cgsecurity.org

Posted: **11 Sep 2024, 06:17**

Hi, can I get some advice on how to proceed with recovery?

The comp is a Dell laptop with Windows11, it's set up to 2 partitions for basically system and data - C: for os and installed apps, D: for user files, all Windows user directories (Documents, Downloads, Gallery, etc) are linked to folders on partition D... and partition D disappeared

.

Deep search shows the inaccessible parts, I tried MFT repair which didn't help. I don't know what else can be done with this.
This is not my own comp, trying to help a family member through teamviewer, so I don't full details on on how and exactly when it happened (happened 1-3 days ago).

Any help would be great

Code: Select all

Tue Sep 10 16:29:41 2024
Command line: TestDisk

TestDisk 7.2, Data Recovery Utility, February 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=126364843008
Hard disk list
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - PC SN520 NVMe WDC 128GB, S/N:1920_5280_0070_0001_001B_448B_44CA_CECE., FW:20200012

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - PC SN520 NVMe WDC 128GB
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=250069679 (expected 250069679)
hdr_lba_start=34
hdr_lba_end=250069646
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144
 2 P Windows Recovery Env      264192    1347583    1083392
 3 P EFI System               1347584    1552383     204800
 4 P MS Data                  1552384  248358717  246806334 [SYSTEM]
 5 P Windows Recovery Env   248358912  250064895    1705984

search_part()
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
FAT32 at 0/32/33
FAT1 : 5206-6698
FAT2 : 6699-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1535999
sectors : 1536000
cluster_size : 8
no_of_cluster : 190976 (2 - 190977)
fat_length 1493 calculated 1493

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 786 MB / 750 MiB
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=794820608, part_size=126364843008, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS, blocksize=4096, 126 GB / 117 GiB
NTFS at 15459/159/61
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                246652929  248358912    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
NTFS at 15459/159/61
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248358912  250064895    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
NTFS at 15565/241/36
filesystem size           1243136
sectors_per_cluster       8
mft_lcn                   51797
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248823808  250066943    1243136
     NTFS found using backup sector, blocksize=4096, 636 MB / 607 MiB
NTFS at 15565/241/36
filesystem size           1243136
sectors_per_cluster       8
mft_lcn                   51797
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250066943  251310078    1243136
     NTFS, blocksize=4096, 636 MB / 607 MiB
This partition ends after the disk limits. (start=250066943, size=1243136, end=251310078, disk end=250069680)
NTFS at 15566/18/61
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  250068984  248516601 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
NTFS at 15566/18/61
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068984, size=248516601, end=498585584, disk end=250069680)
NTFS at 15566/19/5
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552391  250068991  248516601
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
NTFS at 15566/19/5
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250068991  498585591  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068991, size=248516601, end=498585591, disk end=250069680)
file_win32_pread(648,11,buffer,250069670(15566/29/54)) read err: read after end of file
file_win32_pread(648,11,buffer,250069672(15566/29/56)) read err: read after end of file
file_win32_pread(648,11,buffer,250069678(15566/29/62)) read err: read after end of file
file_win32_pread(648,8,buffer,250069673(15566/29/57)) read err: read after end of file
file_win32_pread(648,3,buffer,250069679(15566/29/63)) read err: read after end of file
file_win32_pread(648,8,buffer,250069677(15566/29/61)) read err: read after end of file
file_win32_pread(648,14,buffer,250069668(15566/29/52)) read err: read after end of file
file_win32_pread(648,14,buffer,250069669(15566/29/53)) read err: read after end of file
file_win32_pread(648,14,buffer,250069670(15566/29/54)) read err: read after end of file
file_win32_pread(648,14,buffer,250069671(15566/29/55)) read err: read after end of file
file_win32_pread(648,14,buffer,250069672(15566/29/56)) read err: read after end of file
file_win32_pread(648,14,buffer,250069674(15566/29/58)) read err: read after end of file
file_win32_pread(648,14,buffer,250069676(15566/29/60)) read err: read after end of file
file_win32_pread(648,14,buffer,250069678(15566/29/62)) read err: read after end of file
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (128 GB / 119 GiB) seems too small! (< 255 GB / 237 GiB)
The following partitions can't be recovered:
     MS Data                250066943  251310078    1243136
     NTFS, blocksize=4096, 636 MB / 607 MiB
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
     MS Data                250068991  498585591  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB

