In short, I updated my ASUS BIOS, and 2 of my 4 disks were removed from my Intel RAID5 array. The array was not a boot drive. I was using it simply as a data drive. I deleted the array and recreated it identically to the previous array, and am hoping to use TestDisk to make this disk available to Windows 7 64-bit again.
When I run TestDisk, it successfully discovers a partition on the array, and I am able to browse and see all of my files. However, when I write the data to the drive, Windows still can't see the files. When I go back into TestDisk, the partition information that I requested it to write didn't appear to write. Hopefully, you will be able to give me some pointers from the log file.
Thanks for the help.
richard
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed May 1 00:37:50 2013
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=512107741184
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199023255040
file_pread(4,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - M4-CT512M4SSD2, S/N:3030303030303030323133333930333141453931, FW:000F
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63, sector size=512 - Intel Raid 5 Volume, S/N:DataDrive, FW:1.0.
Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 5 Volume
Partition table type: Intel
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 3130871808 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 3130871808 > partition 4294967295
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,1,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,7,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,8,buffer,3131138056(729603/7/13)) lseek err Invalid argument
file_pread(5,3,buffer,3131138064(729603/7/21)) lseek err Invalid argument
file_pread(5,3,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,8,buffer,3131138127(729603/8/21)) lseek err Invalid argument
file_pread(5,11,buffer,3131138174(729603/9/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131140096(729603/39/37)) lseek err Invalid argument
Results
* HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
dir_partition inode=5
P HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
Directory /
5 dr-xr-xr-x 0 0 0 29-Apr-2013 12:38 .
5 dr-xr-xr-x 0 0 0 29-Apr-2013 12:38 ..
149 dr-xr-xr-x 0 0 0 6-Nov-2012 00:50 $RECYCLE.BIN
27323 -r--r--r-- 0 0 592208 11-Sep-2009 18:22 install.exe
27549 -r--r--r-- 0 0 659 11-Sep-2009 18:16 install.ini
27450 -r--r--r-- 0 0 32096 11-Sep-2009 18:22 install.res.1028.dll
27530 -r--r--r-- 0 0 53072 11-Sep-2009 18:22 install.res.1031.dll
27531 -r--r--r-- 0 0 47456 11-Sep-2009 18:22 install.res.1033.dll
27533 -r--r--r-- 0 0 53600 11-Sep-2009 18:22 install.res.1036.dll
27534 -r--r--r-- 0 0 52064 11-Sep-2009 18:22 install.res.1040.dll
27535 -r--r--r-- 0 0 37728 11-Sep-2009 18:22 install.res.1041.dll
27536 -r--r--r-- 0 0 36192 11-Sep-2009 18:22 install.res.1042.dll
27537 -r--r--r-- 0 0 49488 11-Sep-2009 18:22 install.res.1049.dll
27324 -r--r--r-- 0 0 31584 11-Sep-2009 18:22 install.res.2052.dll
27532 -r--r--r-- 0 0 52576 11-Sep-2009 18:22 install.res.3082.dll
27354 dr-xr-xr-x 0 0 0 28-Jan-2013 23:20 msdownld.tmp
35 dr-xr-xr-x 0 0 0 29-Apr-2013 17:22 System Volume Information
39 dr-xr-xr-x 0 0 0 5-Nov-2012 22:47 Users
27136 -r--r--r-- 0 0 5686 7-Nov-2007 08:00 vcredist.bmp
27137 -r--r--r-- 0 0 1442522 7-Nov-2007 08:09 VC_RED.cab
27135 -r--r--r-- 0 0 232960 7-Nov-2007 08:12 VC_RED.MSI
27342 -r--r--r-- 0 0 2073703 19-Mar-2010 19:55 VS_EXPBSLN_x64_enu.CAB
27343 -r--r--r-- 0 0 551424 19-Mar-2010 19:58 VS_EXPBSLN_x64_enu.MSI
27539 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1028.txt
27540 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1031.txt
27541 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1033.txt
27543 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1036.txt
27544 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1040.txt
27545 -r--r--r-- 0 0 9558 11-Sep-2009 18:16 eula.1041.txt
27546 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1042.txt
27547 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1049.txt
27538 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.2052.txt
27542 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.3082.txt
27548 -r--r--r-- 0 0 586 11-Sep-2009 18:16 globdata.ini
