cgsecurity.org

Posted: **26 Aug 2012, 01:54**

Dear Gurus,

I'm facing very similiar situation to http://forum.cgsecurity.org/phpBB3/post ... imit#p3434 , but with different size of disk and I do not know if I can apply the very same steps like in "try folowwing" from http://forum.cgsecurity.org/phpBB3/post ... icky#p1093

If so, what should be the cylinder value?

My disc:
WESTERN DIGITAL WD My Book Essential 1TB Ext. 3.5" USB2.0, 16MB cache (single drive)

Using TestDisk 6.14WIPwin64 on W7 Home.

Log:
search_part()
Drive H: - 999 GB / 930 GiB - CHS 121515 255 63
BAD_RS LBA=925781040 9747443
check_part_i386 failed for partition type 0B
FAT32 57627 52 10 322344 7 21 4252675782
This partition ends after the disk limits. (start=925781040, size=4252675782, end=883489525, disk end=1952149504)
Drive H: - 999 GB / 930 GiB - CHS 121515 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (999 GB / 930 GiB) seems too small! (< 2651 GB / 2469 GiB)
The following partition can't be recovered:
FAT32 57627 52 10 322344 7 21 4252675782

Thanks a lot for any feedback.
Filip

Posted: **01 Sep 2012, 08:11**

Don't select H: but the physical drive if possible.

Posted: **22 Sep 2012, 16:33**

UPDATED
Thanks a lot for help. I tried the physical disk deep analyze, it ends with error:

Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB - CHS 121515 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (999 GB / 930 GiB) seems too small! (< 2651 GB / 2469 GiB)
The following partition can't be recovered:
FAT32 57627 84 42 322344 39 53 4252675782

Here is log:

Code: Select all

Sun Sep 23 04:18:43 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, July 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, MinGW 3.11
Compilation date: Aug 14 2012 11:59:38
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=999501594624
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Nesprávná funkce.


filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Nesprávná funkce.


Warning: can't get size for \\.\PhysicalDrive2
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1004795944960
filewin32_getfilesize(\\.\D:) GetFileSize err Nesprávná funkce.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Nesprávná funkce.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=0
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=700448768
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=995494985728
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=999500546048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=5500665856
Hard disk list
Disk \\.\PhysicalDrive0 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB - CHS 121515 255 63, sector size=512
Drive C: - 1004 GB / 935 GiB - CHS 122159 255 63, sector size=512
Drive F: - 700 MB / 668 MiB - CHS 167 64 32, sector size=2048
Drive G: - 995 GB / 927 GiB - CHS 121028 255 63, sector size=512
Drive H: - 999 GB / 930 GiB - CHS 121515 255 63, sector size=512
Drive J: - 5500 MB / 5245 MiB - CHS 1311 64 32, sector size=2048

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB - CHS 121515 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
Failed to read index block: Input/output error.

search_part()
Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/32/33
filesystem size           1952149504
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122009343
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
     NTFS, blocksize=4096, 999 GB / 930 GiB

Results
   * HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
     NTFS, blocksize=4096, 999 GB / 930 GiB


dir_partition inode=5
   * HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
     NTFS, blocksize=4096, 999 GB / 930 GiB
file_win32_pread(92,16,buffer,3615408(225/12/28)) read err: read after end of file
file_win32_pread(92,1,buffer,3615408(225/12/28)) read err: read after end of file
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0 21-Aug-2012 11:55 .
       5 dr-xr-xr-x     0      0         0 21-Aug-2012 11:55 ..

interface_write()
 1 * HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]

search_part()
Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB - CHS 121515 255 63
NTFS at 0/32/33
filesystem size           1952149504
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122009343
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
     NTFS, blocksize=4096, 999 GB / 930 GiB
BAD_RS LBA=925783088 9747443
check_part_i386 failed for partition type 0B
     FAT32                57627  84 42 322344  39 53 4252675782
This partition ends after the disk limits. (start=925783088, size=4252675782, end=883491573, disk end=1952151552)
NTFS at 121515/207/36
filesystem size           1952149504
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               122009343
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
     NTFS found using backup sector, blocksize=4096, 999 GB / 930 GiB
Disk \\.\PhysicalDrive1 - 999 GB / 930 GiB - CHS 121515 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (999 GB / 930 GiB) seems too small! (< 2651 GB / 2469 GiB)
The following partition can't be recovered:
     FAT32                57627  84 42 322344  39 53 4252675782

Results
   * HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
     NTFS, blocksize=4096, 999 GB / 930 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33 121515 207 36 1952149504 [My Book]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

All ideas and hints are really apreciated.
Thanks and have a good rest of weekend.

Filip

Posted: **26 Sep 2012, 19:59**

I really feel that my issue is similiar to
http://forum.cgsecurity.org/phpBB3/post ... imit#p3434
and
http://forum.cgsecurity.org/phpBB3/post ... icky#p1093

but I do not know what should be the number of cylinders for my 1TB WD harddisk.
Can somebody support me?

Cheers, Filip

cgsecurity.org

This partition ends after the disk limits (1TB)

This partition ends after the disk limits (1TB)

Re: This partition ends after the disk limits (1TB)

Re: This partition ends after the disk limits (1TB)

Re: This partition ends after the disk limits (1TB)