cgsecurity.org

Hello gents,

yesterday i had a problem when using HDCLone. All my partitions are gone on the Surface 4.
So i copied testdisk on a win10 recovery install stick and tried to recover the partition.
Unfortunally it wont work. Here is my log file. MAybe you guys can help me out.




Wed Mar 16 09:04:17 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=61505273856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=34359738368
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SAMSUNG KUS030202M-B000, S/N:3333_4A31_4B31_9297_0025_3859_0000_0001., FW:DXY8AM1Q
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7477 255 63, sector size=512 - SanDisk Ultra, S/N:4C530001230912109433, FW:1.00
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512 - Microsoft Corporation RamDisk

Partition table type defaults to Intel
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - SAMSUNG KUS030202M-B000
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 31007/55/25
filesystem size 1986560
sectors_per_cluster 8
mft_lcn 82773
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB

Results
* FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
P HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

P HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 * FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
2 P HPFS - NTFS 31007 55 25 31130 223 5 1986560
write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.



Wed Mar 16 09:13:41 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=61505273856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=272629760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=34359738368
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1017118720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SAMSUNG KUS030202M-B000, S/N:3333_4A31_4B31_9297_0025_3859_0000_0001., FW:DXY8AM1Q
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7477 255 63, sector size=512 - SanDisk Ultra, S/N:4C530001230912109433, FW:1.00
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512 - Microsoft Corporation RamDisk

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - SAMSUNG KUS030202M-B000
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/32/33
Info: size boot_sector 532480, partition 532480
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513
NTFS at 31007/55/25
Current partition structure:
1 * FAT32 0 32 33 33 69 36 532480 [SYSTEM]
2 P HPFS - NTFS 31007 55 25 31130 223 5 1986560

search_part()
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 31007/55/25
filesystem size 1986560
sectors_per_cluster 8
mft_lcn 82773
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB

Results
* FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
P HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB

interface_write()
1 * FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
2 P HPFS - NTFS 31007 55 25 31130 223 5 1986560

search_part()
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
FAT32 at 0/32/39
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513
FAT differs, FAT sectors=496-512/513
set_FAT_info: name from BS used

FAT32 at 0/32/39
FAT: cluster=2(0x2), pos=10240
FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [NO NAME]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 31007/55/25
filesystem size 1986560
sectors_per_cluster 8
mft_lcn 82773
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB
NTFS at 31130/223/5
filesystem size 1986560
sectors_per_cluster 8
mft_lcn 82773
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS found using backup sector, blocksize=4096, 1017 MB / 970 MiB
NTFS at 31130/223/5
filesystem size 1986560
sectors_per_cluster 8
mft_lcn 82773
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 31130 223 5 31254 135 48 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB
This partition ends after the disk limits. (start=500117503, size=1986560, end=502104062, disk end=500118192)
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (256 GB / 238 GiB) seems too small! (< 257 GB / 239 GiB)
The following partition can't be recovered:
HPFS - NTFS 31130 223 5 31254 135 48 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB

Results
* FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
P HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

P HPFS - NTFS 31007 55 25 31130 223 5 1986560
NTFS, blocksize=4096, 1017 MB / 970 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
* FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
FAT: cluster=2(0x2), pos=10240
Directory /
3 drwxr-xr-x 0 0 0 8-May-2018 09:44 EFI
29 drwxr-xr-x 0 0 0 10-Mar-2020 10:15 System Volume Information
44 drwxr-xr-x 0 0 0 16-Mar-2022 09:11 Recovery
0 -rwxr-xr-x 0 0 0 16-Mar-2022 09:11 Recovery.txt

interface_write()
1 * FAT32 0 32 33 33 69 36 532480 [EFI System Partition] [SYSTEM]
2 P HPFS - NTFS 31007 55 25 31130 223 5 1986560
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

GMOT wrote: 16 Mar 2022, 09:34 Hello gents,

yesterday i had a problem when using HDCLone.

Use Photorec or some third party recovery software.

And for diagnosis purposes it is easier to confess right from the start that you confounded source and target when playing with "HDClone" - which is what I am assuming.

Hi,
thanks for the tip, but i already did that. It just recovers data from the bootmanager partition.

I also tought that i maybe just reversed source and target, bt that definitly did not happen.

I had a m2 harddrive from a notebook which i wanted to upgrade with a bigger one.
I took it out of the notebook and connected it to my surface via usb3 adapter. I also connected the new bigger to my surface via usb3 adapter.
Then i started the hdclone software in windows on my surface. it started to copy the harddrive.
But i noticed that my Surface is acting wierd (Settings turn in english from german etc.) and hdclone crashed. After rebooting mysurface, the surface hd wasnt accessible at all.
I now cant get some files from my surface and the other drive is also dead (all partitons lost, or raw. Testdisk wont find anything).
I just want to backup some files from my surface, then i would reinstall it.

I appreciate any tips.

Do not use any dubious buggy promoted closed source software.
Spend your time on learning to use the linux commandline.
Get yourself some small and cheap drives and a machine where you can break the installation without doing any harm and practice Linux on that machine.
Check the health of your devices. Use smartmontools if that works on your type of device.

Use the LSBLK command to identify your devices before invoking other commands with serious consequences like the DD or the better DDRESCUE command.

Thanky you for the tipps