Is there any hope in getting back my data?
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Is there any hope in getting back my data?
Mon Jan 19 20:36:39 2015
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239502098432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000397884928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1500298346496
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:X3DPP40YT, FW:AX001C
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD3, S/N:1347095AE1A1, FW:MU03
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78XQAK, FW:0143
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST315003 41AS, S/N:9344EFFFFFFF
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Desktop, S/N:2GHKBBPP, FW:0130
Partition table type (auto): Intel
Disk /dev/sdd - 1500 GB / 1397 GiB - ST315003 41AS
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open inode: Input/output error.
repair_MFT
NTFS at 0/32/33
ntfs_readdir failed for cluster 5
NTFS listing using MFT:
Directory /
5 dr-xr-xr-x 0 0 0 17-Jan-2015 02:45 .
5 dr-xr-xr-x 0 0 0 17-Jan-2015 02:45 ..
14984 dr-xr-xr-x 0 0 0 30-Nov-2010 22:39 H_Blog
NTFS filesystem need to be repaired.
ntfs_dir: ntfs_inode_open failed
Don't fix MFT mirror.
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
Any comments or guidance on what to do next will be much appreciated. Thanks in advance.
Elmer
- cgrenier
- Site Admin
- Posts: 5438
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Is there any hope in getting back my data?
The partition table is ok but the MFT is corrupted.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
Re: Is there any hope in getting back my data?
Hi, thanks for the reply. After running chkdsk /f as suggested, the result is still the same: meaning most of my files are still 0 byte in size. I ran another "deeper search" and the following is the log:cgrenier wrote:The partition table is ok but the MFT is corrupted.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)
-------------------------------------------------------------------------------------------------------------------------------------
Wed Jan 21 21:01:52 2015
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239502098432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000397884928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8002732032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1500298346496
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:X3DPP40YT, FW:AX001C
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD3, S/N:1347095AE1A1, FW:MU03
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78XQAK, FW:0143
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST315003 41AS, S/N:9344EFFFFFFF
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Desktop, S/N:2GHKBBPP, FW:0130
Disk /dev/sdf - 8004 MB / 7633 MiB - CHS 973 255 63, sector size=512 - SanDisk Cruzer Glide, S/N:4C532000020926104521, FW:1.26
Partition table type (auto): Intel
Disk /dev/sdd - 1500 GB / 1397 GiB - ST315003 41AS
Partition table type: Intel
Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument
Results
* HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
interface_write()
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
- Attachments
-
- "Unrecoverable" partition 1
- AfterDeeperSearch1.PNG (15.6 KiB) Viewed 2791 times
-
- "Unrecoverable" partition 2
- AfterDeeperSearch2.PNG (13.76 KiB) Viewed 2791 times
-
- "Unrecoverable" partition 3
- AfterDeeperSearch3.PNG (13.85 KiB) Viewed 2791 times
Re: Is there any hope in getting back my data?
Ok then, I guess there's no more hope in recovering my data...thanks anyway for the help.
-
- Posts: 75
- Joined: 18 Dec 2014, 10:44
Re: Is there any hope in getting back my data?
If you can see your files wiht testdisk you would rather save them with knoppix live-dvd. its much easier and quicker. try it out. nothing can be destroyed.
http://forum.cgsecurity.org/phpBB3/back ... t4690.html
if not successful try to restore with phototec.
http://forum.cgsecurity.org/phpBB3/back ... t4690.html
if not successful try to restore with phototec.