cgsecurity.org

Hi - I'm brand newbie here. I'm facing what I'm sure plenty here are/have faced in trying to repair a drive that is now RAW. I'm in hopes for help going through the delicate minefield of the drive to get it back to a working state. here are a couple screenshots showing disk mgr and what TestDisk is saying so far. Thanks in advance for looking at this and any help given. much appreciated - Shep


This is what D: looked like before the RAW state

And how the drives look now.

Run TestDisk, select the physical disk containing D: (not D: itself). Confirm the partition table type, probably PC/Intel.
Choose Advanced, Boot, RebuildBS, List. If you can see your files, choose Write and confirm, Quit.
If you have problem, please copy and paste the testdisk.log file content.

Being a Win 10 user, which version should I run, please? Thanks much for your assistance.

This is where I was before hitting BOOT.
[img][IMG]http://i156.photobucket.com/albums/t19/ ... 0drive.png[/img][/img]

Before LIST.
[img][IMG]http://i156.photobucket.com/albums/t19/ ... 20list.png[/img][/img]


After LIST.
[img][IMG]http://i156.photobucket.com/albums/t19/ ... amaged.png[/img][/img]

My OS is Win 10...

Sun Dec 20 11:30:12 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, December 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=1000202043904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=998372278272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1002023419904
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-9YN162, S/N:Z1D07VHZ, FW:CC46
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 850 EVO 500GB, S/N:S21HNXAGB09157E, FW:EMT02B6Q
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST31000524AS, S/N:6VPJ7SPD, FW:JC4B
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-9YN162, S/N:Z1D0AQ2T, FW:CC9B
Disk \\.\PhysicalDrive4 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM 001-1CH164, S/N:4310FEDCBA9876543210, FW:CC26
Disk \\.\PhysicalDrive5 - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - Msft Virtual Disk, FW:1.0

Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - ST31000524AS
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
check_part_i386 3 type 27: no test
1 * HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 12 223 20 121543 209 58 1952394672
NTFS, blocksize=4096, 999 GB / 930 GiB
3 P Windows RE(store) 121543 219 21 121601 25 24 919552

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 12 223 19 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.

Can anyone help me with this, please? I'm in dire need to get to this drive. Thanks very much.

BTW - I got a message here about being a bot.I am not a bot. I've been on many forums for over a decade. I have no idea how this kind of thing happens. Am I being hacked?

Does the info from the log indicate whether anything can be done for my drive via test disk to return it from it's current RAW state? Thanks and Merry Christmas, Shep

I am sorry if I was in fact router hacked. I have fixed the issue.

I am still trying to get my Samples and win 7/win 10 C drive back from RAW state. Can you tell me anything I can do from my log, Christopher? Thanks very much, Shep



Sun Dec 27 18:59:36 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, December 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=7803174912
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500104691712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=999572897792
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=7802126336
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-9YN162, S/N:Z1D07VHZ, FW:CC46
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 850 EVO 500GB, S/N:S21HNXAGB09157E, FW:EMT02B6Q
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST31000524AS, S/N:6VPJ7SPD, FW:JC4B
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-9YN162, S/N:Z1D0AQ2T, FW:CC9B
Disk \\.\PhysicalDrive4 - 7803 MB / 7441 MiB - CHS 948 255 63, sector size=512 - USB Flash Memory, S/N:0E0DD700CE90, FW:PMAP

Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - ST1000DM003-9YN162
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 121524/155/40
1 P HPFS - NTFS 0 32 33 121524 155 39 1952290816
NTFS, blocksize=8192, 999 GB / 930 GiB
2 * HPFS - NTFS 121524 155 40 121600 247 55 1226752
NTFS, blocksize=4096, 628 MB / 599 MiB

ntfs_boot_sector
2 * HPFS - NTFS 121524 155 40 121600 247 55 1226752
NTFS, blocksize=4096, 628 MB / 599 MiB
NTFS at 121524/155/40
NTFS at 121524/155/40
filesystem size 1226752
sectors_per_cluster 8
mft_lcn 51114
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 51114
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 51114
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 1226752
sectors_per_cluster 8
mft_lcn 51114
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

ntfs_boot_sector
2 * HPFS - NTFS 121524 155 40 121600 247 55 1226752
NTFS, blocksize=4096, 628 MB / 599 MiB
NTFS at 121524/155/40
NTFS at 121524/155/40
filesystem size 1226752
sectors_per_cluster 8
mft_lcn 51114
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 121524 155 39 1952290816
NTFS, blocksize=8192, 999 GB / 930 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1952290816
sectors_per_cluster 16
mft_lcn 1
mftmirr_lcn 3
clusters_per_mft_record -10
clusters_per_index_record -12
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 1
ntfs_find_mft: mftmirr_lcn 3
ntfs_find_mft: sectors_per_cluster 16
ntfs_find_mft: mft_lcn 1
ntfs_find_mft: mftmirr_lcn 3
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 1952290816
sectors_per_cluster 16
mft_lcn 1
mftmirr_lcn 3
clusters_per_mft_record -10
clusters_per_index_record -12
Not an exFAT boot sector.

1 P HPFS - NTFS 0 32 33 121524 155 39 1952290816
NTFS, blocksize=8192, 999 GB / 930 GiB
Can't open filesystem. Filesystem seems damaged.
filesystem size 1952290816
sectors_per_cluster 16
mft_lcn 1
mftmirr_lcn 3
clusters_per_mft_record -10
clusters_per_index_record -12

Did you use TestDisk 64bit?
TestDisk 7.1WIP 32bit is recommended.
Can you repeat your diagnose and selecting Disk /dev/sd* (a, b. c, etc..) instead of a PhysicalDrive?
TestDisk Advanced would be only helpful when your partition in your partition table is correct.
Did you try to list your files?
Can you upload another snapshot of TestDisk / Analyse and your current partition structure (your current partition table)?

Fiona

I've had to do recovery of files so I can work. This drive is now in a USB3 docking station. It doesn't show up in testdisk. I'll have to move it back into the pc and try it tonight.

Normally, TestDisk supports USB 3 too.
I can't judge why your disk doesn't appear in your docking station?
Please let me know, did moving your disk back ino your PC internal work?

Fiona