Problem navigating the directory structure

Message

erw1 · #1 Post by **erw1** » 10 Jun 2022, 04:34

This is a follow up from this post, after which I launched an analysis in GPT mode (much faster). I selected `P` for `[Vol 1]`, which took me to the screen below. There is an indication at the bottom that says ": to select the current file". If I do that on `.`, it moves the cursor to `..`. Bottom line: I can see what files are in the current directory. If I do `:` with `..` selected, nothing happens. `Right` is also non responsive. Also, once an analysis is carried, is it possible to save it so as to be able to resume later?

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
     MS Data                     2048  564858872  564856825 [Vol1]
Directory /

 dr-xr-xr-x     0     0         0  9-May-2019 22:40 .
>dr-xr-xr-x     0     0         0  9-May-2019 22:40 ..


















                                                   Next
Use Right to change directory, h to hide Alternate Data Stream
    q to quit, : to select the current file, a to select all files
    C to copy the selected files, c to copy the current file

logfile:

Code: Select all



Thu Jun  9 17:01:25 2022
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.4.0-91-generic (#102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021) x86_64
Compiler: GCC 9.2
ext2fs lib: 1.45.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       625142448 sectors
/dev/sda: user_max   625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco        625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop0 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST320LT007-9ZV142, S/N:W0Q4V9V5, FW:0004LVM1
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 0820, FW:1012
Disk /dev/mapper/sda6_crypt - 318 GB / 296 GiB - 622557184 sectors, sector size=512
Disk /dev/mapper/vgmint-root - 317 GB / 295 GiB - 620453888 sectors, sector size=512
Disk /dev/mapper/vgmint-swap_1 - 1023 MB / 976 MiB - 1998848 sectors, sector size=512
Disk /dev/dm-0 - 318 GB / 296 GiB - 622557184 sectors, sector size=512
Disk /dev/dm-1 - 317 GB / 295 GiB - 620453888 sectors, sector size=512
Disk /dev/dm-2 - 1023 MB / 976 MiB - 1998848 sectors, sector size=512

Partition table type (auto): None
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 0820
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=4153407 (expected 1953458175)
hdr_lba_start=64
hdr_lba_end=4153354
hdr_lba_table=12
hdr_entries=208
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
check_FAT: Unusual media descriptor (0xf8!=0xf0)
Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
 2 P MS Data                      640       8639       8000 [ISOHybrid1] [NO NAME]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
FAT12 at 0/10/11
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-6
FAT2 : 7-12
start_rootdir : 13
Data : 45-7996
sectors : 8000
cluster_size : 4
no_of_cluster : 1988 (2 - 1989)
fat_length 6 calculated 6
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 0/10/11
     EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
Search for partition aborted

Results
   P EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 8000 linear /dev/sdc 640" | dmsetup create test0


dir_partition inode=0
   P EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
Directory /
       2 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 EFI

dir_partition inode=2
   P EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
FAT: cluster=2(0x2), pos=685
Directory /EFI
       2 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 .
       0 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 ..
       3 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 BOOT

dir_partition inode=3
   P EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
FAT: cluster=3(0x3), pos=689
Directory /EFI/BOOT
       3 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 .
       2 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 ..
       4 -rwxr-xr-x     0      0   1341560 29-Jan-2021 20:14 BOOTX64.EFI
     660 -rwxr-xr-x     0      0   1427328 29-Jan-2021 20:14 GRUBX64.EFI
    1357 -rwxr-xr-x     0      0   1277024 29-Jan-2021 20:14 MMX64.EFI
FAT: cluster=2(0x2), pos=685
Directory /EFI
       2 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 .
       0 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 ..
       3 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 BOOT
Directory /
       2 drwxr-xr-x     0      0         0 29-Jan-2021 20:14 EFI

interface_write()
 1 P EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]

interface_write()
 
No partition found or selected for recovery
simulate write!