Results
   P EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 786 MB / 750 MiB
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS, blocksize=4096, 126 GB / 117 GiB
     MS Data                  1552384  250068984  248516601 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
     MS Data                  1552391  250068991  248516601
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
     MS Data                246652929  248358912    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
     MS Data                248358912  250064895    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
     MS Data                248823808  250066943    1243136
     NTFS found using backup sector, blocksize=4096, 636 MB / 607 MiB

interface_write()
 1 P EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
simulate write!

Analyse Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=250069679 (expected 250069679)
hdr_lba_start=34
hdr_lba_end=250069646
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144
 2 P Windows Recovery Env      264192    1347583    1083392
 3 P EFI System               1347584    1552383     204800
 4 P MS Data                  1552384  248358717  246806334 [SYSTEM]
 5 P Windows Recovery Env   248358912  250064895    1705984

search_part()
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
FAT32 at 0/32/33
FAT1 : 5206-6698
FAT2 : 6699-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1535999
sectors : 1536000
cluster_size : 8
no_of_cluster : 190976 (2 - 190977)
fat_length 1493 calculated 1493

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 786 MB / 750 MiB
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=794820608, part_size=126364843008, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS, blocksize=4096, 126 GB / 117 GiB
NTFS at 15459/159/61
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                246652929  248358912    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
NTFS at 15459/159/61
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248358912  250064895    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
NTFS at 15565/241/36
filesystem size           1243136
sectors_per_cluster       8
mft_lcn                   51797
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248823808  250066943    1243136
     NTFS found using backup sector, blocksize=4096, 636 MB / 607 MiB
NTFS at 15565/241/36
filesystem size           1243136
sectors_per_cluster       8
mft_lcn                   51797
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250066943  251310078    1243136
     NTFS, blocksize=4096, 636 MB / 607 MiB
This partition ends after the disk limits. (start=250066943, size=1243136, end=251310078, disk end=250069680)
NTFS at 15566/18/61
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  250068984  248516601 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
NTFS at 15566/18/61
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068984, size=248516601, end=498585584, disk end=250069680)
NTFS at 15566/19/5
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552391  250068991  248516601
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
NTFS at 15566/19/5
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250068991  498585591  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068991, size=248516601, end=498585591, disk end=250069680)
file_win32_pread(648,11,buffer,250069670(15566/29/54)) read err: read after end of file
file_win32_pread(648,11,buffer,250069672(15566/29/56)) read err: read after end of file
file_win32_pread(648,11,buffer,250069678(15566/29/62)) read err: read after end of file
file_win32_pread(648,8,buffer,250069673(15566/29/57)) read err: read after end of file
file_win32_pread(648,3,buffer,250069679(15566/29/63)) read err: read after end of file
file_win32_pread(648,8,buffer,250069677(15566/29/61)) read err: read after end of file
file_win32_pread(648,14,buffer,250069668(15566/29/52)) read err: read after end of file
file_win32_pread(648,14,buffer,250069669(15566/29/53)) read err: read after end of file
file_win32_pread(648,14,buffer,250069670(15566/29/54)) read err: read after end of file
file_win32_pread(648,14,buffer,250069671(15566/29/55)) read err: read after end of file
file_win32_pread(648,14,buffer,250069672(15566/29/56)) read err: read after end of file
file_win32_pread(648,14,buffer,250069674(15566/29/58)) read err: read after end of file
file_win32_pread(648,14,buffer,250069676(15566/29/60)) read err: read after end of file
file_win32_pread(648,14,buffer,250069678(15566/29/62)) read err: read after end of file
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (128 GB / 119 GiB) seems too small! (< 255 GB / 237 GiB)
The following partitions can't be recovered:
     MS Data                250066943  251310078    1243136
     NTFS, blocksize=4096, 636 MB / 607 MiB
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
     MS Data                250068991  498585591  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB

Results
   P EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 786 MB / 750 MiB
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS, blocksize=4096, 126 GB / 117 GiB
     MS Data                  1552384  250068984  248516601 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
     MS Data                  1552391  250068991  248516601
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
     MS Data                246652929  248358912    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
     MS Data                248358912  250064895    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
     MS Data                248823808  250066943    1243136
     NTFS found using backup sector, blocksize=4096, 636 MB / 607 MiB

interface_write()
 1 P EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]

search_part()
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
FAT32 at 0/32/33
FAT1 : 5206-6698
FAT2 : 6699-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1535999
sectors : 1536000
cluster_size : 8
no_of_cluster : 190976 (2 - 190977)
fat_length 1493 calculated 1493

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 786 MB / 750 MiB
FAT32 at 0/32/39
FAT1 : 5206-6698
FAT2 : 6699-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1535999
sectors : 1536000
cluster_size : 8
no_of_cluster : 190976 (2 - 190977)
fat_length 1493 calculated 1493
set_FAT_info: name from BS used

FAT32 at 0/32/39
FAT: cluster=2(0x2), pos=10240
     EFI System                  2048    1538047    1536000 [EFI System Partition] [NO NAME]
     FAT32, blocksize=4096, 786 MB / 750 MiB
FAT32 at 0/32/39
FAT1 : 5206-6698
FAT2 : 6699-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1535999
sectors : 1536000
cluster_size : 8
no_of_cluster : 190976 (2 - 190977)
fat_length 1493 calculated 1493
set_FAT_info: name from BS used

FAT32 at 0/32/39
FAT: Directory entry is marked as free.
FAT: cluster=2(0x2), pos=10246
     MS Data                     2054    1538053    1536000 [NO NAME]
     FAT32, blocksize=4096, 786 MB / 750 MiB
NTFS at 2/50/33
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                    29139      35312       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 2/50/33
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                    35312      41485       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 16/113/34
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=554693120, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192    1347576    1083385
     NTFS, blocksize=4096, 554 MB / 528 MiB
NTFS at 83/225/7
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192    1347576    1083385
     NTFS found using backup sector, blocksize=4096, 554 MB / 528 MiB
NTFS at 83/225/7
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1347576    2430960    1083385
     NTFS, blocksize=4096, 554 MB / 528 MiB
NTFS at 83/225/14
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264199    1347583    1083385
     NTFS found using backup sector, blocksize=4096, 554 MB / 528 MiB
NTFS at 83/225/14
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1347583    2430967    1083385
     NTFS, blocksize=4096, 554 MB / 528 MiB
FAT32 at 83/225/15
FAT1 : 32-825
FAT2 : 826-1619
start_rootdir : 1620 root cluster : 2
Data : 1620-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 101590 (2 - 101591)
fat_length 794 calculated 794
set_FAT_info: name from BS used

FAT32 at 83/225/15
FAT: cluster=2(0x2), pos=1349204
     EFI System               1347584    1552383     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
FAT32 at 83/225/21
FAT1 : 32-825
FAT2 : 826-1619
start_rootdir : 1620 root cluster : 2
Data : 1620-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 101590 (2 - 101591)
fat_length 794 calculated 794
FAT differs, FAT sectors=784-794/794
set_FAT_info: name from BS used

FAT32 at 83/225/21
FAT: cluster=2(0x2), pos=1349204
     EFI System               1347584    1552383     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
FAT32 at 83/225/21
FAT1 : 32-825
FAT2 : 826-1619
start_rootdir : 1620 root cluster : 2
Data : 1620-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 101590 (2 - 101591)
fat_length 794 calculated 794
FAT differs, FAT sectors=784-794/794
set_FAT_info: name from BS used

FAT32 at 83/225/21
FAT: cluster=2(0x2), pos=1349210
FAT: cluster=771(0x303), pos=1350748
FAT: cluster=1540(0x604), pos=1352286
     MS Data                  1347590    1552389     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=794820608, part_size=126364843008, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS, blocksize=4096, 126 GB / 117 GiB

HFS magic value at 1153/209/33
part_size 3858760450
     Mac HFS                 18536144 3877296593 3858760450
     HFS blocksize=67108864, 1975 GB / 1840 GiB
This partition ends after the disk limits. (start=18536144, size=3858760450, end=3877296593, disk end=250069680)