interface_write()
1 P HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 16/113/34
Error: size boot_sector 3130871808 > partition 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Error: size boot_sector 3130871808 > partition 4294967295
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729604 255 63
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138076(729603/7/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,1,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131138139(729603/8/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139651(729603/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,3131139714(729603/33/33)) lseek err Invalid argument
file_pread(5,7,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,8,buffer,3131138056(729603/7/13)) lseek err Invalid argument
file_pread(5,3,buffer,3131138064(729603/7/21)) lseek err Invalid argument
file_pread(5,3,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,8,buffer,3131138127(729603/8/21)) lseek err Invalid argument
file_pread(5,11,buffer,3131138174(729603/9/5)) lseek err Invalid argument
file_pread(5,2,buffer,3131140096(729603/39/37)) lseek err Invalid argument
Results
* HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
interface_write()
1 * HPFS - NTFS 16 113 34 729602 229 35 11720806400 [Data Drive]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Win7-64 Intel RAID5 Recovery
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Re: Win7-64 Intel RAID5 Recovery
A bit of additional info. Here's what Windows 7 is seeing in Disk Management
Disk 1: Basic: 5589.04 GB: Online
129MB Unallocated
(E:) 2048.00 GB RAW Healthy (Primary Partition)
3540.92 GB Unallocated
Disk 1: Basic: 5589.04 GB: Online
129MB Unallocated
(E:) 2048.00 GB RAW Healthy (Primary Partition)
3540.92 GB Unallocated
Re: Win7-64 Intel RAID5 Recovery
129 unallocated was probably a MS Reserved partition?
You MS Data-partition should be your important partition containing your data.
It's still displayed in your GUID-partition table.
Would it be possible to make a boot sector diagnose to check are your data are listed or an error message?
Start TestDisk, confirm at create a log with enter and select your affected disk/RAID.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
If your partition is listed as "Unknown" you can use the menu List to add your previous file system (partition type probably NTFS?) to your partition.
Afterwards, the menu Boot becomes available.
Confirm at Boot.
If you're able to list your files, you can either copy/backup your files using testdisk to another disk or write your boot sector at write.
Otherwise;
Highlight Rebuild BS and hit Enter.
Rebuild BS will be in progress.
Normally, it takes some minutes.
If you see the menu List, please highlight it and press enter.
If you see your data, you can copy your data or write your boot sector.
Fiona
You MS Data-partition should be your important partition containing your data.
It's still displayed in your GUID-partition table.
Would it be possible to make a boot sector diagnose to check are your data are listed or an error message?
Start TestDisk, confirm at create a log with enter and select your affected disk/RAID.
Confirm at partition table type with enter also
Don't confirm at Analyse but Advanced.
If your partition is listed as "Unknown" you can use the menu List to add your previous file system (partition type probably NTFS?) to your partition.
Afterwards, the menu Boot becomes available.
Confirm at Boot.
If you're able to list your files, you can either copy/backup your files using testdisk to another disk or write your boot sector at write.
Otherwise;
Highlight Rebuild BS and hit Enter.
Rebuild BS will be in progress.
Normally, it takes some minutes.
If you see the menu List, please highlight it and press enter.
If you see your data, you can copy your data or write your boot sector.
Fiona
Re: Win7-64 Intel RAID5 Recovery
Fiona,
Thanks for the reply. I think I'm getting closer! One problem was that I was selecting Intel instead of GPT for the partition type. I have since selected GPT and verified that the boot sectors are ok and that I can list the files in TestDisk. I have written the partition table, but there still appears to be some cleanup remaining.