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=4153407 (expected 1953458175)
hdr_lba_start=64
hdr_lba_end=4153354
hdr_lba_table=12
hdr_entries=208
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
 1 P MS Data                        0    4153351    4153352 [ISOHybrid]
check_FAT: Unusual media descriptor (0xf8!=0xf0)
Warning: number of heads/cylinder mismatches 64 (FAT) != 255 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)
 2 P MS Data                      640       8639       8000 [ISOHybrid1] [NO NAME]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
FAT12 at 0/10/11
check_FAT: Unusual media descriptor (0xf8!=0xf0)
FAT1 : 1-6
FAT2 : 7-12
start_rootdir : 13
Data : 45-7996
sectors : 8000
cluster_size : 4
no_of_cluster : 1988 (2 - 1989)
fat_length 6 calculated 6
heads/cylinder 64 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT12 at 0/10/11
     EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
NTFS at 851/58/24
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                 13470193   13674992     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
NTFS at 851/58/24
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                 13674992   13879791     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB

HFS+ magic value at 4790/202/53
part_size 14983104
     Mac HFS                 76964128   91947231   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
NTFS at 6017/98/18
filesystem size           349673984
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=49494679552, part_size=179033079808, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 6017/98/18
filesystem size           349673984
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                 96669296  446343279  349673984
     NTFS, blocksize=4096, 179 GB / 166 GiB

LVM magic value at 28778/170/54

LVM magic value at 28831/41/46

HFS magic value at 28832/100/2
part_size 8388866
     Mac HFS                463192381  471581246    8388866
     HFS blocksize=16777216, 4295 MB / 4096 MiB

HFS+ magic value at 31453/157/61
part_size 14983104
     Mac HFS                505302396  520285499   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB

HFS+ magic value at 32386/71/2
part_size 14983104
     Mac HFS                520285564  535268667   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
NTFS at 35160/213/54
filesystem size           564856825
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048  564858872  564856825 [Vol1]
     NTFS found using backup sector, blocksize=4096, 289 GB / 269 GiB
NTFS at 35160/213/54
filesystem size           564856825
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                564858872 1129715696  564856825
     NTFS, blocksize=4096, 289 GB / 269 GiB

     Linux filesys. data   1134254080 1134258175       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
check_FAT: Bad jump in FAT partition
file_pread(5,16,buffer,1658476000(103235/90/56)) read err: Partial read
file_pread(5,16,buffer,1658475998(103235/90/54)) read err: Partial read
file_pread(5,16,buffer,1658476014(103235/91/7)) read err: Input/output error
file_pread(5,1,buffer,1658476014(103235/91/7)) read err: Input/output error
file_pread(5,16,buffer,1658476015(103235/91/8)) read err: Input/output error
file_pread(5,1,buffer,1658476015(103235/91/8)) read err: Input/output error
file_pread(5,16,buffer,1658475999(103235/90/55)) read err: Partial read
file_pread(5,16,buffer,1658476015(103235/91/8)) read err: Input/output error
file_pread(5,1,buffer,1658476015(103235/91/8)) read err: Input/output error
file_pread(5,16,buffer,1658476006(103235/90/62)) read err: Partial read

Results
     EFI System                   640       8639       8000 [EFI System Partition] [NO NAME]
     FAT12, blocksize=2048, 4096 KB / 4000 KiB
     MS Data                     2048  564858872  564856825 [Vol1]
     NTFS found using backup sector, blocksize=4096, 289 GB / 269 GiB
     MS Data                 13470193   13674992     204800
     NTFS found using backup sector, blocksize=4096, 104 MB / 100 MiB
     MS Data                 13674992   13879791     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
     Mac HFS                 76964128   91947231   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
     MS Data                 96669296  446343279  349673984
     NTFS, blocksize=4096, 179 GB / 166 GiB
     Mac HFS                463192381  471581246    8388866
     HFS blocksize=16777216, 4295 MB / 4096 MiB
     Mac HFS                505302396  520285499   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
     Mac HFS                520285564  535268667   14983104
     HFS+ blocksize=4096, 7671 MB / 7315 MiB
     MS Data                564858872 1129715696  564856825
     NTFS, blocksize=4096, 289 GB / 269 GiB
   P Linux filesys. data   1134254080 1134258175       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 8000 linear /dev/sdc 640" | dmsetup create test0
echo "0 564856825 linear /dev/sdc 2048" | dmsetup create test1
echo "0 204800 linear /dev/sdc 13470193" | dmsetup create test2
echo "0 204800 linear /dev/sdc 13674992" | dmsetup create test3
echo "0 14983104 linear /dev/sdc 76964128" | dmsetup create test4
echo "0 349673984 linear /dev/sdc 96669296" | dmsetup create test5
echo "0 8388866 linear /dev/sdc 463192381" | dmsetup create test6
echo "0 14983104 linear /dev/sdc 505302396" | dmsetup create test7
echo "0 14983104 linear /dev/sdc 520285564" | dmsetup create test8
echo "0 564856825 linear /dev/sdc 564858872" | dmsetup create test9
echo "0 4096 linear /dev/sdc 1134254080" | dmsetup create test10

