer. This showed the following:
Disk has four partitions/drives: H was my D-drive. This one still works fine. J was my C-drive, this one I would like very much to recover. According to the Medion Helpdesk G is a bitlocker partition.
I have run the testdisk analyse, but I am unsure how to continue. The log file up to now reports the following:
Code: Select all
Sun Jan 6 13:14:15 2013
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999317045248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202241024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2647570432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=53687091200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=945336352768
filewin32_getfilesize(\\.\L:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\L:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\L:
file_pread(4,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,1953536129(121601/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST310005 28AS, S/N:V93P3XBV, FW:CC45
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST310003 33AS
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Generic External, S/N:MSE5235V1NXG2U, FW:2.10
Drive E: - 2647 MB / 2524 MiB - CHS 631 64 32, sector size=2048 - DTSOFT BDROM, FW:1.05
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - Generic External
Partition table type: Intel
Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
NTFS at 114943/120/58
check_part_i386 4 type 12: no test
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800
Invalid NTFS or EXFAT boot
2 P HPFS - NTFS 12 223 20 114943 120 57 1846360064
2 P HPFS - NTFS 12 223 20 114943 120 57 1846360064
3 P HPFS - NTFS 114943 120 58 121470 142 16 104857600 [Recover]
4 P Compaq Diagnostics 121470 142 17 121601 48 31 2098608
Computes LBA from CHS for Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121602 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, 104 MB / 100 MiB
file_pread(6,16,buffer,206848(12/223/20)) read err: Invalid argument
file_pread(6,1,buffer,206848(12/223/20)) read err: Invalid argument
file_pread(6,7,buffer,206849(12/223/21)) read err: Invalid argument
file_pread(6,16,buffer,259151(16/33/33)) read err: Invalid argument
file_pread(6,1,buffer,259151(16/33/33)) read err: Invalid argument
file_pread(6,16,buffer,2925941(182/33/33)) read err: Invalid argument
file_pread(6,16,buffer,4899951(305/2/1)) read err: Invalid argument
file_pread(6,1,buffer,4899961(305/2/11)) read err: Invalid argument
file_pread(6,16,buffer,4899967(305/2/17)) read err: Invalid argument
file_pread(6,1,buffer,4899967(305/2/17)) read err: Invalid argument
file_pread(6,16,buffer,4921470(306/88/37)) read err: Invalid argument
file_pread(6,1,buffer,4921470(306/88/37)) read err: Invalid argument
file_pread(6,16,buffer,4923455(306/120/6)) read err: Invalid argument
file_pread(6,1,buffer,4923456(306/120/7)) read err: Invalid argument
file_pread(6,8,buffer,4923471(306/120/22)) read err: Invalid argument
file_pread(6,16,buffer,4925566(306/153/38)) read err: Invalid argument
file_pread(6,1,buffer,4925568(306/153/40)) read err: Invalid argument
file_pread(6,16,buffer,4934003(307/32/33)) read err: Invalid argument
file_pread(6,1,buffer,4934003(307/32/33)) read err: Invalid argument
file_pread(6,16,buffer,6598672(410/190/53)) read err: Invalid argument
file_pread(6,1,buffer,6598672(410/190/53)) read err: Invalid argument
file_pread(6,16,buffer,26388606(1642/156/49)) read err: Invalid argument
file_pread(6,1,buffer,26388606(1642/156/49)) read err: Invalid argument
file_pread(6,16,buffer,34019328(2117/154/22)) read err: Invalid argument
file_pread(6,1,buffer,34019328(2117/154/22)) read err: Invalid argument
file_pread(6,7,buffer,34019329(2117/154/23)) read err: Invalid argument
file_pread(6,16,buffer,34019391(2117/155/22)) read err: Invalid argument
file_pread(6,1,buffer,34019391(2117/155/22)) read err: Invalid argument
file_pread(6,8,buffer,34019407(2117/155/38)) read err: Invalid argument
file_pread(6,11,buffer,34019454(2117/156/22)) read err: Invalid argument
LVM magic value at 55837/73/45
NTFS at 114943/120/58
filesystem size 104857600
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 114943 120 58 121470 142 16 104857600 [Recover]
NTFS, 53 GB / 50 GiB
NTFS at 121470/142/17
filesystem size 2098608
sectors_per_cluster 8
mft_lcn 87442
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 121470 142 17 121601 48 31 2098608
NTFS, 1074 MB / 1024 MiB
file_pread(6,2,buffer,1953525200(121601/81/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525200(121601/81/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525231(121601/82/1)) lseek err Invalid argument
file_pread(6,1,buffer,1953525231(121601/82/1)) lseek err Invalid argument
file_pread(6,2,buffer,1953525263(121601/82/33)) lseek err Invalid argument
file_pread(6,1,buffer,1953525263(121601/82/33)) lseek err Invalid argument
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,1,buffer,1953525248(121601/82/18)) lseek err Invalid argument
file_pread(6,8,buffer,1953525376(121601/84/20)) lseek err Invalid argument
file_pread(6,8,buffer,1953525504(121601/86/22)) lseek err Invalid argument
file_pread(6,8,buffer,1953525632(121601/88/24)) lseek err Invalid argument
file_pread(6,7,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,8,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525768(121601/90/34)) lseek err Invalid argument
file_pread(6,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(6,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(6,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(6,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, 104 MB / 100 MiB
P HPFS - NTFS 114943 120 58 121470 142 16 104857600 [Recover]
NTFS, 53 GB / 50 GiB
P HPFS - NTFS 121470 142 17 121601 48 31 2098608
NTFS, 1074 MB / 1024 MiB
interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800
2 P HPFS - NTFS 114943 120 58 121470 142 16 104857600 [Recover]
3 P HPFS - NTFS 121470 142 17 121601 48 31 2098608
All partitions are now marked as deleted. Quick look at the partition now named "boot" shows files, so I am hopeful that I can recover the drive. I guess I need to change the D into *, P and perhaps L, but the big question what partition should get what mark? Could anybody help me out with this?
Also, do the read and lseek errors in the log, mean the disk is bad and should I have it replaced? The system still has warranty.
Tnx,
Niels