HFS magic value at 1153/209/35

LVM magic value at 3406/201/35
NTFS at 3654/239/26
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                 58710419   58716592       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 3654/239/26
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                 58716592   58722765       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB

LVM magic value at 4484/35/45

LVM magic value at 4879/252/7

LVM magic value at 5303/165/61
NTFS at 15459/156/55
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 126 GB / 117 GiB
NTFS at 15459/156/55
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                248358717  495165050  246806334
     NTFS, blocksize=4096, 126 GB / 117 GiB
This partition ends after the disk limits. (start=248358717, size=246806334, end=495165050, disk end=250069680)
NTFS at 15459/159/61
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                246652929  248358912    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
NTFS at 15459/159/61
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248358912  250064895    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
NTFS at 15503/49/19
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                249052627  249058800       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 15503/49/19
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     MS Data                249058800  249064973       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 15565/209/4
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248358912  250064895    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
NTFS at 15565/209/4
filesystem size           1705984
sectors_per_cluster       8
mft_lcn                   71082
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250064895  251770878    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
This partition ends after the disk limits. (start=250064895, size=1705984, end=251770878, disk end=250069680)
NTFS at 15565/241/36
filesystem size           1243136
sectors_per_cluster       8
mft_lcn                   51797
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                248823808  250066943    1243136
     NTFS found using backup sector, blocksize=4096, 636 MB / 607 MiB
NTFS at 15565/241/36
filesystem size           1243136
sectors_per_cluster       8
mft_lcn                   51797
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250066943  251310078    1243136
     NTFS, blocksize=4096, 636 MB / 607 MiB
This partition ends after the disk limits. (start=250066943, size=1243136, end=251310078, disk end=250069680)
NTFS at 15566/18/61
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552384  250068984  248516601 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
NTFS at 15566/18/61
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068984, size=248516601, end=498585584, disk end=250069680)
NTFS at 15566/19/5
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1552391  250068991  248516601
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
NTFS at 15566/19/5
filesystem size           248516601
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                250068991  498585591  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068991, size=248516601, end=498585591, disk end=250069680)
file_win32_pread(648,11,buffer,250069670(15566/29/54)) read err: read after end of file
file_win32_pread(648,11,buffer,250069672(15566/29/56)) read err: read after end of file
file_win32_pread(648,11,buffer,250069678(15566/29/62)) read err: read after end of file
file_win32_pread(648,8,buffer,250069673(15566/29/57)) read err: read after end of file
file_win32_pread(648,3,buffer,250069679(15566/29/63)) read err: read after end of file
file_win32_pread(648,8,buffer,250069677(15566/29/61)) read err: read after end of file
file_win32_pread(648,14,buffer,250069668(15566/29/52)) read err: read after end of file
file_win32_pread(648,14,buffer,250069669(15566/29/53)) read err: read after end of file
file_win32_pread(648,14,buffer,250069670(15566/29/54)) read err: read after end of file
file_win32_pread(648,14,buffer,250069671(15566/29/55)) read err: read after end of file
file_win32_pread(648,14,buffer,250069672(15566/29/56)) read err: read after end of file
file_win32_pread(648,14,buffer,250069674(15566/29/58)) read err: read after end of file
file_win32_pread(648,14,buffer,250069676(15566/29/60)) read err: read after end of file
file_win32_pread(648,14,buffer,250069678(15566/29/62)) read err: read after end of file
NTFS at 16/113/34
filesystem size           1083385
sectors_per_cluster       8
mft_lcn                   32224
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS at 96/161/2
filesystem size           246806334
sectors_per_cluster       8
mft_lcn                   659743
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Disk \\.\PhysicalDrive1 - 128 GB / 119 GiB - CHS 15566 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (128 GB / 119 GiB) seems too small! (< 1985 GB / 1848 GiB)
The following partitions can't be recovered:
     Mac HFS                 18536144 3877296593 3858760450
     HFS blocksize=67108864, 1975 GB / 1840 GiB
     MS Data                248358717  495165050  246806334
     NTFS, blocksize=4096, 126 GB / 117 GiB
     MS Data                250064895  251770878    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
     MS Data                250066943  251310078    1243136
     NTFS, blocksize=4096, 636 MB / 607 MiB
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
     MS Data                250068991  498585591  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB

Results
     EFI System                  2048    1538047    1536000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 786 MB / 750 MiB
     MS Data                     2054    1538053    1536000 [NO NAME]
     FAT32, blocksize=4096, 786 MB / 750 MiB
     MS Data                    29139      35312       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data                    35312      41485       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
     MS Data                   264192    1347576    1083385
     NTFS, blocksize=4096, 554 MB / 528 MiB
     MS Data                   264199    1347583    1083385
     NTFS found using backup sector, blocksize=4096, 554 MB / 528 MiB
     MS Data                  1347576    2430960    1083385
     NTFS, blocksize=4096, 554 MB / 528 MiB
     MS Data                  1347583    2430967    1083385
     NTFS, blocksize=4096, 554 MB / 528 MiB
     EFI System               1347584    1552383     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
     MS Data                  1347590    1552389     204800 [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
     MS Data                  1552384  248358717  246806334 [SYSTEM]
     NTFS, blocksize=4096, 126 GB / 117 GiB
     MS Data                  1552384  250068984  248516601 [SYSTEM]
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
     MS Data                  1552391  250068991  248516601
     NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
     MS Data                 58710419   58716592       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data                 58716592   58722765       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
     MS Data                246652929  248358912    1705984
     NTFS found using backup sector, blocksize=4096, 873 MB / 833 MiB
     MS Data                248358912  250064895    1705984
     NTFS, blocksize=4096, 873 MB / 833 MiB
     MS Data                248823808  250066943    1243136
     NTFS found using backup sector, blocksize=4096, 636 MB / 607 MiB
     MS Data                249052627  249058800       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
     MS Data                249058800  249064973       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB

Posted: **11 Sep 2024, 09:17**

If your disk really has become smaller you would need to contact a professional recovery lab.
Your disk size is not necessarily the sum of all partitions that you can see in Windows Explorer.
You need to open the disk management to verify if your disk size has shrunk.

Is there another storage device in the notebook so that the D-partition may not be necessarily located on the NVME disk?

Code: Select all

Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144
 1 P MS Reserved                   34     262177     262144
 2 P Windows Recovery Env      264192    1347583    1083392
 3 P EFI System               1347584    1552383     204800
 4 P MS Data                  1552384  248358717  246806334 [SYSTEM]
 5 P Windows Recovery Env   248358912  250064895    1705984

Except for the double entries of the Windows Recovery Environment everything looks fine. There is no space for a data partition.
You should find out how big your system and data partition had been before the incident.

This information is necessary to make an educated guess where the data partition may be hiding in the structure above.

Looking at the figures above it appears to me that someone has modified the 3, 4 and 5.

Posted: **11 Sep 2024, 10:02**

recuperation wrote: 11 Sep 2024, 09:17 You should find out how big your system and data partition had been before the incident.
This information is necessary to make an educated guess where the data partition may be hiding in the structure above.

It's not in those partitions, I think (not 100% sure) that it's a 256GB drive that was in 2 128GB partitions.
I assumed the following start/end numbers from the log corroborates that:

Code: Select all

NTFS: Can't read MFT
     MS Data                250068984  498585584  248516601
     NTFS, blocksize=4096, 127 GB / 118 GiB
This partition ends after the disk limits. (start=250068984, size=248516601, end=498585584, disk end=250069680)

Looking at MS disk management and then NIUBI partition editor, it now shows as a "normal" 128GB disk.
And no, there's only the one disk present.

Posted: **11 Sep 2024, 10:54**

You should then complain with your manufacturer that you bought a fake 256 GB NVME device:

https://www.westerndigital.com/de-de/pr ... -128G-1022

Posted: **11 Sep 2024, 13:29**

Fake?! It's a 5y old laptop. The disk was (seemingly) fine till a few days ago.
So, you're saying there's nothing to be done?

cgsecurity.org

Dell laptop partition D disappeared and drive is now smaller!?

Dell laptop partition D disappeared and drive is now smaller!?

Re: Dell laptop partition D disappeared and drive is now smaller!?

Re: Dell laptop partition D disappeared and drive is now smaller!?

Re: Dell laptop partition D disappeared and drive is now smaller!?

Re: Dell laptop partition D disappeared and drive is now smaller!?