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096

interface_write()
 1 P Linux filesys. data   1134254080 1134258175       4096
ntfs_mst_post_read_fixup_warn: magic: 0xb9e90000  size: 1024   usa_ofs: 2  usa_count: 33536: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x53e8c789  size: 1024   usa_ofs: 64803  usa_count: 59903: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0xfffe8c85  size: 1024   usa_ofs: 35327  usa_count: 18625: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x8948e845  size: 1024   usa_ofs: 59591  usa_count: 6992: Invalid argument
Record 0 has no FILE magic (0xb9e90000)
ntfs_mst_post_read_fixup_warn: magic: 0x4d482d43  size: 4096   usa_ofs: 17217  usa_count: 21293: Invalid argument
Corrupt index block signature: vcn 0 inode 5

#2 Post by **recuperation** » 10 Jun 2022, 09:11

erw1 wrote: 10 Jun 2022, 04:34 This is a follow up from this post, after which I launched an analysis in GPT mode (much faster). I selected `P` for `[Vol 1]`, which took me to the screen below. There is an indication at the bottom that says ": to select the current file". If I do that on `.`, it moves the cursor to `..`. Bottom line: I can see what files are in the current directory.

I only see an empty directory. Why can you see what files are in the directory???

If I do `:` with `..` selected, nothing happens. `Right` is also non responsive.

These are technical entries originating from the time of the creation of FAT16. ".." moves you upwards in the folder structure but will do nothing if you are already on root level.

Also, once an analysis is carried, is it possible to save it so as to be able to resume later?

No.

erw1 · #3 Post by **erw1** » 10 Jun 2022, 13:16

recuperation wrote: 10 Jun 2022, 09:11
erw1 wrote: 10 Jun 2022, 04:34 This is a follow up from this post, after which I launched an analysis in GPT mode (much faster). I selected `P` for `[Vol 1]`, which took me to the screen below. There is an indication at the bottom that says ": to select the current file". If I do that on `.`, it moves the cursor to `..`. Bottom line: I can see what files are in the current directory.
I only see an empty directory. Why can you see what files are in the directory???

You mean "can['t]"? Perhaps the external drive had been poorly connected. The log is filled with errors.

#4 Post by **recuperation** » 10 Jun 2022, 15:32

erw1 wrote: 10 Jun 2022, 04:34 This is a follow up from this post, after which I launched an analysis in GPT mode (much faster). I selected `P` for `[Vol 1]`, which took me to the screen below. There is an indication at the bottom that says ": to select the current file". If I do that on `.`, it moves the cursor to `..`. Bottom line: I can see what files are in the current directory.

I only see an empty directory. Why can you see what files are in the directory???

erw1 wrote: 10 Jun 2022, 04:34 You mean "can['t]"? Perhaps the external drive had been poorly connected. The log is filled with errors.

I don't mean anything. You show a picture of an empty directory stating "Bottom line: I can see what files are in the current directory."
I was asking you "Why can you see what files are in the directory?" whereas you had presented an empty directory.
Please mind your own words.

cgsecurity.org

Problem navigating the directory structure

Problem navigating the directory structure

Re: Problem navigating the directory structure

Re: Problem navigating the directory structure

Re: Problem navigating the directory structure