dispart clean, danach zweimal testdisk write
Posted: 11 Sep 2021, 17:29
Ich hab gleich zweimal Mist gebaut zuerst Diskpart clean auf die falsche 4TB Festplatte mit nur einer Partition, danach Testdisk write darauf doppelt ausgeführt.
Resultat:
3 Partitionen wo zuvor nur 1 war: 2x nicht zugeordnet 1x aktiv primär RAW
Die aktive ist leer unformatiert, die aktive ist leider kleiner als der vorherige bespielte Inhalt der Festplatte.
ich befürchte dass ich den falschen Partitions Tabellen Typ gewählt habe:
Partition table type defaults to EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40EZRZ-00WN9B0
Partition table type: Intel
Wie komm ich aus der Nummer wieder raus?
Das Tool EaseUS Data Recovery Wizard hat nach einem 15 Stündigen Scan angeboten die Daten auf eine weitere Festplatte zu sichern. Leider ist sind die dafür beim Scan gefundenen Files doppelt so groß wie die Festplatte selbst.
Testdisk log:
Wed Sep 8 21:02:26 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999019065344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=606076928
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDS100T2X0C-00L350, S/N:1903_8780_0306_0001_001B_448B_445B_CB22., FW:101200WD
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WDC WD40EZRZ-00WN9B0, S/N:WD-WCC4E0NE5L52, FW:80.00A80
Partition table type defaults to EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40EZRZ-00WN9B0
Partition table type: Intel
Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,2,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,8,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,7814037376(486401/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037512(486401/86/30)) lseek err Invalid argument
file_pread(5,3,buffer,7814037520(486401/86/38)) lseek err Invalid argument
file_pread(5,3,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037583(486401/87/38)) lseek err Invalid argument
file_pread(5,11,buffer,7814037630(486401/88/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814039552(486401/118/54)) lseek err Invalid argument
Results
* HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
interface_write()
1 * HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 7813771264 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 7813771264 > partition 4294967295
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 16 113 34 267365 202 36 4294967295
1 * HPFS - NTFS 16 113 34 267365 202 36 4294967295
search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,2,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,8,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,7814037376(486401/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037512(486401/86/30)) lseek err Invalid argument
file_pread(5,3,buffer,7814037520(486401/86/38)) lseek err Invalid argument
file_pread(5,3,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037583(486401/87/38)) lseek err Invalid argument
file_pread(5,11,buffer,7814037630(486401/88/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814039552(486401/118/54)) lseek err Invalid argument
Results
* HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
interface_write()
1 * HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Partition table type (auto): Intel
SIGHUP detected! PhotoRec has been killed.
Resultat:
3 Partitionen wo zuvor nur 1 war: 2x nicht zugeordnet 1x aktiv primär RAW
Die aktive ist leer unformatiert, die aktive ist leider kleiner als der vorherige bespielte Inhalt der Festplatte.
ich befürchte dass ich den falschen Partitions Tabellen Typ gewählt habe:
Partition table type defaults to EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40EZRZ-00WN9B0
Partition table type: Intel
Wie komm ich aus der Nummer wieder raus?
Das Tool EaseUS Data Recovery Wizard hat nach einem 15 Stündigen Scan angeboten die Daten auf eine weitere Festplatte zu sichern. Leider ist sind die dafür beim Scan gefundenen Files doppelt so groß wie die Festplatte selbst.
Testdisk log:
Wed Sep 8 21:02:26 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999019065344
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=606076928
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDS100T2X0C-00L350, S/N:1903_8780_0306_0001_001B_448B_445B_CB22., FW:101200WD
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WDC WD40EZRZ-00WN9B0, S/N:WD-WCC4E0NE5L52, FW:80.00A80
Partition table type defaults to EFI GPT
Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40EZRZ-00WN9B0
Partition table type: Intel
Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,2,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,8,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,7814037376(486401/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037512(486401/86/30)) lseek err Invalid argument
file_pread(5,3,buffer,7814037520(486401/86/38)) lseek err Invalid argument
file_pread(5,3,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037583(486401/87/38)) lseek err Invalid argument
file_pread(5,11,buffer,7814037630(486401/88/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814039552(486401/118/54)) lseek err Invalid argument
Results
* HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
interface_write()
1 * HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 7813771264 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 7813771264 > partition 4294967295
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 16 113 34 267365 202 36 4294967295
1 * HPFS - NTFS 16 113 34 267365 202 36 4294967295
search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,2,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037515(486401/86/33)) lseek err Invalid argument
file_pread(5,2,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,1,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,1,buffer,7814037578(486401/87/33)) lseek err Invalid argument
file_pread(5,8,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,7814037248(486401/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,7814037376(486401/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,7814037504(486401/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037512(486401/86/30)) lseek err Invalid argument
file_pread(5,3,buffer,7814037520(486401/86/38)) lseek err Invalid argument
file_pread(5,3,buffer,7814037567(486401/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,7814037583(486401/87/38)) lseek err Invalid argument
file_pread(5,11,buffer,7814037630(486401/88/22)) lseek err Invalid argument
file_pread(5,2,buffer,7814039552(486401/118/54)) lseek err Invalid argument
Results
* HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
interface_write()
1 * HPFS - NTFS 16 113 34 486401 53 52 7813771264 [Daten_WD_4TB]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Partition table type (auto): Intel
SIGHUP detected! PhotoRec has been killed.