cgsecurity.org

First time using testdisk.

Trying to recover data from friends laptop HD, a WD5000BPVX. This is a 500GB drive. Their laptop died due to system board failure.

Connected to my laptop (running W10) with a SATA to USB adapter.

My laptop does not recognise drive correctly, says unformatted and DISKMANAGEMENT shows wrong size.

TESTDISK shows incorrect size and CHS values.

Any suggestions as what to do next?

TESTDISK log:
Sun Nov 22 21:19:53 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1669332992
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
Hard disk list
Drive E: - 1669 MB / 1592 MiB - CHS 25 255 63, sector size=4096 - WDC WD50 00BPVX-00JC3T0, S/N:152D20337A0C

Partition table type defaults to None
Drive E: - 1669 MB / 1592 MiB - WDC WD50 00BPVX-00JC3T0
Partition table type: Intel

Analyse Drive E: - 1669 MB / 1592 MiB - CHS 25 255 63
Current partition structure:
No partition is bootable

search_part()
Drive E: - 1669 MB / 1592 MiB - CHS 25 255 63
NTFS at 3/15/13
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 943738880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 3 15 13 7346 47 61 117967360
NTFS, blocksize=4096, 483 GB / 450 GiB
This partition ends after the disk limits. (start=49152, size=117967360, end=118016511, disk end=407552)
Drive E: - 1669 MB / 1592 MiB - CHS 25 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1669 MB / 1592 MiB) seems too small! (< 483 GB / 450 GiB)
The following partition can't be recovered:
HPFS - NTFS 3 15 13 7346 47 61 117967360
NTFS, blocksize=4096, 483 GB / 450 GiB

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Could you post the full log file?

Adapters for 2,5'' typically rely on the power supply of the computer. I consider using an externally powered docking station as an electrically safer alternative.

That is the full log file.

It is powered by a separate power supply, not through the USB bus.

mudrat wrote: 25 Nov 2020, 12:42 That is the full log file.

There is something rotten with the whole setup as your laptop drive is not listed. Very strange.

I agree, very strange, no listing at all of my laptop drives.

OK, newbie mistake. MUST RUN AS ADMINISTRATOR!

Now things look better.

Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - HITACHI HTS723232A7A364, S/N:E3834563JPKW6N, FW:EC2ZB70B
Disk /dev/sdb - 500 GB / 465 GiB - CHS 7600 255 63, sector size=4096 - WDC WD50 00BPVX-00JC3T0, S/N:152D20337A0C
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 7600 255 63, sector size=4096 - WDC WD50 00BPVX-00JC3T0, S/N:152D20337A0C
Drive D: - 208 MB / 199 MiB - CHS 3 255 63, sector size=4096 - WDC WD50 00BPVX-00JC3T0, S/N:152D20337A0C
Drive E: - 483 GB / 450 GiB - CHS 7343 255 63, sector size=4096 - WDC WD50 00BPVX-00JC3T0, S/N:152D20337A0C
Drive F: - 16 GB / 15 GiB - CHS 252 255 63, sector size=4096 - WDC WD50 00BPVX-00JC3T0, S/N:152D20337A0C

All 3 have error: Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)

Took info from other posts and got the sector size changed and I can now see the files. Will start file copy process now.