cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=12915

Page 1 of 1

Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 01 Oct 2024, 08:38
by yum13241
The USB drive is 64GB in size (that's what it says on it).
I was attempting to fix a Windows installation not being detected by the system, so I ran [c]bootrec /fixboot[/c] and [c]bootrec /fixmbr[/c]. I also ran [c]bootrec /rebuildbcd[/c], but my USB drive wasn't impacted by it. I attempted to update Ventoy, which was on the drive. The drive already had Ventoy on it, so Ventoy2Disk would just update the VTOYEFI partition, which is intact.

There were 2 partitions: One 32MB (ESP | name VTOYEFI) in size and an exFAT partition taking all the available space.
When I realized I toasted my drive, I went to my PC and ran TestDisk. Bringing back the old partition did not work, it says the file system is damaged. I checked the boot sector and it said that the main one was [c]exFAT OK[/c] and the backup one wasn't. TestDisk offered to copy the main one to the back up. I allowed it to. (this was before I enabled the log file!)

I also attempted to rebuild the boot sector, to no avail.

Is my data just gone?

Testdisk.log is here.

Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 01 Oct 2024, 19:28
by recuperation
yum13241 wrote: 01 Oct 2024, 08:38 The USB drive is 64GB in size (that's what it says on it).
I was attempting to fix a Windows installation not being detected by the system, so I ran [c]bootrec /fixboot[/c] and [c]bootrec /fixmbr[/c].
Insufficient description. Who is repairing whom?

I also ran [c]bootrec /rebuildbcd[/c], but my USB drive wasn't impacted by it.
Confusing, again! I expect the USB disk to be the one containing Ventoy. Now operating on your USB "drive"?

I attempted to update Ventoy, which was on the drive. How this is Ventoy update related to the incident?
Is this a new operation independant of the initial repair?
The drive already had Ventoy on it, so Ventoy2Disk would just update the VTOYEFI partition, which is intact.

There
Where?!
were 2 partitions: One 32MB (ESP | name VTOYEFI) in size and an exFAT partition taking all the available space.
When I realized I toasted my drive, I went to my PC and ran TestDisk.
Running TestDisk against which target?!

Bringing back the old partition did not work, it says the file system is damaged. I checked the boot sector and it said that the main one was [c]exFAT OK[/c] and the backup one wasn't. TestDisk offered to copy the main one to the back up. I allowed it to. (this was before I enabled the log file!)

I also attempted to rebuild the boot sector, to no avail.

Is my data just gone?
I have no idea!
You are supposed to upload your logfile to this site. I did this for you.
According to the log file you were trying to repair the Kingston stick that is running Ventoy.

I don't understand which data you are referring to as a Ventoy disk is usually filled with ISO files that came from somewhere else.
Are the ISO's the data?

If I have a problem with a Ventoy storage device I would zero out the device, reinstall Ventoy and copy the ISO files.

Code: Select all

Tue Oct  1 10:27:47 2024
Command line: TestDisk

TestDisk 7.3-WIP, Data Recovery Utility, September 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3003.3
ext2fs lib: 1.45.3, ntfs lib: available, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=61991813632
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=66294120448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=224933179904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=208271310848
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=61957210112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=33554432
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-1DG142, S/N:WBYDLJ5Z, FW:1003YAM1
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63, sector size=512 - Kingston DataTraveler 3.0, S/N:0000000005, FW:0000

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - Kingston DataTraveler 3.0
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
Current partition structure:
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [VTOYEFI]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
     HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 7532/168/61
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254

FAT16 at 7532/168/61
     FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB
file_win32_pread(884,8,buffer,121077760(7536/189/14)) read err: read after end of file

Results
   * HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
   P FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

interface_write()
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

exFAT_boot_sector
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
Boot sector
exFAT OK

Backup boot record
exFAT OK

Sectors are identical.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.

Directory /

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB


dir_partition inode=0
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
Directory /

Analyse Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
Current partition structure:
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [VTOYEFI]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
     HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 7532/168/61
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254

FAT16 at 7532/168/61
     FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB
file_win32_pread(884,8,buffer,121077760(7536/189/14)) read err: read after end of file

Results
   * HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
   P FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

interface_write()
 1 * HPFS - NTFS              0  32 33  7532 168 60  121010176
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
Geometry from i386 MBR: head=255 sector=63
FAT16 at 7532/168/61
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
Current partition structure:
 1 P HPFS - NTFS              0  32 33  7532 168 60  121010176
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [VTOYEFI]
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 61 GB / 57 GiB - CHS 7536 255 63
     HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 7532/168/61
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254

FAT16 at 7532/168/61
     FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB
file_win32_pread(884,8,buffer,121077760(7536/189/14)) read err: read after end of file

Results
   * HPFS - NTFS              0  32 33  7532 168 60  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
   P FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

interface_write()
 1 * HPFS - NTFS              0  32 33  7532 168 60  121010176
 2 P FAT16 LBA             7532 168 61  7536 189 13      65536 [EFI System Partition] [VTOYEFI]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 02 Oct 2024, 14:45
by yum13241
Insufficient description. Who is repairing whom?
I was repairing a cousin's computer with my Ventoy USB drive. The USB drive is the kingston drive.
Confusing, again! I expect the USB disk to be the one containing Ventoy. Now operating on your USB "drive"?
Sorry. The USB drive is the Kingston drive. It contains Ventoy.
Is this a new operation independant of the initial repair?
Yes.
Running TestDisk against which target?!
The second, large partition. The first one is as I described, intact.

Are the ISO's the data?
Yes.

Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 02 Oct 2024, 15:02
by recuperation
yum13241 wrote: 02 Oct 2024, 14:45
Insufficient description. Who is repairing whom?
I was repairing a cousin's computer with my Ventoy USB drive. The USB drive is the kingston drive.
Confusing, again! I expect the USB disk to be the one containing Ventoy. Now operating on your USB "drive"?
Sorry. The USB drive is the Kingston drive. It contains Ventoy.
Is this a new operation independant of the initial repair?
Yes.
Running TestDisk against which target?!
The second, large partition. The first one is as I described, intact.
But what is the disk? :roll: :shock:
What you say is as specific and precise as when you said "I delivered the mail to house number 5".

The logfile states that you operated on your Kingston USB device.

It is still unclear what is dammaged. Obviously it is your cousin's computer. Now it seems the Kingston USB device is dammaged as well. You did not comment on my proposal of just reinstalling Ventoy to the pen drive of your choice and copying the ISOs in there.
If there were ISO files, the chances are 99,9% that you did not create those ISO files and that you just copied them to the Ventoy disk.

I don't get it sorry, and asking you does not enlight me as I hoped to.

Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 02 Oct 2024, 18:53
by yum13241
Now it seems the Kingston USB device is dammaged as well. You did not comment on my proposal of just reinstalling Ventoy to the pen drive of your choice and copying the ISOs in there.
If there were ISO files, the chances are 99,9% that you did not create those ISO files and that you just copied them to the Ventoy disk.
It is unclear what is damaged
The second partition (the biggest one on my Kingston drive) is damaged.

I actually did create some of the ISO files on there (mainly custom Windows deployments, mainly getting around esoteric firmware), and there were non-ISO files there as well.

I could format the drive and just try to download everything again, but typically that's a last resort. All I know is that [c]bootrec[/c] must've operated on the Kingston USB drive, since its bootsector is corrupted, which even after copying the regular to the backup as TestDisk suggests, does not allow me to list files on the deleted partition, since TestDisk believes that the filesystem is damaged. Rewriting the partition table has no effect, and Windows Explorer prompts to format the drive, to which I have selected NO each time.

But what is the disk? :roll: :shock:
What you say is as specific and precise as when you said "I delivered the mail to house number 5".
The Kingston USB drive, which is 64GB in size and had 2 partitions before the accident: VTOYEFI (32MB in size) and Ventoy Neo, taking the rest of the space, formatted as exFAT.

My cousin's computer is no longer "damaged", as you put it. Some aftermarket disk shenanigans, that was all. They went to a guy who installed a drive, replacing the DVD drive, though that's out of scope.

If it is at all possible, I'd rather just "undelete" as TestDisk puts it, rather than just give up. If that is not possible, I'll just go on a long scavenger hunt for everything I had.

Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 02 Oct 2024, 20:58
by recuperation
yum13241 wrote: 02 Oct 2024, 18:53
The second partition (the biggest one on my Kingston drive) is damaged.

I actually did create some of the ISO files on there (mainly custom Windows deployments, mainly getting around esoteric firmware), and there were non-ISO files there as well.

I could format the drive and just try to download everything again, but typically that's a last resort. All I know is that [c]bootrec[/c] must've operated on the Kingston USB drive, since its bootsector is corrupted, which even after copying the regular to the backup as TestDisk suggests, does not allow me to list files on the deleted partition, since TestDisk believes that the filesystem is damaged. Rewriting the partition table has no effect, and Windows Explorer prompts to format the drive, to which I have selected NO each time.
[/quote]
[/quote]


According to the log file - which I trust - your first partition is the big one containing your iso-files.
I found that strange and looked at my own Ventoy pen drive - the EFI partition is the second one which is the last one of two partitions. The first one is the big one in case of my Ventoy pen drive.

You just have to follow the standard procedure and try to look into that first partition using Testdisk and search your iso's and files there:

https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

There is an undelete function in the "advanced" menu.

If that fails use some commercial software or try using Photorec. It might be necessary to disable all formats in Photorec with the exception of the ISO file format.
The problem with ISO is that they contain lots of different file formats. Photorec typically stops recovering a file when it detecs a new file.
That means that finding a zip file header might finalize the recovery of an ISO file.
You might play around to see which settings yield the expected outcome.

