Code: Select all
.
Thu Apr 14 10:14:59 2022
Command line: TestDisk
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.15.0-kali3-686-pae (#1 SMP Debian 5.15.15-2kali1 (2022-01-31)) i686
Compiler: GCC 10.3
ext2fs lib: 1.46.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.2
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 976773168 sectors
/dev/sdb: user_max 976773168 sectors
/dev/sdb: native_max 976773168 sectors
/dev/sdb: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500VT000-1DK142, S/N:WBY7WM10, FW:0001SDC1
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HGST HTS545050A7E380, S/N:TEA55B3Q39H33W, FW:GG2ZBD90
Disk /dev/sdc - 15 GB / 14 GiB - CHS 14782 64 32, sector size=512 - TOSHIBA TransMemory, FW:1.00
Disk /dev/loop0 - 2772 MB / 2644 MiB - 5415400 sectors (RO), sector size=512
Partition table type (auto): EFI GPT
Disk /dev/sda - 500 GB / 465 GiB - ST500VT000-1DK142
Partition table type: EFI GPT
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 2048 1085439 1083392
2 P EFI System 1085440 1290239 204800 [EFI System Partition]
3 P MS Data 1323008 250005503 248682496
4 P MS Data 251029504 636174335 385144832
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 67711
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=554696704, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 67711
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1085439 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 67/144/14
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 67/144/14
FAT: cluster=2(0x2), pos=1093632
EFI System 1085440 1290239 204800 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 82/90/9
filesystem size 248682496
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=677380096, part_size=127325437952, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 82/90/9
filesystem size 248682496
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1323008 250005503 248682496
NTFS, blocksize=4096, 127 GB / 118 GiB
FAT32 at 15562/31/22
FAT1 : 6206-7198
FAT2 : 7199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1023999
sectors : 1024000
cluster_size : 8
no_of_cluster : 126976 (2 - 126977)
fat_length 993 calculated 993
set_FAT_info: name from BS used
FAT32 at 15562/31/22
FAT: cluster=2(0x2), pos=250013696
MS Data 250005504 251029503 1024000 [NO NAME]
FAT32, blocksize=4096, 524 MB / 500 MiB
NTFS at 15625/220/20
filesystem size 385144832
sectors_per_cluster 8
mft_lcn 2822382
mftmirr_lcn 2830833
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=128527106048, part_size=197194153984, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 15625/220/20
filesystem size 385144832
sectors_per_cluster 8
mft_lcn 2822382
mftmirr_lcn 2830833
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 251029504 636174335 385144832
NTFS, blocksize=4096, 197 GB / 183 GiB
NTFS at 39600/5/22
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 635090945 636174336 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
NTFS at 39600/5/22
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 636174336 637257727 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 39667/117/3
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 39667/117/3
FAT: cluster=2(0x2), pos=637265920
MS Data 637257728 637462527 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 39680/52/53
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 636379137 637462528 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
NTFS at 39680/52/53
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 637462528 638545919 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 39747/164/34
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 39747/164/34
FAT: cluster=2(0x2), pos=638554112
MS Data 638545920 638750719 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 39760/100/21
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 637667329 638750720 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
NTFS at 39760/100/21
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 638750720 639834111 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 39827/212/2
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 39827/212/2
FAT: cluster=2(0x2), pos=639842304
MS Data 639834112 640038911 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 39840/147/52
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 638955521 640038912 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
NTFS at 39840/147/52
filesystem size 1083392
sectors_per_cluster 8
mft_lcn 45141
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 640038912 641122303 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
FAT32 at 39908/4/33
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used
FAT32 at 39908/4/33
FAT: cluster=2(0x2), pos=641130496
MS Data 641122304 641327103 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
