cgsecurity.org

Tried to restore partition using testdisk but I think I have written the wrong partition as after doing so, my 1.5TB (which is around 98% full) became 250GB (the rest are unallocated according to Windows Disk Manager). So I "expanded" the allocation thinking that it will magically bring my files back, but didn't. Please note that the files seem to be there as well but most of them (around 90%) are 0 bytes in sizes. And every time I try to navigate to each folder I get this message as well: "The Recycle Bin on W:\ is corrupted. Do you want to empty the Recycle Bin for this drive?" Of course I always click No as I do not want to make matters worse. I have tried running testdisk again (deep search) and the following is the log:



Mon Jan 19 20:36:39 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239502098432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000397884928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1500298346496
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:X3DPP40YT, FW:AX001C
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD3, S/N:1347095AE1A1, FW:MU03
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78XQAK, FW:0143
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST315003 41AS, S/N:9344EFFFFFFF
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Desktop, S/N:2GHKBBPP, FW:0130

Partition table type (auto): Intel
Disk /dev/sdd - 1500 GB / 1397 GiB - ST315003 41AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open inode: Input/output error.
repair_MFT
NTFS at 0/32/33
ntfs_readdir failed for cluster 5
NTFS listing using MFT:
Directory /
5 dr-xr-xr-x 0 0 0 17-Jan-2015 02:45 .
5 dr-xr-xr-x 0 0 0 17-Jan-2015 02:45 ..
14984 dr-xr-xr-x 0 0 0 30-Nov-2010 22:39 H_Blog
NTFS filesystem need to be repaired.
ntfs_dir: ntfs_inode_open failed
Don't fix MFT mirror.

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

Any comments or guidance on what to do next will be much appreciated. Thanks in advance.

Elmer

The partition table is ok but the MFT is corrupted.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)

cgrenier wrote:The partition table is ok but the MFT is corrupted.
Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter)

Hi, thanks for the reply. After running chkdsk /f as suggested, the result is still the same: meaning most of my files are still 0 byte in size. I ran another "deeper search" and the following is the log:

-------------------------------------------------------------------------------------------------------------------------------------
Wed Jan 21 21:01:52 2015
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, May 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-05-20T10:35:40
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=8004304896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239502098432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000397884928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8002732032
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=1000202273280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=1500298346496
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA MQ01ABD100, S/N:X3DPP40YT, FW:AX001C
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - Crucial_CT240M500SSD3, S/N:1347095AE1A1, FW:MU03
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA78XQAK, FW:0143
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST315003 41AS, S/N:9344EFFFFFFF
Disk /dev/sde - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Seagate Desktop, S/N:2GHKBBPP, FW:0130
Disk /dev/sdf - 8004 MB / 7633 MiB - CHS 973 255 63, sector size=512 - SanDisk Cruzer Glide, S/N:4C532000020926104521, FW:1.26

Partition table type (auto): Intel
Disk /dev/sdd - 1500 GB / 1397 GiB - ST315003 41AS
Partition table type: Intel

Analyse Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

search_part()
Disk /dev/sdd - 1500 GB / 1397 GiB - CHS 182401 255 63
NTFS at 0/32/33
filesystem size 2930270208
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB
file_pread(7,2,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,1,buffer,2930277248(182401/82/18)) lseek err Invalid argument
file_pread(7,8,buffer,2930277376(182401/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,2930277504(182401/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,2930277632(182401/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,2930277760(182401/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,2930277888(182401/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,2930278016(182401/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,2930278144(182401/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,2930278272(182401/98/34)) lseek err Invalid argument
file_pread(7,1,buffer,2930278399(182401/100/35)) lseek err Invalid argument
file_pread(7,1,buffer,2930278400(182401/100/36)) lseek err Invalid argument
file_pread(7,14,buffer,2930278401(182401/100/37)) lseek err Invalid argument
file_pread(7,3,buffer,2930278415(182401/100/51)) lseek err Invalid argument
file_pread(7,3,buffer,2930278462(182401/101/35)) lseek err Invalid argument
file_pread(7,8,buffer,2930278478(182401/101/51)) lseek err Invalid argument
file_pread(7,11,buffer,2930278525(182401/102/35)) lseek err Invalid argument
file_pread(7,2,buffer,2930280447(182401/133/4)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 182401 3 2 2930270208
NTFS, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 182401 3 2 2930270208

Ok then, I guess there's no more hope in recovering my data...thanks anyway for the help.

If you can see your files wiht testdisk you would rather save them with knoppix live-dvd. its much easier and quicker. try it out. nothing can be destroyed.
http://forum.cgsecurity.org/phpBB3/back ... t4690.html
if not successful try to restore with phototec.