can't read MFT / hard disk seems too small
Posted: 17 May 2024, 18:25
HP Elitebook x360 1040 G6, BIOS 01.27.00 is current. UEFI diags show both
memory and disk are OK.
After a crash, third partition is RAW.
Disk is an Intel HBRPEKNX0202AH. BIOS claims it's 512 GB.
Running analyze shows "can't read MFT" for both the second
(MS Reserved) and c: partitions and "This partition ends after the disk limits"
as well as:
The hard disk (512 GB / 476 GiB) seems too small! (< 1024 GB / 953 GiB)
The following partitions can't be recovered:
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
I also ran the deep search without any change.
As testdisk warns that the disk capacity must be correctly detected for a successful
recovery, I'm afraid I must ask for guidance. Thanks in advance for any pointers.
Cheers
***
Fri May 17 10:53:45 2024
Command line: TestDisk
TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=61958258688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511094816768
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=61956161536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=719323136
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112
Hard disk list
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - INTEL HBRPEKNX0202AH, S/N:0000_0000_0100_0000_E4D2_5C38_6ADA_5101., FW:HPS1
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7532 255 63, sector size=512 - Patriot Memory, S/N:037B00196040, FW:PMAP
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512 - Microsoft Corporation RamDisk
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - INTEL HBRPEKNX0202AH
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1000210671 (expected 1000215215)
hdr_lba_start=34
hdr_lba_end=1000210638
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
check_part_gpt failed for partition
3 P MS Data 567296 998799359 998232064 [Basic data partition]
Current partition structure:
1 P EFI System 2048 534527 532480 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 567296 998799359 998232064 [Basic data partition]
3 P MS Data 567296 998799359 998232064 [Basic data partition]
4 P Windows Recovery Env 998799360 1000204287 1404928 [Basic data partition]
search_part()
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513
FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 49/75/19
filesystem size 998232064
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=405467136, part_size=511094816768, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 49/75/19
filesystem size 998232064
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 791928 999023991 998232064
NTFS, blocksize=4096, 511 GB / 475 GiB
NTFS at 62196/189/50
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 999184523 999190696 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 62196/189/50
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 999190696 999196869 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 62259/213/34
filesystem size 1404928
sectors_per_cluster 8
mft_lcn 58538
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 998799360 1000204287 1404928 [Windows RE Tools]
NTFS found using backup sector, blocksize=4096, 719 MB / 686 MiB
NTFS at 62259/213/34
filesystem size 1404928
sectors_per_cluster 8
mft_lcn 58538
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
This partition ends after the disk limits. (start=1000204287, size=1404928, end=1001609214, disk end=1000215216)
NTFS at 62260/88/36
filesystem size 1000210432
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1000212479 1000210432
NTFS found using backup sector, blocksize=4096, 512 GB / 476 GiB
NTFS at 62260/88/36
filesystem size 1000210432
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
This partition ends after the disk limits. (start=1000212479, size=1000210432, end=2000422910, disk end=1000215216)
file_win32_pread(504,11,buffer,1000215208(62260/131/56)) read err: read after end of file
file_win32_pread(504,11,buffer,1000215212(62260/131/60)) read err: read after end of file
file_win32_pread(504,8,buffer,1000215211(62260/131/59)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215204(62260/131/52)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215205(62260/131/53)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215206(62260/131/54)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215207(62260/131/55)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215208(62260/131/56)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215210(62260/131/58)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215212(62260/131/60)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215214(62260/131/62)) read err: read after end of file
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 1024 GB / 953 GiB)
The following partitions can't be recovered:
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
Results
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
MS Data 2048 1000212479 1000210432
NTFS found using backup sector, blocksize=4096, 512 GB / 476 GiB
MS Data 791928 999023991 998232064
NTFS, blocksize=4096, 511 GB / 475 GiB
MS Data 998799360 1000204287 1404928 [Windows RE Tools]
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 1024 GB / 953 GiB)
The following partitions can't be recovered:
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
Results
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
MS Data 2048 1000212479 1000210432
NTFS found using backup sector, blocksize=4096, 512 GB / 476 GiB
MS Data 791928 999023991 998232064
NTFS, blocksize=4096, 511 GB / 475 GiB
MS Data 998799360 1000204287 1404928 [Windows RE Tools]
NTFS found using backup sector, blocksize=4096, 719 MB / 686 MiB
MS Data 999184523 999190696 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
MS Data 999190696 999196869 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
interface_write()
No partition found or selected for recovery
simulate write!
TestDisk exited normally.
memory and disk are OK.
After a crash, third partition is RAW.
Disk is an Intel HBRPEKNX0202AH. BIOS claims it's 512 GB.
Running analyze shows "can't read MFT" for both the second
(MS Reserved) and c: partitions and "This partition ends after the disk limits"
as well as:
The hard disk (512 GB / 476 GiB) seems too small! (< 1024 GB / 953 GiB)
The following partitions can't be recovered:
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
I also ran the deep search without any change.
As testdisk warns that the disk capacity must be correctly detected for a successful
recovery, I'm afraid I must ask for guidance. Thanks in advance for any pointers.
Cheers
***
Fri May 17 10:53:45 2024
Command line: TestDisk
TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=61958258688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=511094816768
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=61956161536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=719323136
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=3162112
Hard disk list
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - INTEL HBRPEKNX0202AH, S/N:0000_0000_0100_0000_E4D2_5C38_6ADA_5101., FW:HPS1
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7532 255 63, sector size=512 - Patriot Memory, S/N:037B00196040, FW:PMAP
Drive X: - 3162 KB / 3088 KiB - CHS 193 16 2, sector size=512 - Microsoft Corporation RamDisk
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - INTEL HBRPEKNX0202AH
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1000210671 (expected 1000215215)
hdr_lba_start=34
hdr_lba_end=1000210638
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
check_part_gpt failed for partition
3 P MS Data 567296 998799359 998232064 [Basic data partition]
Current partition structure:
1 P EFI System 2048 534527 532480 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
2 P MS Reserved 534528 567295 32768 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 567296 998799359 998232064 [Basic data partition]
3 P MS Data 567296 998799359 998232064 [Basic data partition]
4 P Windows Recovery Env 998799360 1000204287 1404928 [Basic data partition]
search_part()
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
FAT32 at 0/32/33
FAT1 : 7166-7678
FAT2 : 7679-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-532479
sectors : 532480
cluster_size : 8
no_of_cluster : 65536 (2 - 65537)
fat_length 513 calculated 513
FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
NTFS at 49/75/19
filesystem size 998232064
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=405467136, part_size=511094816768, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 49/75/19
filesystem size 998232064
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 791928 999023991 998232064
NTFS, blocksize=4096, 511 GB / 475 GiB
NTFS at 62196/189/50
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 999184523 999190696 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 62196/189/50
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
MS Data 999190696 999196869 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 62259/213/34
filesystem size 1404928
sectors_per_cluster 8
mft_lcn 58538
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 998799360 1000204287 1404928 [Windows RE Tools]
NTFS found using backup sector, blocksize=4096, 719 MB / 686 MiB
NTFS at 62259/213/34
filesystem size 1404928
sectors_per_cluster 8
mft_lcn 58538
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
This partition ends after the disk limits. (start=1000204287, size=1404928, end=1001609214, disk end=1000215216)
NTFS at 62260/88/36
filesystem size 1000210432
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 1000212479 1000210432
NTFS found using backup sector, blocksize=4096, 512 GB / 476 GiB
NTFS at 62260/88/36
filesystem size 1000210432
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
This partition ends after the disk limits. (start=1000212479, size=1000210432, end=2000422910, disk end=1000215216)
file_win32_pread(504,11,buffer,1000215208(62260/131/56)) read err: read after end of file
file_win32_pread(504,11,buffer,1000215212(62260/131/60)) read err: read after end of file
file_win32_pread(504,8,buffer,1000215211(62260/131/59)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215204(62260/131/52)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215205(62260/131/53)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215206(62260/131/54)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215207(62260/131/55)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215208(62260/131/56)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215210(62260/131/58)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215212(62260/131/60)) read err: read after end of file
file_win32_pread(504,14,buffer,1000215214(62260/131/62)) read err: read after end of file
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 1024 GB / 953 GiB)
The following partitions can't be recovered:
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
Results
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
MS Data 2048 1000212479 1000210432
NTFS found using backup sector, blocksize=4096, 512 GB / 476 GiB
MS Data 791928 999023991 998232064
NTFS, blocksize=4096, 511 GB / 475 GiB
MS Data 998799360 1000204287 1404928 [Windows RE Tools]
Disk \\.\PhysicalDrive0 - 512 GB / 476 GiB - CHS 62260 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (512 GB / 476 GiB) seems too small! (< 1024 GB / 953 GiB)
The following partitions can't be recovered:
MS Data 1000204287 1001609214 1404928
NTFS, blocksize=4096, 719 MB / 686 MiB
MS Data 1000212479 2000422910 1000210432
NTFS, blocksize=4096, 512 GB / 476 GiB
Results
EFI System 2048 534527 532480 [EFI System Partition] [SYSTEM]
FAT32, blocksize=4096, 272 MB / 260 MiB
MS Data 2048 1000212479 1000210432
NTFS found using backup sector, blocksize=4096, 512 GB / 476 GiB
MS Data 791928 999023991 998232064
NTFS, blocksize=4096, 511 GB / 475 GiB
MS Data 998799360 1000204287 1404928 [Windows RE Tools]
NTFS found using backup sector, blocksize=4096, 719 MB / 686 MiB
MS Data 999184523 999190696 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
MS Data 999190696 999196869 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
interface_write()
No partition found or selected for recovery
simulate write!
TestDisk exited normally.