Partition RAW

Comment utiliser TestDisk pour récupérer une partition perdue
Locked
Message
Author
Regular4049
Posts: 5
Joined: 02 Mar 2023, 13:13

Partition RAW

#1 Post by Regular4049 »

Bonjour,

Ma partition d'un disque dur externe est passée RAW quand j'ai voulu changé ma partition de mon SSD principale de MBR à GPT. J'ai voulu débranché le disque dur externe pour ne pas qu'il soit modifier par erreur.. et j'imagine que le logiciel (alors que je n'avais pas encore démarrer le changement de MBR à GPT) était entrain de faire quelques chose sur le disque dur externe.

Ma partition est donc passé de NTFS à RAW quand j'ai voulu rebranché le disque dur externe plus tard. En cherchant sur le net je suis tombé sur testDisk et j'ai donc lancé une quicksearch puis une deepsearch. Mon DD ne faisait que de se remplir donc j'ai pensé que testdisk faisait une copie des données dans le dossier source de testdisk. Après 5 jours de traitement je pense que j'ai juste alimenter un fichier log rempli d'erreur de + de 4To et voici le début du résultat (inquiétant) :

Code: Select all

Thu Feb 16 16:13:36 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249482384896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4000768327680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=10735345664
filewin32_getfilesize(\\.\F:) GetFileSize err Fonction incorrecte.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Fonction incorrecte.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=989469508096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=4000650887168
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - HGST HTS721010A9E630, S/N:JR10006P0GLHBF, FW:JB0OA3J0
Disk \\.\PhysicalDrive1 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 850 EVO mSATA 250GB, S/N:S248NX0H404264F, FW:EMT41B6Q
Disk \\.\PhysicalDrive2 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - USB3.0 , S/N:0123456789ABCDEF, FW:0203
Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Seagate M3 Portable, S/N:NM14GJTZ, FW:9300

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 4000 GB / 3726 GiB - USB3.0 
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive2 - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037167 (expected 7814037167)
hdr_lba_start=34
hdr_lba_end=7814037134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 2 P MS Data                    32768 7814033407 7814000640 [Basic data partition] [sauvegarde2]

search_part()
Disk \\.\PhysicalDrive2 - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 2/10/9
filesystem size           7814000640
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=16777216, part_size=4000768327680, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 2/10/9
filesystem size           7814000640
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                    32768 7814033407 7814000640 [sauvegarde2]
     NTFS, blocksize=4096, 4000 GB / 3726 GiB
Search for partition aborted

Results
   P MS Data                    32768 7814033407 7814000640 [sauvegarde2]
     NTFS, blocksize=4096, 4000 GB / 3726 GiB

interface_write()
 1 P MS Data                    32768 7814033407 7814000640 [sauvegarde2]
simulate write!
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - Seagate M3 Portable
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037166 (expected 7814037166)
hdr_lba_start=34
hdr_lba_end=7814037133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 2 P MS Data                   264192 7814035455 7813771264 [Basic data partition]

search_part()
Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size           7813771264
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=4000650887168, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           7813771264
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 7814035455 7813771264
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_win32_pread(548,1,buffer,7814035598(486401/56/6)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035599(486401/56/7)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035600(486401/56/8)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035465(486401/53/62)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035466(486401/53/63)) read err: read after end of file
file_win32_pread(548,14,buffer,7814035467(486401/54/1)) read err: read after end of file
file_win32_pread(548,3,buffer,7814035481(486401/54/15)) read err: read after end of file
file_win32_pread(548,3,buffer,7814035528(486401/54/62)) read err: read after end of file
file_win32_pread(548,8,buffer,7814035544(486401/55/15)) read err: read after end of file
file_win32_pread(548,11,buffer,7814035591(486401/55/62)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035484(486401/54/18)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035531(486401/55/2)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035552(486401/55/23)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035602(486401/56/10)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035485(486401/54/19)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035532(486401/55/3)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035553(486401/55/24)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035603(486401/56/11)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035486(486401/54/20)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035533(486401/55/4)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035554(486401/55/25)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035604(486401/56/12)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035469(486401/54/3)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035470(486401/54/4)) read err: read after end of file
file_win32_pread(548,14,buffer,7814035471(486401/54/5)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035487(486401/54/21)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035534(486401/55/5)) read err: read after end of file
file_win32_pread(548,8,buffer,7814035548(486401/55/19)) read err: read after end of file
file_win32_pread(548,11,buffer,7814035595(486401/56/3)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035485(486401/54/19)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035488(486401/54/22)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035535(486401/55/6)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035556(486401/55/27)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035606(486401/56/14)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035486(486401/54/20)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035489(486401/54/23)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035536(486401/55/7)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035557(486401/55/28)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035607(486401/56/15)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035472(486401/54/6)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035473(486401/54/7)) read err: read after end of file
file_win32_pread(548,14,buffer,7814035474(486401/54/8)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035490(486401/54/24)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035537(486401/55/8)) read err: read after end of file
file_win32_pread(548,8,buffer,7814035551(486401/55/22)) read err: read after end of file
file_win32_pread(548,11,buffer,7814035598(486401/56/6)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035488(486401/54/22)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035491(486401/54/25)) read err: read after end of file
file_win32_pread(548,1,buffer,7814035538(486401/55/9)) read err: read after end of file
etc.
A la fin de la deepsearch je n'avais toujours pas de partition
Pensez vous que c'est mort pour récupérer la partition et mes données ?
Merci
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition RAW