block_group_nr 25
recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/518, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 16974592
recover_EXT2: part_size 135796736
Filesystem created: Sat Apr 9 09:35:04 2022
Linux filesys. data 636174334 771971069 135796736
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 69 GB / 64 GiB
NTFS at 48052/249/6
filesystem size 204800000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 567171073 771971072 204800000
NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
NTFS at 48052/249/6
filesystem size 204800000
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 771971072 976771071 204800000 [MEDIA]
NTFS, blocksize=4096, 104 GB / 97 GiB
Results
P MS Data 2048 1085439 1083392
NTFS, blocksize=4096, 554 MB / 529 MiB
P EFI System 1085440 1290239 204800 [EFI System Partition] [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
P MS Data 1323008 250005503 248682496
NTFS, blocksize=4096, 127 GB / 118 GiB
P MS Data 250005504 251029503 1024000 [NO NAME]
FAT32, blocksize=4096, 524 MB / 500 MiB
MS Data 251029504 636174335 385144832
NTFS, blocksize=4096, 197 GB / 183 GiB
MS Data 567171073 771971072 204800000
NTFS found using backup sector, blocksize=4096, 104 GB / 97 GiB
MS Data 635090945 636174336 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
Linux filesys. data 636174334 771971069 135796736
ext4 blocksize=4096 Large_file Sparse_SB Backup_SB, 69 GB / 64 GiB
MS Data 636174336 637257727 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
MS Data 636379137 637462528 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
MS Data 637257728 637462527 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
MS Data 637462528 638545919 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
MS Data 637667329 638750720 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
MS Data 638545920 638750719 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
MS Data 638750720 639834111 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
MS Data 638955521 640038912 1083392
NTFS found using backup sector, blocksize=4096, 554 MB / 529 MiB
MS Data 639834112 640038911 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
MS Data 640038912 641122303 1083392 [Recovery]
NTFS, blocksize=4096, 554 MB / 529 MiB
MS Data 641122304 641327103 204800 [NO NAME]
FAT32, blocksize=1024, 104 MB / 100 MiB
MS Data 771971072 976771071 204800000 [MEDIA]
NTFS, blocksize=4096, 104 GB / 97 GiB
Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 1083392 linear /dev/sda 2048" | dmsetup create test0
echo "0 204800 linear /dev/sda 1085440" | dmsetup create test1
echo "0 248682496 linear /dev/sda 1323008" | dmsetup create test2
echo "0 1024000 linear /dev/sda 250005504" | dmsetup create test3
echo "0 385144832 linear /dev/sda 251029504" | dmsetup create test4
echo "0 204800000 linear /dev/sda 567171073" | dmsetup create test5
echo "0 1083392 linear /dev/sda 635090945" | dmsetup create test6
echo "0 135796736 linear /dev/sda 636174334" | dmsetup create test7
echo "0 1083392 linear /dev/sda 636174336" | dmsetup create test8
echo "0 1083392 linear /dev/sda 636379137" | dmsetup create test9
echo "0 204800 linear /dev/sda 637257728" | dmsetup create test10
echo "0 1083392 linear /dev/sda 637462528" | dmsetup create test11
echo "0 1083392 linear /dev/sda 637667329" | dmsetup create test12
echo "0 204800 linear /dev/sda 638545920" | dmsetup create test13
echo "0 1083392 linear /dev/sda 638750720" | dmsetup create test14
echo "0 1083392 linear /dev/sda 638955521" | dmsetup create test15
echo "0 204800 linear /dev/sda 639834112" | dmsetup create test16
echo "0 1083392 linear /dev/sda 640038912" | dmsetup create test17
echo "0 204800 linear /dev/sda 641122304" | dmsetup create test18
echo "0 204800000 linear /dev/sda 771971072" | dmsetup create test19
ntfs_mst_post_read_fixup_warn: magic: 0x7d30407e size: 1024 usa_ofs: 26795 usa_count: 56348: Invalid argument
Record 0 has no FILE magic (0x7d30407e)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x7d30407e size: 1024 usa_ofs: 26795 usa_count: 56348: Invalid argument
Record 0 has no FILE magic (0x7d30407e)
Failed to load $MFT: Input/output error
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
P MS Data 251029504 636174335 385144832
NTFS, blocksize=4096, 197 GB / 183 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P MS Data 2048 1085439 1083392
2 P EFI System 1085440 1290239 204800 [EFI System Partition] [NO NAME]
3 P MS Data 1323008 250005503 248682496
4 P MS Data 250005504 251029503 1024000 [NO NAME]
5 P MS Data 251029504 636174335 385144832
SIGINT detected! TestDisk has been killed.
I tried to list the files, backup BS, rebuild BS, chkdsk but can't access the data on it. I just want the data out of this single partition and I don't care about the other partitions on it. How can I access the data on this partition now?