Windows is now showing three partitions for this Disk:
(E:) 100 MB RAW Healthy (Primary Partition)
26 MB Unallocated
Data Drive (F:) 5588.92 GB NTFS Healthy (Primary Partition)
I can read all of my data within Windows on the F: drive! This is progress!
Before the mess occurred, however, there was just one drive (the current F: was my E:). I'm attaching the latest log file after doing a Deeper Search to ask for more advice about cleaning up these two smaller bits of disk space.
Thanks for the help!
richard
Thanks for the reply. I think I'm getting closer! One problem was that I was selecting Intel instead of GPT for the partition type. I have since selected GPT and verified that the boot sectors are ok and that I can list the files in TestDisk. I have written the partition table, but there still appears to be some cleanup remaining.
Windows is now showing three partitions for this Disk:
(E:) 100 MB RAW Healthy (Primary Partition)
26 MB Unallocated
Data Drive (F:) 5588.92 GB NTFS Healthy (Primary Partition)
I can read all of my data within Windows on the F: drive! This is progress!
Before the mess occurred, however, there was just one drive (the current F: was my E:). I'm attaching the latest log file after doing a Deeper Search to ask for more advice about cleaning up these two smaller bits of disk space.
Thanks for the help!
richard
Code: Select all
Fri May 3 13:23:27 2013
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=512107741184
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=6001052876800
file_pread(4,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - M4-CT512M4SSD2, S/N:3030303030303030323133333930333141453931, FW:000F
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63, sector size=512 - Intel Raid 5 Volume, S/N:DataDrive, FW:1.0.
Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 5 Volume
Partition table type: EFI GPT
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721072639 (expected 11721072639)
hdr_lba_start=34
hdr_lba_end=11721072606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 6400 211199 204800
2 P MS Data 264192 11721070591 11720806400 [Data Drive]
search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
NTFS at 0/101/38
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,1,buffer,3131138051(729603/7/8)) lseek err Invalid argument
file_pread(5,1,buffer,3131138052(729603/7/9)) lseek err Invalid argument
file_pread(5,1,buffer,3131138053(729603/7/10)) lseek err Invalid argument
file_pread(5,1,buffer,3131138054(729603/7/11)) lseek err Invalid argument
...
{snip lots of these errors}
...
file_pread(5,1,buffer,3131138062(729603/7/19)) lseek err Invalid argument
file_pread(5,1,buffer,3131138065(729603/7/22)) lseek err Invalid argument
file_pread(5,1,buffer,3131138112(729603/8/6)) lseek err Invalid argument
file_pread(5,1,buffer,3131138133(729603/8/27)) lseek err Invalid argument
file_pread(5,1,buffer,3131138183(729603/9/14)) lseek err Invalid argument
file_pread(5,1,buffer,3131140096(729603/39/37)) lseek err Invalid argument
file_pread(5,1,buffer,3131138063(729603/7/20)) lseek err Invalid argument
file_pread(5,1,buffer,3131138066(729603/7/23)) lseek err Invalid argument
file_pread(5,1,buffer,3131138113(729603/8/7)) lseek err Invalid argument
file_pread(5,1,buffer,3131138134(729603/8/28)) lseek err Invalid argument
file_pread(5,1,buffer,3131138184(729603/9/15)) lseek err Invalid argument
file_pread(5,1,buffer,3131140097(729603/39/38)) lseek err Invalid argument
Results
P MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
P MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
interface_write()
1 P MS Data 6400 211199 204800
2 P MS Data 264192 11721070591 11720806400 [Data Drive]
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
NTFS at 0/101/38
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=3276800, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/101/38
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
NTFS at 8/37/6
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=66998272, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 8/37/6
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 130856 335655 204800
NTFS, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=6001052876800, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
Search for partition aborted
Results
MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
MS Data 130856 335655 204800
NTFS, 104 MB / 100 MiB
MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.
MS Data 130856 335655 204800
NTFS, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.
dir_partition inode=5
MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
Directory /
5 dr-xr-xr-x 0 0 0 3-May-2013 13:20 .
5 dr-xr-xr-x 0 0 0 3-May-2013 13:20 ..