Re: Recover a USB drive after accidental bootrec /fixboot and bootrec /fixmbr

Posted: 03 Oct 2024, 22:20
by yum13241

Code: Select all

Thu Oct  3 23:22:14 2024
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2024
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.11.1-arch1-1 (#1 SMP PREEMPT_DYNAMIC Mon, 30 Sep 2024 23:49:50 +0000) x86_64
Compiler: GCC 14.1
ext2fs lib: 1.47.1, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.5
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LT012-1DG14, FW:YAM1
Disk /dev/sdb - 61 GB / 57 GiB - CHS 59120 64 32, sector size=512 - DataTraveler 3.0, FW:0000

Partition table type (auto): Intel
Disk /dev/sdb - 61 GB / 57 GiB - DataTraveler 3.0
Partition table type: Intel

Analyse Disk /dev/sdb - 61 GB / 57 GiB - CHS 59120 64 32
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 1056
FAT16 at 59088/0/1
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
heads/cylinder 255 (FAT) != 64 (HD)
sect/track 63 (FAT) != 32 (HD)
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=2
Current partition structure:
 1 * HPFS - NTFS              1   0  1 59087  63 32  121010176

Warning: Bad starting sector (CHS and LBA don't match)
Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD)
Warning: number of sectors per track mismatches 63 (FAT) != 32 (HD)
 2 P FAT16 LBA            59088   0  1 59119  63 32      65536 [VTOYEFI]

Warning: Bad starting sector (CHS and LBA don't match)

search_part()
Disk /dev/sdb - 61 GB / 57 GiB - CHS 59120 64 32
     HPFS - NTFS              1   0  1 59087  63 32  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 59088/0/1
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
heads/cylinder 255 (FAT) != 64 (HD)
sect/track 63 (FAT) != 32 (HD)

FAT16 at 59088/0/1
     FAT16 LBA            59088   0  1 59119  63 32      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=2

Results
   * HPFS - NTFS              1   0  1 59087  63 32  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
   P FAT16 LBA            59088   0  1 59119  63 32      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 121010176 linear /dev/sdb 2048" | dmsetup create test0
echo "0 65536 linear /dev/sdb 121012224" | dmsetup create test1

interface_write()
 1 P HPFS - NTFS              1   0  1 59087  63 32  121010176
 2 P FAT16 LBA            59088   0  1 59119  63 32      65536 [EFI System Partition] [VTOYEFI]
NTFS signature is missing.
NTFS signature is missing.
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

Interface Advanced
Geometry from i386 MBR: head=64 sector=32
FAT16 at 59088/0/1
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
heads/cylinder 255 (FAT) != 64 (HD)
sect/track 63 (FAT) != 32 (HD)
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=2
 1 P HPFS - NTFS              1   0  1 59087  63 32  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
 2 P FAT16 LBA            59088   0  1 59119  63 32      65536 [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

Directory /


dir_partition inode=0
 1 P HPFS - NTFS              1   0  1 59087  63 32  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
Directory /
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Analyse Disk /dev/sdb - 61 GB / 57 GiB - CHS 59120 64 32
Geometry from i386 MBR: head=64 sector=32
FAT16 at 59088/0/1
Info: size boot_sector 65536, partition 65536
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
heads/cylinder 255 (FAT) != 64 (HD)
sect/track 63 (FAT) != 32 (HD)
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=2
Current partition structure:
 1 P HPFS - NTFS              1   0  1 59087  63 32  121010176
Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD)
Warning: number of sectors per track mismatches 63 (FAT) != 32 (HD)
 2 P FAT16 LBA            59088   0  1 59119  63 32      65536 [VTOYEFI]
No partition is bootable

search_part()
Disk /dev/sdb - 61 GB / 57 GiB - CHS 59120 64 32
     HPFS - NTFS              1   0  1 59087  63 32  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
FAT16 at 59088/0/1
FAT1 : 1-254
FAT2 : 255-508
start_rootdir : 509
Data : 541-65535
sectors : 65536
cluster_size : 1
no_of_cluster : 64995 (2 - 64996)
fat_length 254 calculated 254
heads/cylinder 255 (FAT) != 64 (HD)
sect/track 63 (FAT) != 32 (HD)

FAT16 at 59088/0/1
     FAT16 LBA            59088   0  1 59119  63 32      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=8 nbr=4
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=2

Results
   * HPFS - NTFS              1   0  1 59087  63 32  121010176
     exFAT, blocksize=2, 61 GB / 57 GiB
   P FAT16 LBA            59088   0  1 59119  63 32      65536 [EFI System Partition] [VTOYEFI]
     FAT16, blocksize=512, 33 MB / 32 MiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 121010176 linear /dev/sdb 2048" | dmsetup create test0
echo "0 65536 linear /dev/sdb 121012224" | dmsetup create test1

interface_write()
 1 P HPFS - NTFS              1   0  1 59087  63 32  121010176
 2 P FAT16 LBA            59088   0  1 59119  63 32      65536 [EFI System Partition] [VTOYEFI]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
Trying to "undelete" results in the error "Filesystem damaged, unable to list files".
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited