cgsecurity.org

Bonjour,

J'essaie de récupérer mes données d'un disque endommagé mais je ne sais pas trop comment utiliser testdisk dans mon cas malgré les tutos.

Mon disque fait 2To, il a a priori 5 secteurs illisibles. J'en ai fait une image sur un disque sain de 4To avec ddrescue.
L'espace total est vu comme non alloué par les OS.
Il s'agit d'un disque qui contient une partition windows avec mes données (sans l'os) + 1 (ou plus je sais plus) partition d'os linux.

Mes données à récupérer sont sur la partition windows, en particulier un gros fichier TrueCrypt
A noter que Photorec fonctionne et me récupère plein de photo, mais il me semble qu'il ne supporte pas le format TrueCrypt

Voici le résultat de l'analyse tesdisk du fichier image, en choisissant partition de type intel/pc

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63

The harddisk (2000 GB / 1863 GiB) seems too small! (< 3888 GB / 3621 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
Partition Start End Size in sectors
> Linux 121751 232 18 364363 156 17 3897556992 [1.41.12-3211]
Linux 121759 77 47 364371 1 46 3897556992 [1.41.12-3211]
Linux 121760 17 50 364371 196 49 3897556992 [1.41.12-3211]
FAT12 231734 201 1 261405 179 26 476663255
FAT16 LBA 349728 207 33 472702 209 17 1975577421

Comment dois je interpréter cela ? Ma partition Données windows n'était peut-être pas en ntfs mais je devrais voir de la fat32 non ?

Merci de vos conseils !
Seb

Continuez sur l'écran suivant...
Faites un copier/coller du contenu du fichier testdisk.log. Cela évitera de vous donner un conseil mal informé.

Bonjour,

Merci de votre aide. Ci-dessous le contenu du testdisk.log

Je précise qu'avant d'être utilisé dans ma tour, ce disque était dans un NAS Synology en RAID SHR, ce qui explique sans doute les traces de partitions RAID qui sont relevées.


Command line: TestDisk /media/backup/recovery.img /log

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 5.4.0-42-generic (#46~18.04.1-Ubuntu SMP Fri Jul 10 07:21:24 UTC 2020) x86_64
Compiler: GCC 7.2
ext2fs lib: 1.44.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
Hard disk list
Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63, sector size=512

Partition table type default to Intel
Disk /media/backup/recovery.img - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63
Linux 134 190 57 444 194 6 4980352 [1.42.6-5698]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 2549 MB / 2431 MiB
BAD_RS LBA=3722819373 4133247
check_part_i386 failed for partition type 01
FAT12 231734 201 1 261405 179 26 476663255
This partition ends after the disk limits.
Linux 121751 232 18 364363 156 17 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
This partition ends after the disk limits.
Linux 121759 77 47 364371 1 46 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
This partition ends after the disk limits.
Linux 121760 17 50 364371 196 49 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
This partition ends after the disk limits.
BAD_RS LBA=5618393393 13557257
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
FAT16 LBA 349728 207 33 472702 209 17 1975577421
This partition ends after the disk limits.
Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 3888 GB / 3621 GiB)
The following partitions can't be recovered:
Linux 121751 232 18 364363 156 17 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
Linux 121759 77 47 364371 1 46 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
Linux 121760 17 50 364371 196 49 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
FAT12 231734 201 1 261405 179 26 476663255
FAT16 LBA 349728 207 33 472702 209 17 1975577421

ext2fs_dir_iterate failed with error 1.
Directory /

interface_write()
1 * Linux 134 190 57 444 200 12 4980736 [1.42.6-5698]

search_part()
Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63
Linux 134 190 57 444 194 6 4980352 [1.42.6-5698]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 2549 MB / 2431 MiB
Linux 137 76 4 447 79 16 4980352 [1.42.6-5698]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 2549 MB / 2431 MiB
Linux Swap 310 9 20 571 28 17 4194160
SWAP2 version 1, pagesize=4096, 2147 MB / 2047 MiB

Raid magic value at 571/28/34
Raid apparent size: 2180922880 sectors
Raid chunk size: 0 bytes
Linux RAID 310 9 20 571 30 35 4194304 [md1]
md 0.90.0 B.Endian Raid 1: devices 0(8,2)* 1(8,18), 2147 MB / 2048 MiB
BAD_RS LBA=3722819373 4133247
check_part_i386 failed for partition type 01
FAT12 231734 201 1 261405 179 26 476663255
This partition ends after the disk limits.
Linux 121751 232 18 364363 156 17 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
This partition ends after the disk limits.
Linux 121759 77 47 364371 1 46 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
This partition ends after the disk limits.
Linux 121760 17 50 364371 196 49 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
This partition ends after the disk limits.
BAD_RS LBA=5618393393 13557257
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
FAT16 LBA 349728 207 33 472702 209 17 1975577421
This partition ends after the disk limits.
Disk /media/backup/recovery.img - 2000 GB / 1863 GiB - CHS 243202 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 3888 GB / 3621 GiB)
The following partitions can't be recovered:
Linux 121751 232 18 364363 156 17 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
Linux 121759 77 47 364371 1 46 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
Linux 121760 17 50 364371 196 49 3897556992 [1.41.12-3211]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 1995 GB / 1858 GiB
FAT12 231734 201 1 261405 179 26 476663255
FAT16 LBA 349728 207 33 472702 209 17 1975577421

ext2fs_dir_iterate failed with error 1.
Directory /

interface_write()

No partition found or selected for recovery
simulate write!
No extended partition

TestDisk exited normally.