Disque 3to qui passe en RAW

Comment utiliser TestDisk pour récupérer une partition perdue
Post Reply
Message
Author
staf
Posts: 9
Joined: 25 Aug 2014, 16:59

Disque 3to qui passe en RAW

#1 Post by staf » 25 Aug 2014, 17:19

Bonjour,

Suite à un plantage d'un poste et un hard reboot, mon dd WD 3to est passé en RAW. La lettre est toujours assigné, et bien sur il me demande de le formater.

Juste pour préciser, le poste en sous windows 2008 R2, je n'ai pas pu le formater sous windows ( même en gpt il reconnaissait que 7xx go), j'ai du passé par gparted. Le disque à 2 mois.

J'ai lancé un testdisk/quicksearch, voici le résultat:

Image

Voici le log:

Code: Select all


Sat Aug 23 20:38:33 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, August 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 2008 R2 (7601) SP1
Compiler: GCC 4.8, MinGW 3.11
Compilation date: Aug 20 2014 21:37:49
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=801569726464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=31453470720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=31453438464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=339275776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=94371840000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=209715200000
filewin32_getfilesize(\\.\I:) GetFileSize err Fonction incorrecte.


filewin32_setfilepointer(\\.\I:) SetFilePointer err Fonction incorrecte.


Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=250057064448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=3000591450112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\U:)=2000396746752
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 969021 16 63, sector size=512
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 3876021 16 63, sector size=512
Disk \\.\PhysicalDrive2 - 250 GB / 232 GiB - CHS 484521 16 63, sector size=512
Disk \\.\PhysicalDrive3 - 801 GB / 746 GiB - CHS 1553140 16 63, sector size=512
Disk \\.\PhysicalDrive4 - 250 GB / 232 GiB - CHS 484521 16 63, sector size=512
Drive C: - 104 GB / 97 GiB - CHS 203174 16 63, sector size=512
Drive D: - 31 GB / 29 GiB - CHS 60945 16 63, sector size=512
Drive E: - 31 GB / 29 GiB - CHS 60944 16 63, sector size=512
Drive F: - 339 MB / 323 MiB - CHS 80 64 32, sector size=2048
Drive G: - 94 GB / 87 GiB - CHS 182857 16 63, sector size=512
Drive H: - 209 GB / 195 GiB - CHS 406349 16 63, sector size=512
Drive P: - 250 GB / 232 GiB - CHS 484516 16 63, sector size=512
Drive S: - 3000 GB / 2794 GiB - CHS 5814018 16 63, sector size=512
Drive U: - 2000 GB / 1863 GiB - CHS 3876016 16 63, sector size=512

Partition table type default to None
Drive S: - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Analyse Drive S: - 3000 GB / 2794 GiB - CHS 5814018 16 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Drive S: - 3000 GB / 2794 GiB - CHS 5814018 16 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

Analyse Drive S: - 3000 GB / 2794 GiB - CHS 5814018 16 63
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.

search_part()
Drive S: - 3000 GB / 2794 GiB - CHS 5814018 16 63
check_FAT: Bad jump in FAT partition

cramfs Marker at 332455/13/42

recover_cramfs
     MS Data                335115500  342380137    7264637 [~$`°Ç§üjŠ¨òê7Ão]
     cramfs, 3719 MB / 3547 MiB

HFS magic value at 632855/11/53
part_size 35790850
     Mac HFS                637918585  673709434   35790850
     HFS blocksize=2097152, 18 GB / 17 GiB

HFS magic value at 669166/0/45
part_size 9472002
     Mac HFS                674519372  683991373    9472002
     HFS blocksize=524288, 4849 MB / 4625 MiB

HFS magic value at 819110/6/58
part_size 35790850
     Mac HFS                825663315  861454164   35790850
     HFS blocksize=2097152, 18 GB / 17 GiB

HFS magic value at 1000111/9/44
part_size 2236930
     Mac HFS               1008112498 1010349427    2236930
     HFS blocksize=131072, 1145 MB / 1092 MiB

HFS magic value at 1113118/13/35
part_size 34954
     Mac HFS               1122023797 1122058750      34954
     HFS blocksize=2048, 17 MB / 17 MiB

HFS magic value at 1120190/1/9
part_size 139810
     Mac HFS               1129151591 1129291400     139810
     HFS blocksize=8192, 71 MB / 68 MiB

HFS magic value at 1120916/5/9
part_size 8947714
     Mac HFS               1129883651 1138831364    8947714
     HFS blocksize=524288, 4581 MB / 4369 MiB

HFS magic value at 1155164/10/1
part_size 8740
     Mac HFS               1164405942 1164414681       8740
     HFS blocksize=512, 4474 KB / 4370 KiB

HFS magic value at 1156540/5/60
part_size 559234
     Mac HFS               1165792694 1166351927     559234
     HFS blocksize=32768, 286 MB / 273 MiB

SYSV4 Marker at 1221191/7/46

recover_sysv4
     Unknown               1230961014 1230961013          0 [«##]
     SysV4, 0 B
Partition not added.