#2 Post by recuperation »

Regular4049 wrote: ↑02 Mar 2023, 13:20 A la fin de la deepsearch je n'avais toujours pas de partition
Cette description ne suffit pas du tout pour pouvoir vous aider!
Pensez vous que c'est mort pour récupérer la partition et mes données ?
Merci
Dans les rares cas où c'est pas possible de dire cela je vous le dit.
Dans votre cas je ne peux pas juger.

Veuillez lire
https://www.cgsecurity.org/wiki/TestDis ... _par_Etape

Les plus important c'est de regarder dans les partitions trouvées pour voir si le contenu est lisible est connu de votre part (touche "p", "list files").
Top
Regular4049
Posts: 5
Joined: 02 Mar 2023, 13:13

Re: Partition RAW

#3 Post by Regular4049 »

Bonjour,
Merci pour votre réponse.

C'est un DD sans windows dessus. Il y avait seulement des données.

J'avais déjà essayé de lire les fichiers mais j'avais un message d'erreur lorsque j'essayais.
Lorsque j'ai fais la deepsearch (5 jours de recherche) soit l'étape du guide : "Une partition est toujours manquante: Recherche approfondie" à la fin je n'avais toujours pas de partition et qu'un fichier de 4TO de log avec ce genre de ligne :

Code: Select all

file_win32_pread(548,1,buffer,7814035532(486401/55/3)) read err: read after end of file
Il faudrait que je vous donne quoi comme informations ?

Merci
Top
Regular4049
Posts: 5
Joined: 02 Mar 2023, 13:13

Re: Partition RAW

#4 Post by Regular4049 »

Voici la fin de mon fichier .log de 4To

Code: Select all


search for partition aborted

Results

interface_write()

No partition found or selected for recovery

interface_write()

No partition found or selected for recovery
simulate write!

Analyse Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - CHS 486401 255 63
file_win32_pread(548,1,buffer,1(0/0/2)) read err: read after end of file
file_win32_pread(548,1,buffer,7814037166(486401/80/62)) read err: read
after end of file
Trying alternate GPT
Current partition structure:
Trying alternate GPT

interface_write()

No partition found or selected for recovery

interface_write()

No partition found or selected for recovery
simulate write!

Analyse Disk \\.\PhysicalDrive3 - 4000 GB / 3726 GiB - CHS 486401 255 63
file_win32_pread(548,1,buffer,1(0/0/2)) read err: read after end of file
file_win32_pread(548,1,buffer,7814037166(486401/80/62)) read err: read
after end of file
Trying alternate GPT
Current partition structure:
Trying alternate GPT
Top
Regular4049
Posts: 5
Joined: 02 Mar 2023, 13:13

Re: Partition RAW

#5 Post by Regular4049 »

Je viens de ressayer et je ne peux pas vraiment suivre le lien que vous m'avez donné car je n'arrive pas à faire cette étape.

J'ai installer un linux et j'ai lancé deux scan. Un sur le HDD en question et un sur une image (un image.dd) que j'avais fais (mais après que le NTFS été passé en RAW).
Le test sur le DD fait pareil qu'avant soit : "read error at" sur chaque ligne. Le test sur l'image me dit que la partition est mauvaise mais il à lancé le test quand même donc on verra.

Le disque fait 4 TO j'ai choisi "EFI GPT", puis quick search pour le moment. J'avais déjà fait une deepsearch mais sans résultat. Donc je pense que j'aurais le même résultat. Auriez vous une idées ? Quel informations je pourrais vous donner ?
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Partition RAW

#6 Post by recuperation »

Je suis désolé, je ne peux pas vous aider.
Top
Regular4049
Posts: 5
Joined: 02 Mar 2023, 13:13

Re: Partition RAW

#7 Post by Regular4049 »

Merci d'avoir essayé.
Top
Locked

Return to “Récupération de partition”