Re: DD+Clef effacés (Reste 4 partitions : 1 Sys=4F, 2 Sys=73, 3 Sys=2B et 4 SpeedStor)
Posted: 22 Dec 2025, 08:17
J'ai réussi à récuperer la partition du Disque dur avec TestDisk. Merci !!!!
J'ai mis le log ici.
Ca resemble à une disparition suprimée tout simplement. Apres récupération, HiJackThis trouve plein d'Alternate Stream Data sur des fichiers au hasard, que j'ai supprimé. Est-ce que cela ressemble à quelquechose de connu?
J'ai mis le log ici.
Code: Select all
Sun Dec 21 15:27:19 2025
Command line: TestDisk
TestDisk 7.3-WIP, Data Recovery Utility, September 2025
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 13.4, Cygwin32 3003.3
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ATA SanDisk SDSSDXP1, S/N:132094400097
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - LaCie P9223, S/N:2MH7D3LN0000, FW:1053
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - LaCie P9223
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616
No partition is bootable
search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4144453452 12099646
check_part_i386 failed for partition type 07
HPFS - NTFS 257980 75 28 349073 67 15 1463408529
This partition ends after the disk limits. (start=4144453452, size=1463408529, end=5607861980, disk end=1953525168)
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1000 GB / 931 GiB) seems too small! (< 2871 GB / 2674 GiB)
The following partition can't be recovered:
HPFS - NTFS 257980 75 28 349073 67 15 1463408529
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4144453452 12099646
check_part_i386 failed for partition type 07
HPFS - NTFS 257980 75 28 349073 67 15 1463408529
This partition ends after the disk limits. (start=4144453452, size=1463408529, end=5607861980, disk end=1953525168)
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (1000 GB / 931 GiB) seems too small! (< 2871 GB / 2674 GiB)
The following partition can't be recovered:
HPFS - NTFS 257980 75 28 349073 67 15 1463408529
Results
* HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
dir_partition inode=5
P HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 3-Dec-2025 14:16 .
5 dr-xr-xr-x 0 0 0 3-Dec-2025 14:16 ..
403 dr-xr-xr-x 0 0 0 1-Dec-2025 13:39 $RECYCLE.BIN
72626 dr-xr-xr-x 0 0 0 28-Nov-2025 09:32 FEP
38 dr-xr-xr-x 0 0 0 22-Aug-2019 07:53 LaCie Setup
407 dr-xr-xr-x 0 0 0 21-Oct-2025 22:24 MEDIA
80922 dr-xr-xr-x 0 0 0 20-Nov-2025 12:25 PRIVAT
16969 dr-xr-xr-x 0 0 0 19-Mar-2021 23:01 System Volume Information
35 -r--r--r-- 0 0 1123049 22-Aug-2019 07:53 .VolumeIcon.icns
36 -r--r--r-- 0 0 619838 22-Aug-2019 07:53 .VolumeIcon.ico
37 -r--r--r-- 0 0 33 22-Aug-2019 07:53 autorun.inf
interface_write()
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
filesystem size 320881733296173847 1953519616
sectors_per_cluster 124 8
mft_lcn 14992745406053418504 786432
mftmirr_lcn 10416984888689325032 2
clusters_per_mft_record -112 -10
clusters_per_index_record -112 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Directory /
5 dr-xr-xr-x 0 0 0 3-Dec-2025 14:16 .
5 dr-xr-xr-x 0 0 0 3-Dec-2025 14:16 ..
403 dr-xr-xr-x 0 0 0 1-Dec-2025 13:39 $RECYCLE.BIN
72626 dr-xr-xr-x 0 0 0 28-Nov-2025 09:32 FEP
38 dr-xr-xr-x 0 0 0 22-Aug-2019 07:53 LaCie Setup
407 dr-xr-xr-x 0 0 0 21-Oct-2025 22:24 MEDIA
80922 dr-xr-xr-x 0 0 0 20-Nov-2025 12:25 PRIVAT
16969 dr-xr-xr-x 0 0 0 19-Mar-2021 23:01 System Volume Information
35 -r--r--r-- 0 0 1123049 22-Aug-2019 07:53 .VolumeIcon.icns
36 -r--r--r-- 0 0 619838 22-Aug-2019 07:53 .VolumeIcon.ico
37 -r--r--r-- 0 0 33 22-Aug-2019 07:53 autorun.inf
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 0/32/33
MFT and MFT mirror match perfectly.
MFT and MFT mirror match perfectly.
ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121601 25 24 1953519616 [LaCie]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.
TestDisk exited normally.