
I tried analyzing it with Testdisk and after I got the
Code: Select all
warning: number of heads/cylinders 240 (NTFS) != 255 (HD)
This is the current state of TestDisk

Any ideas what to do next?
Code: Select all
warning: number of heads/cylinders 240 (NTFS) != 255 (HD)
Code: Select all
Fri Jan 08 16:40:14 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=63496519680
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=375703732224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=624497262592
Hard disk list
Disk \\.\PhysicalDrive0 - 64 GB / 59 GiB - CHS 124053 16 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 63 GB / 59 GiB - CHS 123032 16 63, sector size=512
Drive H: - 375 GB / 349 GiB - CHS 45676 255 63, sector size=512
Drive I: - 624 GB / 581 GiB - CHS 75924 255 63, sector size=512
Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=240 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 60801 48 31 976771057
No partition is bootable
search_part()
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 31870/166/41
heads/cylinder 240 (NTFS) != 255 (HD)
filesystem size 976766976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 31870 166 41 92671 149 22 976766976
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=512002048, size=976766976, end=1488769023, disk end=976773168)
Disk \\.\PhysicalDrive2 - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 762 GB / 709 GiB)
The following partition can't be recovered:
HPFS - NTFS 31870 166 41 92671 149 22 976766976
NTFS, blocksize=4096, 500 GB / 465 GiB
Results
Can't open backup.log file: No such file or directory
interface_load
interface_write()
No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Code: Select all
Mon Jan 11 12:24:56 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=2002780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=64023257088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2002780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=63496519680
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000204845056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2002780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000200994816
Hard disk list
Disk /dev/sda - 64 GB / 59 GiB - CHS 124053 16 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sde - 2002 MB / 1910 MiB - CHS 243 255 63, sector size=512
Drive C: - 63 GB / 59 GiB - CHS 123032 16 63, sector size=512
Drive E: - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive I: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Partition table type (auto): Intel
Disk /dev/sdc - 500 GB / 465 GiB
Partition table type: Intel
Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=240 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 60801 48 31 976771057
No partition is bootable
search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 31870/166/41
heads/cylinder 240 (NTFS) != 255 (HD)
filesystem size 976766976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 31870 166 41 92671 149 22 976766976
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=512002048, size=976766976, end=1488769023, disk end=976773168)
file_pread(6,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(6,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(6,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(6,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(6,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(6,13,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(6,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(6,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(6,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(6,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(6,2,buffer,976777215(60801/145/16)) lseek err Invalid argument
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 762 GB / 709 GiB)
The following partition can't be recovered:
HPFS - NTFS 31870 166 41 92671 149 22 976766976
NTFS, blocksize=4096, 500 GB / 465 GiB
Results
interface_write()
No partition found or selected for recovery