Code: Select all
Sun Dec 5 04:29:46 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=135175077888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=214914040320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=149489188864
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-9WS142, S/N:W0VBPEZ3, FW:0002SDM1
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - ST500LT012-9WS142
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 63/221/31
NTFS at 16498/21/60
BAD_RS LBA=684797952 2
NTFS at 42626/178/49
Current partition structure:
1 * HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
2 P HPFS - NTFS 63 221 31 16497 247 6 264013824
3 P HPFS - NTFS 16498 21 60 42626 143 38 419753985
4 E extended LBA 42626 178 47 60801 47 46 291973122
5 L HPFS - NTFS 42626 178 49 60801 15 14 291971072
Bad relative sector.
search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size 264013824
sectors_per_cluster 8
mft_lcn 6180
mftmirr_lcn 883
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63 221 31 16497 247 6 264013824
NTFS, blocksize=4096, 135 GB / 125 GiB
NTFS at 16498/21/60
filesystem size 419753985
sectors_per_cluster 8
mft_lcn 26600484
mftmirr_lcn 5012748
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16498 21 60 42626 143 38 419753985
NTFS, blocksize=4096, 214 GB / 200 GiB
Error: size boot_sector 291971072 > partition 188743680
check_part_i386 failed for partition type 07
HPFS - NTFS 42626 178 49 54375 115 12 188743680
recover_EXT2: s_block_group_nr=0/393, s_mnt_count=34/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 12903424
recover_EXT2: part_size 103227392
Filesystem created: Sat Feb 20 12:28:58 2021
Last mount time: Sun Aug 15 14:52:52 2021
Linux 54375 147 45 60801 47 46 103227392
ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
Results
* HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS, blocksize=4096, 524 MB / 500 MiB
P HPFS - NTFS 63 221 31 16497 247 6 264013824
NTFS, blocksize=4096, 135 GB / 125 GiB
P HPFS - NTFS 16498 21 60 42626 143 38 419753985
NTFS, blocksize=4096, 214 GB / 200 GiB
L HPFS - NTFS 42626 178 49 54375 115 12 188743680
L Linux 54375 147 45 60801 47 46 103227392
ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
add_ext_part_i386: max
add_ext_part_i386: max
interface_write()
1 * HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
2 P HPFS - NTFS 63 221 31 16497 247 6 264013824
3 P HPFS - NTFS 16498 21 60 42626 143 38 419753985
4 E extended LBA 42626 146 17 60801 80 15 291977216
5 L HPFS - NTFS 42626 178 49 54375 115 12 188743680
6 L Linux 54375 147 45 60801 47 46 103227392
search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 12/223/19
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 136212480
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 8491 181 10 136212480
NTFS, blocksize=4096, 69 GB / 64 GiB
NTFS at 63/221/30
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size 264013824
sectors_per_cluster 8
mft_lcn 6180
mftmirr_lcn 883
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63 221 31 16497 247 6 264013824
NTFS, blocksize=4096, 135 GB / 125 GiB
NTFS at 16498/21/60
filesystem size 419753985
sectors_per_cluster 8
mft_lcn 26600484
mftmirr_lcn 5012748
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16498 21 60 42626 143 38 419753985
NTFS, blocksize=4096, 214 GB / 200 GiB
BAD_RS LBA=684797952 2
NTFS at 42626/178/49
filesystem size 291971072
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 42626 178 49 60801 15 14 291971072
NTFS, blocksize=4096, 149 GB / 139 GiB
Search for partition aborted
Results
HPFS - NTFS 0 32 33 12 223 19 204800
NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS, blocksize=4096, 524 MB / 500 MiB
HPFS - NTFS 12 223 20 8491 181 10 136212480
NTFS, blocksize=4096, 69 GB / 64 GiB
HPFS - NTFS 63 221 31 16497 247 6 264013824
NTFS, blocksize=4096, 135 GB / 125 GiB
* HPFS - NTFS 16498 21 60 42626 143 38 419753985
NTFS, blocksize=4096, 214 GB / 200 GiB
P HPFS - NTFS 42626 178 49 60801 15 14 291971072
NTFS, blocksize=4096, 149 GB / 139 GiB
Sun Dec 5 10:12:33 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, September 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=135175077888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=214914040320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=149489188864
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-9WS142, S/N:W0VBPEZ3, FW:0002SDM1
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - ST500LT012-9WS142
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 63/221/31
NTFS at 16498/21/60
BAD_RS LBA=684797952 2
NTFS at 42626/178/49
Current partition structure:
1 * HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
2 P HPFS - NTFS 63 221 31 16497 247 6 264013824
3 P HPFS - NTFS 16498 21 60 42626 143 38 419753985
4 E extended LBA 42626 178 47 60801 47 46 291973122
5 L HPFS - NTFS 42626 178 49 60801 15 14 291971072
Bad relative sector.
search_part()
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 1024000
sectors_per_cluster 8
mft_lcn 42666
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 63/221/31
filesystem size 264013824
sectors_per_cluster 8
mft_lcn 6180
mftmirr_lcn 883
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 63 221 31 16497 247 6 264013824
NTFS, blocksize=4096, 135 GB / 125 GiB
NTFS at 16498/21/60
filesystem size 419753985
sectors_per_cluster 8
mft_lcn 26600484
mftmirr_lcn 5012748
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16498 21 60 42626 143 38 419753985
NTFS, blocksize=4096, 214 GB / 200 GiB
Error: size boot_sector 291971072 > partition 188743680
check_part_i386 failed for partition type 07
HPFS - NTFS 42626 178 49 54375 115 12 188743680
recover_EXT2: s_block_group_nr=0/393, s_mnt_count=34/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 12903424
recover_EXT2: part_size 103227392
Filesystem created: Sat Feb 20 12:28:58 2021
Last mount time: Sun Aug 15 14:52:52 2021
Linux 54375 147 45 60801 47 46 103227392
ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
Results
* HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
NTFS, blocksize=4096, 524 MB / 500 MiB
P HPFS - NTFS 63 221 31 16497 247 6 264013824
NTFS, blocksize=4096, 135 GB / 125 GiB
P HPFS - NTFS 16498 21 60 42626 143 38 419753985
NTFS, blocksize=4096, 214 GB / 200 GiB
L HPFS - NTFS 42626 178 49 54375 115 12 188743680
L Linux 54375 147 45 60801 47 46 103227392
ext4 blocksize=4096 Large_file Sparse_SB, 52 GB / 49 GiB
add_ext_part_i386: max
add_ext_part_i386: max
interface_write()
1 * HPFS - NTFS 0 32 33 63 221 30 1024000 [System Reserved]
2 P HPFS - NTFS 63 221 31 16497 247 6 264013824
3 P HPFS - NTFS 16498 21 60 42626 143 38 419753985
4 E extended LBA 42626 146 17 60801 80 15 291977216
5 L HPFS - NTFS 42626 178 49 54375 115 12 188743680
6 L Linux 54375 147 45 60801 47 46 103227392