Partition without endmark 0xAA55

Comment utiliser TestDisk pour récupérer une partition perdue
Locked
Message
Author
hozkar
Posts: 2
Joined: 08 Jul 2013, 21:30

Partition without endmark 0xAA55

#1 Post by hozkar »

Hi,
Faulty DD is Maxtor 160GB in "Craft Cooler Master" Box with USB interface.
Testdisk recognize the DD as "Initio 6L160P0" but didn't find the partition (there should be 1 partition).
In the log "Partition sector doesn't have the endmark 0xAA55" is mentioned.
I follow your instruction (video) but still it doesn't work.
Thx for your help !
Br

Mon Jul 8 21:37:21 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=163928604672
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=163928604672
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80530636800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=79508275200
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
file_pread(4,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,320175449(19929/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD16 00BEVT-75A23, S/N:W -DXW135A705103, FW:01.0
Disk /dev/sdb - 163 GB / 152 GiB - CHS 19929 255 63, sector size=512 - Initio 6L160P0, FW:3.12

Partition table type (auto): Intel
Disk /dev/sdb - 163 GB / 152 GiB - Initio 6L160P0
Partition table type: Intel

Analyse Disk /dev/sdb - 163 GB / 152 GiB - CHS 19929 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

hozkar
Posts: 2
Joined: 08 Jul 2013, 21:30

Partition without endmark 0xAA55 (con't)

#2 Post by hozkar »

Hi,
I did really nothing else than to repeat the test ... and behaviour looks different,
MFT seems now the root cause ...
Br


Mon Jul 8 23:05:30 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=163928604672
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=163928604672
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=80530636800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=79508275200
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=163913347584
file_pread(4,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,320175449(19929/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD16 00BEVT-75A23, S/N:W -DXW135A705103, FW:01.0
Disk /dev/sdb - 163 GB / 152 GiB - CHS 19929 255 63, sector size=512 - Initio 6L160P0, FW:3.12

Partition table type (auto): Intel
Disk /dev/sdb - 163 GB / 152 GiB - Initio 6L160P0
Partition table type: Intel

Analyse Disk /dev/sdb - 163 GB / 152 GiB - CHS 19929 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 163 GB / 152 GiB - CHS 19930 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 163 GB / 152 GiB - CHS 19930 255 63
NTFS at 0/1/1
filesystem size 320143257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
file_pread(5,2,buffer,320174080(19929/233/17)) lseek err Invalid argument
file_pread(5,1,buffer,320174080(19929/233/17)) lseek err Invalid argument
file_pread(5,7,buffer,320174081(19929/233/18)) lseek err Invalid argument
file_pread(5,8,buffer,320174088(19929/233/25)) lseek err Invalid argument
file_pread(5,3,buffer,320174096(19929/233/33)) lseek err Invalid argument
file_pread(5,3,buffer,320174143(19929/234/17)) lseek err Invalid argument
file_pread(5,8,buffer,320174159(19929/234/33)) lseek err Invalid argument
file_pread(5,11,buffer,320174206(19929/235/17)) lseek err Invalid argument
file_pread(5,2,buffer,320176128(19930/10/49)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
Not an exFAT boot sector.

* HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 163 GB / 152 GiB - CHS 19930 255 63
NTFS at 0/1/1
filesystem size 320143257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
Not an exFAT boot sector.

* HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 320143257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Not an exFAT boot sector.

1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 320143257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
repair_MFT
NTFS at 0/1/1
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 320143257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Boot sector Backup boot sector
0000 eb52904e 54465320 .R.NTFS eb52904e 54465320 .R.NTFS
0008 20202000 02080000 ..... 20202000 02080000 .....
0010 00000000 00f80000 ........ 00000000 00f80000 ........
0018 3f00ff00 3f000000 ?...?... 3f00ff00 3f000000 ?...?...
0020 00000000 80008000 ........ 00000000 80008000 ........
0028 98ff1413 00000000 ........ 98ff1413 00000000 ........
0030 00000c00 00000000 ........ 00000c00 00000000 ........
0038 02000000 00000000 ........ 02000000 00000000 ........
0040 f6000000 01000000 ........ f6000000 01000000 ........
0048 e3d07cd0 d97cd0c6 ..|..|.. e3d07cd0 d97cd0c6 ..|..|..
0050 00000000 fa33c08e .....3.. 00000000 fa33c08e .....3..
0058 d0bc007c fb68c007 ...|.h.. d0bc007c fb68c007 ...|.h..
0060 1f1e6866 00cb8816 ..hf.... 1f1e6866 00cb8816 ..hf....
0068 0e006681 3e03004e ..f.>..N 0e006681 3e03004e ..f.>..N
0070 54465375 15b441bb TFSu..A. 54465375 15b441bb TFSu..A.
0078 aa55cd13 720c81fb .U..r... aa55cd13 720c81fb .U..r...
0080 55aa7506 f7c10100 U.u..... 55aa7506 f7c10100 U.u.....
0088 7503e9dd 001e83ec u....... 7503e9dd 001e83ec u.......
0090 18681a00 b4488a16 .h...H.. 18681a00 b4488a16 .h...H..
0098 0e008bf4 161fcd13 ........ 0e008bf4 161fcd13 ........
00A0 9f83c418 9e581f72 .....X.r 9f83c418 9e581f72 .....X.r
00A8 e13b060b 0075dba3 .;...u.. e13b060b 0075dba3 .;...u..
00B0 0f00c12e 0f00041e ........ 0f00c12e 0f00041e ........
00B8 5a33dbb9 00202bc8 Z3... +. 5a33dbb9 00202bc8 Z3... +.
00C0 66ff0611 0003160f f....... 66ff0611 0003160f f.......
00C8 008ec2ff 061600e8 ........ 008ec2ff 061600e8 ........
00D0 4b002bc8 77efb800 K.+.w... 4b002bc8 77efb800 K.+.w...
00D8 bbcd1a66 23c0752d ...f#.u- bbcd1a66 23c0752d ...f#.u-
00E0 6681fb54 43504175 f..TCPAu 6681fb54 43504175 f..TCPAu
00E8 2481f902 01721e16 $....r.. 2481f902 01721e16 $....r..
00F0 6807bb16 68700e16 h...hp.. 6807bb16 68700e16 h...hp..
00F8 68090066 53665366 h..fSfSf 68090066 53665366 h..fSfSf
0100 55161616 68b80166 U...h..f 55161616 68b80166 U...h..f
0108 610e07cd 1a33c0bf a....3.. 610e07cd 1a33c0bf a....3..
0110 2810b9d8 0ffcf3aa (....... 2810b9d8 0ffcf3aa (.......
0118 e95f0190 9066601e ._...f`. e95f0190 9066601e ._...f`.
0120 0666a111 00660306 .f...f.. 0666a111 00660306 .f...f..
0128 1c001e66 68000000 ...fh... 1c001e66 68000000 ...fh...
0130 00665006 53680100 .fP.Sh.. 00665006 53680100 .fP.Sh..
0138 681000b4 428a160e h...B... 681000b4 428a160e h...B...
0140 00161f8b f4cd1366 .......f 00161f8b f4cd1366 .......f
0148 595b5a66 5966591f Y[ZfYfY. 595b5a66 5966591f Y[ZfYfY.
0150 0f821600 66ff0611 ....f... 0f821600 66ff0611 ....f...
0158 0003160f 008ec2ff ........ 0003160f 008ec2ff ........
0160 0e160075 bc071f66 ...u...f 0e160075 bc071f66 ...u...f
0168 61c3a0f8 01e80900 a....... 61c3a0f8 01e80900 a.......
0170 a0fb01e8 0300f4eb ........ a0fb01e8 0300f4eb ........
0178 fdb4018b f0ac3c00 ......<. fdb4018b f0ac3c00 ......<.
0180 7409b40e bb0700cd t....... 7409b40e bb0700cd t.......
0188 10ebf2c3 0d0a4572 ......Er 10ebf2c3 0d0a4572 ......Er
0190 72657572 206c6563 reur lec 72657572 206c6563 reur lec
0198 74757265 20646973 ture dis 74757265 20646973 ture dis
01A0 71756500 0d0a424f que...BO 71756500 0d0a424f que...BO
01A8 4f544d47 52206162 OTMGR ab 4f544d47 52206162 OTMGR ab
01B0 73656e74 000d0a42 sent...B 73656e74 000d0a42 sent...B
01B8 4f4f544d 47522063 OOTMGR c 4f4f544d 47522063 OOTMGR c
01C0 6f6d7072 65737382 ompress. 6f6d7072 65737382 ompress.
01C8 000d0a43 74726c2b ...Ctrl+ 000d0a43 74726c2b ...Ctrl+
01D0 416c742b 53757070 Alt+Supp 416c742b 53757070 Alt+Supp
01D8 7220706f 75722072 r pour r 7220706f 75722072 r pour r
01E0 6564826d 61727265 ed.marre 6564826d 61727265 ed.marre
01E8 720d0a00 6f207265 r...o re 720d0a00 6f207265 r...o re
01F0 73746172 740d0a00 start... 73746172 740d0a00 start...
01F8 8ca4b5c9 000055aa ......U. 8ca4b5c9 000055aa ......U.

ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 19927 254 63 320143257
NTFS, 163 GB / 152 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 320143257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

Locked