149 dr-xr-xr-x 0 0 0 6-Nov-2012 00:50 $RECYCLE.BIN
27323 -r--r--r-- 0 0 592208 11-Sep-2009 18:22 install.exe
27549 -r--r--r-- 0 0 659 11-Sep-2009 18:16 install.ini
27450 -r--r--r-- 0 0 32096 11-Sep-2009 18:22 install.res.1028.dll
27530 -r--r--r-- 0 0 53072 11-Sep-2009 18:22 install.res.1031.dll
27531 -r--r--r-- 0 0 47456 11-Sep-2009 18:22 install.res.1033.dll
27533 -r--r--r-- 0 0 53600 11-Sep-2009 18:22 install.res.1036.dll
27534 -r--r--r-- 0 0 52064 11-Sep-2009 18:22 install.res.1040.dll
27535 -r--r--r-- 0 0 37728 11-Sep-2009 18:22 install.res.1041.dll
27536 -r--r--r-- 0 0 36192 11-Sep-2009 18:22 install.res.1042.dll
27537 -r--r--r-- 0 0 49488 11-Sep-2009 18:22 install.res.1049.dll
27324 -r--r--r-- 0 0 31584 11-Sep-2009 18:22 install.res.2052.dll
27532 -r--r--r-- 0 0 52576 11-Sep-2009 18:22 install.res.3082.dll
27354 dr-xr-xr-x 0 0 0 28-Jan-2013 23:20 msdownld.tmp
35 dr-xr-xr-x 0 0 0 29-Apr-2013 17:22 System Volume Information
39 dr-xr-xr-x 0 0 0 5-Nov-2012 22:47 Users
27136 -r--r--r-- 0 0 5686 7-Nov-2007 08:00 vcredist.bmp
27137 -r--r--r-- 0 0 1442522 7-Nov-2007 08:09 VC_RED.cab
27135 -r--r--r-- 0 0 232960 7-Nov-2007 08:12 VC_RED.MSI
27342 -r--r--r-- 0 0 2073703 19-Mar-2010 19:55 VS_EXPBSLN_x64_enu.CAB
27343 -r--r--r-- 0 0 551424 19-Mar-2010 19:58 VS_EXPBSLN_x64_enu.MSI
27539 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1028.txt
27540 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1031.txt
27541 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1033.txt
27543 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1036.txt
27544 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1040.txt
27545 -r--r--r-- 0 0 9558 11-Sep-2009 18:16 eula.1041.txt
27546 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1042.txt
27547 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.1049.txt
27538 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.2052.txt
27542 -r--r--r-- 0 0 20716 11-Sep-2009 18:16 eula.3082.txt
27548 -r--r--r-- 0 0 586 11-Sep-2009 18:16 globdata.ini
interface_write()
No partition found or selected for recovery
simulate write!
TestDisk exited normally.
Re: Win7-64 Intel RAID5 Recovery
Here's what Disk Management looks like
Re: Win7-64 Intel RAID5 Recovery
Ok, so, after doing some research online, I noticed that these GPT disks are supposed to have a 32- or 128-MB Microsoft Reserved partition at the beginning of the disk depending on size. For me, it's 128-MB.
So, I deleted the MS Data partition at the beginning of the disk (spanned 100 MB from 6400 - 211199), and Added an MS Reserved / NTFS partition beginning at sector(?) 1 and ending just before my true MS Data partition began. Something like this:
MS Reserved 1 - 264191
MS Data 264192 - 11720806400
Then I wrote that to the disk and rebooted.
Voila! It worked! The worst-case scenario had happened: two out of four disks in a RAID5 array had been booted from the array, and I've been able to recover everything. Zero loss.
These are links that helped me immensely:
http://msdn.microsoft.com/en-us/library ... 63525.aspx
http://technet.microsoft.com/en-us/libr ... s.10).aspx
http://support.microsoft.com/kb/302873
Also, thanks to the crew here supporting TestDisk. In addition to the software itself allowing me to write these partition tables, I read tons of material here that educated me about the latest partition technology being used and was able to "ask" better questions of the internet to find what I needed. Thanks again!
richard
So, I deleted the MS Data partition at the beginning of the disk (spanned 100 MB from 6400 - 211199), and Added an MS Reserved / NTFS partition beginning at sector(?) 1 and ending just before my true MS Data partition began. Something like this:
MS Reserved 1 - 264191
MS Data 264192 - 11720806400
Then I wrote that to the disk and rebooted.
Voila! It worked! The worst-case scenario had happened: two out of four disks in a RAID5 array had been booted from the array, and I've been able to recover everything. Zero loss.
These are links that helped me immensely:
http://msdn.microsoft.com/en-us/library ... 63525.aspx
http://technet.microsoft.com/en-us/libr ... s.10).aspx
http://support.microsoft.com/kb/302873
Also, thanks to the crew here supporting TestDisk. In addition to the software itself allowing me to write these partition tables, I read tons of material here that educated me about the latest partition technology being used and was able to "ask" better questions of the internet to find what I needed. Thanks again!
richard
Re: Win7-64 Intel RAID5 Recovery
Also, here's a copy of the log from the successful configuration / write. Just in case you guys see something else I need to take care of.
Code: Select all
Fri May 3 13:45:53 2013
Command line: TestDisk
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001189191680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=512107741184
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=6001052876800
file_pread(4,1,buffer,1000222964(62260/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - M4-CT512M4SSD2, S/N:3030303030303030323133333930333141453931, FW:000F
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63, sector size=512 - Intel Raid 5 Volume, S/N:DataDrive, FW:1.0.
Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - Intel Raid 5 Volume
Partition table type: EFI GPT
file_pread(5,1,buffer,3131153667(729603/254/63)) lseek err Invalid argument
Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721072639 (expected 11721072639)
hdr_lba_start=34
hdr_lba_end=11721072606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
2 P MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
1 P MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
NTFS at 0/101/38
filesystem size 204800 1
sectors_per_cluster 8 0
mft_lcn 8533 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_boot_sector
2 P MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_boot_sector
1 P MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
NTFS at 0/101/38
filesystem size 204800 1
sectors_per_cluster 8 0
mft_lcn 8533 0
mftmirr_lcn 2 0
clusters_per_mft_record -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=11721072639 (expected 11721072639)
hdr_lba_start=34
hdr_lba_end=11721072606
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 6400 211199 204800
2 P MS Data 264192 11721070591 11720806400 [Data Drive]
search_part()
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729603 255 63
NTFS at 0/101/38
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
NTFS at 16/113/34
filesystem size 11720806400
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
file_pread(5,2,buffer,3131138049(729603/7/6)) lseek err Invalid argument
file_pread(5,1,buffer,3131138051(729603/7/8))
lseek err Invalid argument
file_pread(5,1,buffer,3131138064(729603/7/21)) lseek err Invalid argument
file_pread(5,1,buffer,3131138111(729603/8/5)) lseek err Invalid argument
file_pread(5,8,buffer,3131138125(729603/8/19)) lseek err Invalid argument
file_pread(5,11,buffer,3131138172(729603/9/3)) lseek err Invalid argument
file_pread(5,1,buffer,3131138184(729603/9/15)) lseek err Invalid argument
file_pread(5,1,buffer,3131140097(729603/39/38)) lseek err Invalid argument
Results
P MS Data 6400 211199 204800
NTFS, 104 MB / 100 MiB
P MS Data 264192 11721070591 11720806400 [Data Drive]
NTFS, 6001 GB / 5588 GiB
gpt_change_part_type
Change partition type:
MS Reserved 1 264191 264191
Change partition type:
NTFS 1 264191 264191
P MS Reserved 1 264191 264191
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P MS Reserved 1 264191 264191
2 P MS Data 264192 11721070591 11720806400 [Data Drive]
write!
No extended partition
You will have to reboot for the change to take effect.
TestDisk exited normally.