Photorec goes through the whole card and comes out with 0 files.
I am running Mavericks OS X, using the latest download for OS X Intel.
Here's the report.xml file:
Code: Select all
<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
<metadata
xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.0-WIP</version>
<build_environment>
<compiler>GCC 4.0</compiler>
<compilation_date>2014-06-17T18:21:04</compilation_date>
<library name='libext2fs' version='1.42.8'/>
<library name='libewf' version='20120504'/>
<library name='libjpeg' version='62'/>
<library name='libntfs' version='libntfs-3g'/>
</build_environment>
<execution_environment>
<os_sysname>Darwin</os_sysname>
<os_release>13.2.0</os_release>
<os_version>Darwin Kernel Version 13.2.0: Thu Apr 17 23:03:13 PDT 2014; root:xnu-2422.100.13~1/RELEASE_X86_64</os_version>
<host>macbookProDS.local</host>
<arch>x86_64</arch>
<uid>0</uid>
<start_time>2014-06-18T23:43:50-0600</start_time>
</execution_environment>
</creator>
<source>
<image_filename>/dev/disk1</image_filename>
<sectorsize>512</sectorsize>
<image_size>16089350144</image_size>
<volume>
<byte_runs>
<byte_run offset='0' img_offset='0' len='16089350144'/>
</byte_runs>
</volume>
</source>
<configuration>
</configuration>
</dfxml>
and testdisk log file:
Code: Select all
Thu Jun 19 09:05:27 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 13.2.0 (Darwin Kernel Version 13.2.0: Thu Apr 17 23:03:13 PDT 2014; root:xnu-2422.1
Compiler: GCC 4.0
Compilation date: 2014-06-17T18:21:04
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
User is not root!
Hard disk list
Disk /dev/disk2 - 1073 MB / 1024 MiB - 2097152 sectors (RO), sector size=512
Disk /dev/rdisk1 - 16 GB / 14 GiB - 31424512 sectors, sector size=512
Disk /dev/rdisk2 - 1073 MB / 1024 MiB - 2097152 sectors (RO), sector size=512
Partition table type default to EFI GPT
Disk /dev/rdisk1 - 16 GB / 14 GiB
Partition table type: Intel
Analyse Disk /dev/rdisk1 - 16 GB / 14 GiB - 31424512 sectors
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/rdisk1 - 16 GB / 14 GiB - 31424512 sectors
Results
interface_write()
No partition found or selected for recovery