please help me:File is missing

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
gengstergile
Posts: 1
Joined: 03 Dec 2012, 12:14

please help me:File is missing

#1 Post by gengstergile »

Hello,yesterdayi try to recover my corrupted disk,and then i dont remember what i did,the file inside my 'C' is missing and all left only 1 folder perflog.

if i am not mistaken,i choose analyse>quicksearch>write.
and the my file inside that partition is all gone,how do i recover it back because in testdisk undelete,it said that there is no deleted files. please help me,there is very important files on tht partition. :(

here is my log files,

Code: Select all


Mon Dec  3 19:05:02 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-11-23T18:11:40
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=160041885184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=160041885184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=125724262400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=374276620288
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=0
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=367001600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=80015523840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=79646687232
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000BEKT-75KA9T0, S/N:2020202057202d44585731383841353032303735, FW:01.01A01
Disk /dev/sdc - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD16 00BEVT-22ZCT0

Partition table type (auto): Intel
Disk /dev/sdc - 160 GB / 149 GiB - WDC WD16 00BEVT-22ZCT0
Partition table type: Intel

Analyse Disk /dev/sdc - 160 GB / 149 GiB - CHS 19457 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
heads/cylinder 4 (NTFS) != 255 (HD)
NTFS at 44/190/19
NTFS at 9728/0/1
heads/cylinder 4 (NTFS) != 255 (HD)
file_pread(5,4096,buffer,162571776(10119/159/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,162571832(10119/160/18)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Warning: number of heads/cylinder mismatches 4 (NTFS) != 255 (HD)
 1 * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
 2 P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
Warning: number of heads/cylinder mismatches 4 (NTFS) != 255 (HD)
 3 P HPFS - NTFS           9728   0  1 19455 254 63  156280320

search_part()
Disk /dev/sdc - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/32/33
heads/cylinder 4 (NTFS) != 255 (HD)
filesystem size           716800
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
     NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size           155559936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
     NTFS, blocksize=4096, 79 GB / 74 GiB
NTFS at 9728/0/1
heads/cylinder 4 (NTFS) != 255 (HD)
filesystem size           156280320
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,162571776(10119/159/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,162571832(10119/160/18)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS           9728   0  1 19455 254 63  156280320
     NTFS, blocksize=4096, 80 GB / 74 GiB
file_pread(5,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(5,15,buffer,312582145(19457/86/23)) lseek err Invalid argument
file_pread(5,3,buffer,312582160(19457/86/38)) lseek err Invalid argument
file_pread(5,3,buffer,312582207(19457/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,312582223(19457/87/38)) lseek err Invalid argument
file_pread(5,11,buffer,312582270(19457/88/22)) lseek err Invalid argument
file_pread(5,2,buffer,312584192(19457/118/54)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
     NTFS, blocksize=4096, 367 MB / 350 MiB
   P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
     NTFS, blocksize=4096, 79 GB / 74 GiB
   P HPFS - NTFS           9728   0  1 19455 254 63  156280320
     NTFS, blocksize=4096, 80 GB / 74 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
 2 P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
 3 P HPFS - NTFS           9728   0  1 19455 254 63  156280320
pread: Input/Output error
Failed to calculate number of free MFTs: Input/Output error.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
heads/cylinder 4 (NTFS) != 255 (HD)
NTFS at 44/190/19
NTFS at 9728/0/1
heads/cylinder 4 (NTFS) != 255 (HD)
file_pread(5,4096,buffer,162571776(10119/159/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,162571832(10119/160/18)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
 1 * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
     NTFS, blocksize=4096, 367 MB / 350 MiB
 2 P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
     NTFS, blocksize=4096, 79 GB / 74 GiB
 3 P HPFS - NTFS           9728   0  1 19455 254 63  156280320
     NTFS, blocksize=4096, 80 GB / 74 GiB
file_pread(5,16,buffer,7195200(447/224/34)) ReadFile Incorrect function.

file_pread(5,1,buffer,7195200(447/224/34)) ReadFile Data error (cyclic redundancy check).

NTFS filesystem need to be repaired.


dir_partition inode=5
 2 P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
     NTFS, blocksize=4096, 79 GB / 74 GiB
ntfs_readdir failed
Directory /
       5 dr-xr-xr-x     0      0         0  1-Dec-2012 23:39 .
       5 dr-xr-xr-x     0      0         0  1-Dec-2012 23:39 ..
      60 dr-xr-xr-x     0      0         0 26-Jul-2012 15:33 PerfLogs

Analyse Disk /dev/sdc - 160 GB / 149 GiB - CHS 19457 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
heads/cylinder 4 (NTFS) != 255 (HD)
NTFS at 44/190/19
NTFS at 9728/0/1
heads/cylinder 4 (NTFS) != 255 (HD)
file_pread(5,4096,buffer,162571776(10119/159/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,162571832(10119/160/18)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Warning: number of heads/cylinder mismatches 4 (NTFS) != 255 (HD)
 1 * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
 2 P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
Warning: number of heads/cylinder mismatches 4 (NTFS) != 255 (HD)
 3 P HPFS - NTFS           9728   0  1 19455 254 63  156280320

search_part()
Disk /dev/sdc - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/32/33
heads/cylinder 4 (NTFS) != 255 (HD)
filesystem size           716800
sectors_per_cluster       8
mft_lcn                   29866
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
     NTFS, blocksize=4096, 367 MB / 350 MiB
NTFS at 44/190/19
filesystem size           155559936
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
     NTFS, blocksize=4096, 79 GB / 74 GiB
NTFS at 9728/0/1
heads/cylinder 4 (NTFS) != 255 (HD)
filesystem size           156280320
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(5,4096,buffer,162571776(10119/159/25)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,162571832(10119/160/18)) ReadFile Data error (cyclic redundancy check).

NTFS: Can't read MFT
     HPFS - NTFS           9728   0  1 19455 254 63  156280320
     NTFS, blocksize=4096, 80 GB / 74 GiB
file_pread(5,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(5,1,buffer,312582144(19457/86/22)) lseek err Invalid argument
file_pread(5,15,buffer,312582145(19457/86/23)) lseek err Invalid argument
file_pread(5,3,buffer,312582160(19457/86/38)) lseek err Invalid argument
file_pread(5,3,buffer,312582207(19457/87/22)) lseek err Invalid argument
file_pread(5,8,buffer,312582223(19457/87/38)) lseek err Invalid argument
file_pread(5,11,buffer,312582270(19457/88/22)) lseek err Invalid argument
file_pread(5,2,buffer,312584192(19457/118/54)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
     NTFS, blocksize=4096, 367 MB / 350 MiB
   P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
     NTFS, blocksize=4096, 79 GB / 74 GiB
   P HPFS - NTFS           9728   0  1 19455 254 63  156280320
     NTFS, blocksize=4096, 80 GB / 74 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33    44 190 18     716800 [System Reserved]
 2 P HPFS - NTFS             44 190 19  9727 230 39  155559936 [Windows 8]
 3 P HPFS - NTFS           9728   0  1 19455 254 63  156280320



thank you
Top
User avatar
cgrenier
Site Admin
Posts: 5427
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: please help me:File is missing

#2 Post by cgrenier »

There are CRC errors due to bad sectors. You should clone your HD to a new empty one as described in
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk
Once it's done, remove the dmaaged disk and try to access/repair the clone.
Top
Locked

Return to “File undelete”