HFS magic value at 1462054/1/12
part_size 143163394
     Mac HFS               1473750506 1616913899  143163394
     HFS blocksize=8388608, 73 GB / 68 GiB

cramfs Marker at 1659147/1/7

recover_cramfs
     MS Data               1672420245 1675732351    3312106 [i±nÕÃ%Hlø¡¬Åh]
     cramfs, 1695 MB / 1617 MiB

HFS magic value at 1725234/9/1
part_size 285802498
     Mac HFS               1739036439 2024838936  285802498
     HFS blocksize=8388608, 146 GB / 136 GiB
check_FAT: Bad number of sectors per cluster

HFS magic value at 2255234/2/33
part_size 143163394
     Mac HFS               2273276030 2416439423  143163394
     HFS blocksize=8388608, 73 GB / 68 GiB

HFS magic value at 2478545/2/33
part_size 572653570
     Mac HFS               2498373518 3071027087  572653570
     HFS blocksize=33554432, 293 GB / 273 GiB

HFS magic value at 3165717/13/6
part_size 139810
     Mac HFS               3191043560 3191183369     139810
     HFS blocksize=8192, 71 MB / 68 MiB

HFS magic value at 3166113/8/42
part_size 2290614274
     Mac HFS               3191442449 5482056722 2290614274
     HFS blocksize=134217728, 1172 GB / 1092 GiB

SYSV4 Marker at 5482071/11/50

recover_sysv4
     Unknown               5525928310 5525928309          0 [«##]
     SysV4, 0 B
Partition not added.

HFS magic value at 5722934/5/16
part_size 143163394
     Mac HFS               5768717802 5911881195  143163394
     HFS blocksize=8388608, 73 GB / 68 GiB
This partition ends after the disk limits. (start=5768717802, size=143163394, end=5911881195, disk end=5860530176)

HFS magic value at 5722934/5/18
part_size 143163394
     Mac HFS               5625554412 5768717805  143163394
     HFS found using backup sector!, 73 GB / 68 GiB

HFS magic value at 5726452/9/9
part_size 143163394
     Mac HFS               5772264191 5915427584  143163394
     HFS blocksize=8388608, 73 GB / 68 GiB
This partition ends after the disk limits. (start=5772264191, size=143163394, end=5915427584, disk end=5860530176)

HFS magic value at 5726452/9/11
part_size 143163394
     Mac HFS               5629100801 5772264194  143163394
     HFS found using backup sector!, 73 GB / 68 GiB
     Unknown               5832056768 5965599162  133542395
     FATX, 68 GB / 63 GiB
Partition not added.
file_win32_pread(140,11,buffer,
Et quelques infos en plus que m'as donné gdisk
sous gparted (via systemrescuecd) , unallocated,
partition/information : warning, the backup GPT table is corrupt, but the primary appears ok, so that will be used.Not all of the space available to /dev/sdd appears to be used, you can fix the GPT to use all of the space (an extra 4294967296 blocks) or continue with the current setting?
Unable to satisfy all constraints on the partition ...

gdisk /dev/sdd
p (print the partition table) donne : 0700 , donc le bon code de partition..( avec un start sector 2048 et un end à 58xxxxxxx , done une grosse partition, ce qui m'as l'air bon)

J'ai beau testé 'r' (recovery options), puis d, ou e, ça fait rien..
Et pour finir, getdataback (analyse complète) me retrouve seulement 4-5 fichiers, j'ai lancé photorec 2mn il m'en a retrouvé aussi 3-4.

Mais j'aimerais bien essayé de retrouver la partition avec tout les fichiers (et leurs noms!), avant de passer à photorec, vu que je n'ai pas un disque de taille égale, il va falloir que je branche plein de petit disque, les passer en jbod, je suis même pas sur d'arriver à la bonne taille, sans compter les jours de boulot pour tout renommer.

Je pense avoir tout détaille, pour l'instant je laisse testdisk comme sur le screen d'en haut, mais vu qu'il voit une partition Mac HFS au lieu de NTFS, j'ai des doutes pour la suite..

En vous remerciant par avance ;)

Staf

Sponsored links

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests