Partition Truecrypt introuvable
Posted: 22 Mar 2016, 00:49
Bonjour
J'ai un DD de 3 To crypté intégralement avec Truecrypt (une seule partition). J'ai dû faire une déconnection hasardeuse car windows ne le reconnait plus (non alloué, disque "non initialisé") quand je le branche (rack SATA). Truecrypt trouve bien le volume cependant, mais le disque n'est pas accessible.
J'ai lancé Testdisk, y compris avec un deeper search mais j'ai du mal à analyser les résultats, j'ai l'impression que les partitions qu'il trouve sont trop petites pour correspondre la partition unique que je cherche. Ci-dessous le log (il s'agit du disque "physical drive4") . Quelqu'un pourrait-il y jeter un oeil sur ce log pour me dire s'il y a une chance que je récupère quelque chose?
Merci d'avance!
Tue Mar 01 07:42:23 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=78538342400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=41388343296
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500105457664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=320070483968
filewin32_getfilesize(\\.\I:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\I:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=320070221824
Hard disk list
Disk \\.\PhysicalDrive0 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Drive C: - 78 GB / 73 GiB - CHS 9548 255 63, sector size=512
Drive D: - 41 GB / 38 GiB - CHS 5031 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive H: - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive J: - 320 GB / 298 GiB - CHS 625137152 1 1, sector size=512
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
search_part()
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
check_FAT: Bad jump in FAT partition
Unknown 890463986 897323771 6859785
WBFS, 3512 MB / 3349 MiB
Partition not added.
Unknown 1133504597 314228898388 313095393792
WBFS, 160 TB / 145 TiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster
LVM magic value at 156789/99/6
LVM magic value at 206379/214/20
check_FAT: Bad number of sectors per cluster
Unknown 4025136548 5234965431 1209828884
FATX, 619 GB / 576 GiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 283145/50/5
recover_sysv4
Unknown 4548727579 10966036828954 10961488101376 [~ۂAK]
SysV4, 5612 TB / 5104 TiB
Partition not added.
LVM magic value at 302986/124/17
cramfs Marker at 363546/95/4
recover_cramfs
MS Data 5840372478 5844105629 3733151 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
file_win32_pread(480,11,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(480,11,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,8,buffer,1565565865(364801/80/57)) read err: read after end of file
file_win32_pread(480,3,buffer,1565565871(364801/80/63)) read err: read after end of file
file_win32_pread(480,8,buffer,1565565869(364801/80/61)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565860(364801/80/52)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565861(364801/80/53)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565868(364801/80/60)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565870(364801/80/62)) read err: read after end of file
Results
P MS Data 5840372478 5844105629 3733152 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
interface_write()
1 P MS Data 5840372478 5844105629 3733152 [PÀ¶(v™ù¶%kðFS]
search_part()
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
check_FAT: Bad jump in FAT partition
Unknown 890463986 897323771 6859785
WBFS, 3512 MB / 3349 MiB
Partition not added.
Unknown 1133504597 314228898388 313095393792
WBFS, 160 TB / 145 TiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster
LVM magic value at 156789/99/6
LVM magic value at 206379/214/20
check_FAT: Bad number of sectors per cluster
Unknown 4025136548 5234965431 1209828884
FATX, 619 GB / 576 GiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 283145/50/5
recover_sysv4
Unknown 4548727579 10966036828954 10961488101376 [~ۂAK]
SysV4, 5612 TB / 5104 TiB
Partition not added.
LVM magic value at 302986/124/17
cramfs Marker at 363546/95/4
recover_cramfs
MS Data 5840372478 5844105629 3733151 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
cramfs Marker at 363546/95/5
recover_cramfs
MS Data 5840372479 5844105630 3733151 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
file_win32_pread(480,11,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,8,buffer,1565565869(364801/80/61)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565860(364801/80/52)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565861(364801/80/53)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565868(364801/80/60)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565870(364801/80/62)) read err: read after end of file
Results
MS Data 5840372478 5844105629 3733152 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
MS Data 5840372479 5844105630 3733152 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
J'ai un DD de 3 To crypté intégralement avec Truecrypt (une seule partition). J'ai dû faire une déconnection hasardeuse car windows ne le reconnait plus (non alloué, disque "non initialisé") quand je le branche (rack SATA). Truecrypt trouve bien le volume cependant, mais le disque n'est pas accessible.
J'ai lancé Testdisk, y compris avec un deeper search mais j'ai du mal à analyser les résultats, j'ai l'impression que les partitions qu'il trouve sont trop petites pour correspondre la partition unique que je cherche. Ci-dessous le log (il s'agit du disque "physical drive4") . Quelqu'un pourrait-il y jeter un oeil sur ce log pour me dire s'il y a une chance que je récupère quelque chose?
Merci d'avance!
Tue Mar 01 07:42:23 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=78538342400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=41388343296
filewin32_getfilesize(\\.\E:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500105457664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=320070483968
filewin32_getfilesize(\\.\I:) GetFileSize err Fonction incorrecte.
filewin32_setfilepointer(\\.\I:) SetFilePointer err Fonction incorrecte.
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=320070221824
Hard disk list
Disk \\.\PhysicalDrive0 - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Drive C: - 78 GB / 73 GiB - CHS 9548 255 63, sector size=512
Drive D: - 41 GB / 38 GiB - CHS 5031 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive H: - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive J: - 320 GB / 298 GiB - CHS 625137152 1 1, sector size=512
Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB
Partition table type: EFI GPT
Analyse Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
2 P MS Data 264192 5860532223 5860268032 [Basic data partition]
search_part()
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
check_FAT: Bad jump in FAT partition
Unknown 890463986 897323771 6859785
WBFS, 3512 MB / 3349 MiB
Partition not added.
Unknown 1133504597 314228898388 313095393792
WBFS, 160 TB / 145 TiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster
LVM magic value at 156789/99/6
LVM magic value at 206379/214/20
check_FAT: Bad number of sectors per cluster
Unknown 4025136548 5234965431 1209828884
FATX, 619 GB / 576 GiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 283145/50/5
recover_sysv4
Unknown 4548727579 10966036828954 10961488101376 [~ۂAK]
SysV4, 5612 TB / 5104 TiB
Partition not added.
LVM magic value at 302986/124/17
cramfs Marker at 363546/95/4
recover_cramfs
MS Data 5840372478 5844105629 3733151 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
file_win32_pread(480,11,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(480,11,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,8,buffer,1565565865(364801/80/57)) read err: read after end of file
file_win32_pread(480,3,buffer,1565565871(364801/80/63)) read err: read after end of file
file_win32_pread(480,8,buffer,1565565869(364801/80/61)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565860(364801/80/52)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565861(364801/80/53)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565868(364801/80/60)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565870(364801/80/62)) read err: read after end of file
Results
P MS Data 5840372478 5844105629 3733152 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
interface_write()
1 P MS Data 5840372478 5844105629 3733152 [PÀ¶(v™ù¶%kðFS]
search_part()
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 364801 255 63
check_FAT: Bad jump in FAT partition
Unknown 890463986 897323771 6859785
WBFS, 3512 MB / 3349 MiB
Partition not added.
Unknown 1133504597 314228898388 313095393792
WBFS, 160 TB / 145 TiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad number of sectors per cluster
LVM magic value at 156789/99/6
LVM magic value at 206379/214/20
check_FAT: Bad number of sectors per cluster
Unknown 4025136548 5234965431 1209828884
FATX, 619 GB / 576 GiB
Partition not added.
check_FAT: Bad number of sectors per cluster
check_FAT: Bad jump in FAT partition
SYSV4 Marker at 283145/50/5
recover_sysv4
Unknown 4548727579 10966036828954 10961488101376 [~ۂAK]
SysV4, 5612 TB / 5104 TiB
Partition not added.
LVM magic value at 302986/124/17
cramfs Marker at 363546/95/4
recover_cramfs
MS Data 5840372478 5844105629 3733151 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
cramfs Marker at 363546/95/5
recover_cramfs
MS Data 5840372479 5844105630 3733151 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
file_win32_pread(480,11,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,8,buffer,1565565869(364801/80/61)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565860(364801/80/52)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565861(364801/80/53)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565862(364801/80/54)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565863(364801/80/55)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565864(364801/80/56)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565866(364801/80/58)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565868(364801/80/60)) read err: read after end of file
file_win32_pread(480,14,buffer,1565565870(364801/80/62)) read err: read after end of file
Results
MS Data 5840372478 5844105629 3733152 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB
MS Data 5840372479 5844105630 3733152 [PÀ¶(v™ù¶%kðFS]
cramfs, 1911 MB / 1822 MiB