cgsecurity.org

Bonjour,

Comme beaucoup je suis confronté à un problème de disque dur. Il n'est plus accessible et plus reconnu par Windows. Après voir surfé, je suis tombé sur quelques articles qui invitaient à l'utilisation de TestDisk et PhotoRec. Etant profane en la matière j'ai lancé TestDisk sans trop comprendre en quoi il pouvait m'aider et encore moins depuis que j'ai lu les logs que je ne sais pas interpréter. Ma question est plutôt simple : Pensez-vous qu'à la lecture de ces logs, je pourrais récupérer les données de mon DD ? Et si oui, quelles devront être les principales étapes ?

Mon Feb 07 13:17:00 2022
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=982641424384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=15431892992
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202657792
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 982 GB / 915 GiB - CHS 119466 255 63, sector size=512
Drive D: - 15 GB / 14 GiB - CHS 1876 255 63, sector size=512
Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512

Partition table type (auto): None
Drive F: - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=115 sector=52
BAD_RS LBA=1936269394 5382406
check_part_i386 1 type 4F: no test
BAD_RS LBA=1917848077 5967333
check_part_i386 2 type 73: no test
BAD_RS LBA=1818575915 5855017
check_part_i386 3 type 2B: no test
BAD_RS LBA=2844524554 5982593
check_part_i386 4 type 61: no test
Current partition structure:
1 * Sys=4F 120527 49 53 234813 237 34 1836016416

Bad relative sector.
2 * Sys=73 119380 132 62 153270 41 37 544437093

Bad relative sector.
3 * Sys=2B 113201 29 24 147074 114 59 544175136

Bad relative sector.
4 * SpeedStor 177063 118 26 177066 225 63 54974

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
3 * Sys=2B 113201 29 24 147074 114 59 544175136
2 * Sys=73 119380 132 62 153270 41 37 544437093
Space conflict between the following two partitions
2 * Sys=73 119380 132 62 153270 41 37 544437093
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
Space conflict between the following two partitions
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
4 * SpeedStor 177063 118 26 177066 225 63 54974

search_part()
Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63
file_win32_pread(260,16,buffer,6026486(375/33/33)) read err: read after end of file
file_win32_pread(260,16,buffer,6281279(390/252/54)) read err: read after end of file
file_win32_pread(260,16,buffer,6281295(390/253/7)) read err: read after end of file
file_win32_pread(260,1,buffer,6281295(390/253/7)) read err: read after end of file
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

search_part()
Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63
file_win32_pread(260,16,buffer,6026486(375/33/33)) read err: read after end of file
file_win32_pread(260,16,buffer,6281279(390/252/54)) read err: read after end of file
file_win32_pread(260,16,buffer,6281295(390/253/7)) read err: read after end of file
file_win32_pread(260,1,buffer,6281295(390/253/7)) read err: read after end of file
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=115 sector=52
BAD_RS LBA=1936269394 5382406
check_part_i386 1 type 4F: no test
BAD_RS LBA=1917848077 5967333
check_part_i386 2 type 73: no test
BAD_RS LBA=1818575915 5855017
check_part_i386 3 type 2B: no test
BAD_RS LBA=2844524554 5982593
check_part_i386 4 type 61: no test
Current partition structure:
1 * Sys=4F 120527 49 53 234813 237 34 1836016416

Bad relative sector.
2 * Sys=73 119380 132 62 153270 41 37 544437093

Bad relative sector.
3 * Sys=2B 113201 29 24 147074 114 59 544175136

Bad relative sector.
4 * SpeedStor 177063 118 26 177066 225 63 54974

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
3 * Sys=2B 113201 29 24 147074 114 59 544175136
2 * Sys=73 119380 132 62 153270 41 37 544437093
Space conflict between the following two partitions
2 * Sys=73 119380 132 62 153270 41 37 544437093
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
Space conflict between the following two partitions
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
4 * SpeedStor 177063 118 26 177066 225 63 54974

search_part()
Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63
file_win32_pread(260,16,buffer,6026486(375/33/33)) read err: read after end of file
file_win32_pread(260,16,buffer,6281279(390/252/54)) read err: read after end of file
file_win32_pread(260,16,buffer,6281295(390/253/7)) read err: read after end of file
file_win32_pread(260,1,buffer,6281295(390/253/7)) read err: read after end of file

Results

interface_write()

No partition found or selected for recovery

search_part()
Drive F: - 1000 GB / 931 GiB - CHS 121601 255 63
file_win32_pread(260,16,buffer,6026486(375/33/33)) read err: read after end of file
file_win32_pread(260,16,buffer,6281279(390/252/54)) read err: read after end of file
file_win32_pread(260,16,buffer,6281295(390/253/7)) read err: read after end of file
file_win32_pread(260,1,buffer,6281295(390/253/7)) read err: read after end of file

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

NaturalGiftDesign wrote: 08 Feb 2022, 21:20 Bonjour,

Comme beaucoup je suis confronté à un problème de disque dur. Il n'est plus accessible et plus reconnu par Windows. Après voir surfé, je suis tombé sur quelques articles qui invitaient à l'utilisation de TestDisk et PhotoRec. Etant profane en la matière j'ai lancé TestDisk sans trop comprendre

Veuillez lire la documentation avant de vous servir de Testdisk:

https://www.cgsecurity.org/wiki/TestDisk

en quoi il pouvait m'aider et encore moins depuis que j'ai lu les logs que je ne sais pas interpréter. Ma question est plutôt simple : Pensez-vous qu'à la lecture de ces logs, je pourrais récupérer les données de mon DD ?

Evitez les abbreviations comme "DD"!

Et si oui, quelles devront être les principales étapes ?

Regardez la documentation. Veuillez documenter votre cas! Si vous n'arrivez pas à le décrire la liste suivante en Anglais va vous aider:


1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your disk?

8. Who is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

Bonjour,

Merci pour vos conseils détaillés et éclairés. Promis, je n'utiliserai plus d'abriéviations
J'ai donc pris soin de lire les documents et j'avoue qu'une phrase a suffit à m'aider plus que toutes les autres : Sélectionner le type de la table des partitions, en principe la valeur par défaut est la bonne, car TestDisk effectue une auto détection . Je me suis donc laissé totalement guider en enchaînant les étapes proposées par défaut pour arriver au point de pouvoir récupérer 100% des données auxquelles je ne pouvais plus accéder via Windows. Pur bonheur ! Une nouvelle fois merci.