Ma question concerne un disque dur externe 1TB et une clef USB 8GB qui ne sont plus lisibles.
Je suspecte mon ordi d'etre infecté avec un Rootkit et d'avoir wipé les lecteurs externes, mais ca peut etre de mauvais fonctionnement car le systeme rame à mort.
(détails de ma recherche surle forum MBAM:https://forums.malwarebytes.com/topic/3 ... w7-laptop/) Il s'agit d'un petit netbook (2 Go de RAM double Atom N455, Win7,SSD interne 120GB)
L'ordinateur a rendu ma clé USB et mon disque dur externe inaccessibles ("H is not accessible. The file or directory is corrupted and unreadable").
En les examinant avec TestDisk, j'ai constaté dans les deux cas, une structure de partitions identiques avec quatre parties amorçables : 1 Sys=4F, 2 Sys=73, 3 Sys=2B et 4 SpeedStor, toutes présentant des secteurs relatifs défectueux.
Comme les données sur le DD sontbeaucoup plus précieuses, j'aimerais d'abord tenter de récuperer la clef, et si ca marche, seulement ensuite le disque.
Fri Dec 12 14:51:45 2025
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8054112256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8054112256
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=8053063680
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk /dev/sdb - 8054 MB / 7681 MiB - CHS 979 255 63, sector size=512
Drive C: - 119 GB / 111 GiB - CHS 14580 255 63, sector size=512
Drive H: - 8053 MB / 7680 MiB - CHS 979 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdb - 8054 MB / 7681 MiB
Partition table type: Intel
Analyse Disk /dev/sdb - 8054 MB / 7681 MiB - CHS 979 255 63
Geometry from i386 MBR: head=49 sector=29
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 979 48 29 15728640
Warning: Bad ending cylinder (CHS and LBA don't match)
search_part()
Disk /dev/sdb - 8054 MB / 7681 MiB - CHS 979 255 63
NTFS at 0/32/33
filesystem size 15728640
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 983039
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 979 48 29 15728640
NTFS, blocksize=4096, 8053 MB / 7680 MiB
file_pread(5,8,buffer,15730688(979/48/30)) ReadFile The drive cannot find the sector requested.
file_pread(5,1,buffer,15730688(979/48/30)) ReadFile The drive cannot find the sector requested.
file_pread(5,1,buffer,15730689(979/48/31)) lseek err Invalid argument
file_pread(5,14,buffer,15730690(979/48/32)) lseek err Invalid argument
file_pread(5,3,buffer,15730704(979/48/46)) lseek err Invalid argument
file_pread(5,3,buffer,15730751(979/49/30)) lseek err Invalid argument
file_pread(5,8,buffer,15730767(979/49/46)) lseek err Invalid argument
file_pread(5,11,buffer,15730814(979/50/30)) lseek err Invalid argument
file_pread(5,2,buffer,15732736(979/80/62)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 979 48 29 15728640
NTFS, blocksize=4096, 8053 MB / 7680 MiB
interface_write()
1 * HPFS - NTFS 0 32 33 979 48 29 15728640
search_part()
Disk /dev/sdb - 8054 MB / 7681 MiB - CHS 979 255 63
NTFS at 0/32/33
filesystem size 15728640
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 983039
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 979 48 29 15728640
NTFS, blocksize=4096, 8053 MB / 7680 MiB
file_pread(5,2,buffer,15730688(979/48/30)) ReadFile The drive cannot find the sector requested.
file_pread(5,1,buffer,15730688(979/48/30)) ReadFile The drive cannot find the sector requested.
NTFS at 979/48/29
filesystem size 15728640
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 983039
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 979 48 29 15728640
NTFS found using backup sector, blocksize=4096, 8053 MB / 7680 MiB
file_pread(5,14,buffer,15730689(979/48/31)) lseek err Invalid argument
file_pread(5,1,buffer,15730689(979/48/31)) lseek err Invalid argument
file_pread(5,8,buffer,15730695(979/48/37)) lseek err Invalid argument
file_pread(5,3,buffer,15730703(979/48/45)) lseek err Invalid argument
file_pread(5,3,buffer,15730750(979/49/29)) lseek err Invalid argument
file_pread(5,8,buffer,15730766(979/49/45)) lseek err Invalid argument
file_pread(5,11,buffer,15730813(979/50/29)) lseek err Invalid argument
file_pread(5,2,buffer,15732735(979/80/61)) lseek err Invalid argument
file_pread(5,6,buffer,15730690(979/48/32)) lseek err Invalid argument
file_pread(5,1,buffer,15730706(979/48/48)) lseek err Invalid argument
file_pread(5,1,buffer,15730753(979/49/32)) lseek err Invalid argument
file_pread(5,1,buffer,15730774(979/49/53)) lseek err Invalid argument
file_pread(5,1,buffer,15730824(979/50/40)) lseek err Invalid argument
file_pread(5,1,buffer,15732737(979/80/63)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 979 48 29 15728640
NTFS, blocksize=4096, 8053 MB / 7680 MiB
interface_write()
1 P HPFS - NTFS 0 32 33 979 48 29 15728640
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): None
Drive H: - 8053 MB / 7680 MiB
Partition table type: Intel
Analyse Drive H: - 8053 MB / 7680 MiB - CHS 979 255 63
Geometry from i386 MBR: head=115 sector=52
BAD_RS LBA=1936269394 5382406
check_part_i386
1 type 4F: no test
BAD_RS LBA=1917848077 5967333
check_part_i386
2 type 73: no test
BAD_RS LBA=1818575915 5855017
check_part_i386
3 type 2B: no test
BAD_RS LBA=2844524554 5982593
check_part_i386
4 type 61: no test
Current
partition structure:
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
Bad relative sector.
2 * Sys=73 119380 132 62 153270 41 37 544437093
Bad relative sector.
3 * Sys=2B 113201 29 24 147074 114 59 544175136
Bad relative sector.
4 * SpeedStor 177063 118 26 177066 225 63 54974
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
3 * Sys=2B 113201 29 24 147074 114 59 544175136
2 * Sys=73 119380 132 62 153270 41 37 544437093
Space conflict between the following two partitions
2 * Sys=73 119380 132 62 153270 41 37 544437093
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
Space conflict between the following two partitions
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
4 * SpeedStor 177063 118 26 177066 225 63 54974
search_part()
Drive H: - 8053 MB / 7680 MiB - CHS 979 255 63
NTFS at 979/15/60
filesystem size 15728640
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 983039
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 979 15 60 15728640
NTFS found using backup sector, blocksize=4096, 8053 MB / 7680 MiB
Partition not added.
Results
interface_write()
No partition found or selected for recovery
search_part()
Drive H: - 8053 MB / 7680 MiB - CHS 979 255 63
NTFS at 979/15/60
filesystem size 15728640
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 983039
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 0 1 979 15 60 15728640
NTFS found using backup sector, blocksize=4096, 8053 MB / 7680 MiB
Partition not added.
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=115 sector=52
BAD_RS LBA=1936269394 5382406
check_part_i386 1 type 4F: no test
BAD_RS LBA=1917848077 5967333
check_part_i386 2 type 73: no test
BAD_RS LBA=1818575915 5855017
check_part_i386 3 type 2B: no test
BAD_RS LBA=2844524554 5982593
check_part_i386 4 type 61: no test
3 * Sys=2B 113201 29 24 147074 114 59 544175136
2 * Sys=73 119380 132 62 153270 41 37 544437093
1 * Sys=4F 120527 49 53 234813 237 34 1836016416
4 * SpeedStor 177063 118 26 177066 225 63 54974
TestDisk exited normally.