SYstem Files Corrupted

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Dekker
Posts: 9
Joined: 04 Jun 2012, 15:58

SYstem Files Corrupted

#1 Post by Dekker »

Hi everyone,

I was using SOny Vegas pro the other day, using videos directly from y HDD, a 2To Western Digital My Book External Drive, when the software suddenly crashed ... and the HDD too ...

So, I'm now trying to recover my files since, like 90% on this planet, I do not have any backup (and feel so stupid now). Now, when I want to access my disk, Windows is asking me to Format it (nooooooooooooooooo..)

I've been trying to use HDD Regenerator v2011, but, after 2 scans, it still find errors and it doesn't seem to be very efficient .. (+ it takes 24h to check the whole disk ..)

So my problem, following to TestDisk, is :"Partition sector doesn't have the endmark 0xAA55"
So I found TestDisk and used it following thoses steps :

http://drehsen.com/compusectools/testdi ... mples.html

As you can see, at the end, I chose the 'write' option... but it didn't changed much.
Now , I can see the partition but when I want to see my files (i press list files or something) nothig appear and TestDisk tell me that my files are corrupted.

Then, I've been following these steps :

http://le-monde-informatique.com/forum/ ... 48&t=12136 (just make a translation of the page with google translate :)

At the end they say that I have to go in the advanced options and make a "Backup BS" but, for Test Disk, both (Backup BS and BS) are the same. and it didn't resolved my problem. I also red that I can Rebuild BS but I don't want to since I'm not sure about that.

So what can I do know ? I red that I should maybe try to recover my files, that mean I have to buy a 2To HDD (expensive to me ..) and use either PhotoRec according to this page ( http://www.debian-administration.org/articles/420 ) or those tools :
- http://www.r-studio.com/
- http://findandmount.com/

Could you advice my on what to do now please ? do I have to build a new BS ? Can my HDD still be save ? my datas ?

Thank you so much, here is my .log file :
Sun Jun 3 22:57:09 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=40020664320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=640135028736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=40020664320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=40017854464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=624364213760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=5375438848
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000364240896
file_pread(4,1,buffer,1250274689(77825/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,78172289(4865/254/63)) lseek err Invalid argument
file_pread(6,1,buffer,3906975869(243197/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - SAMSUNG HM640JJ, S/N:2SQADJZR0A4361, FW:2AK1
Disk /dev/sdb - 40 GB / 37 GiB - CHS 4865 255 63, sector size=512 - INTEL SS DSA2M040G2GC, S/N:VCBG594010RG40G0NG, FW:2CV1
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Book 1140, S/N:WCAZA9394386, FW:1007
Drive E: - 5375 MB / 5126 MiB - CHS 1281 64 32, sector size=2048 - Optiarc DVDRWBD BC-5540H, FW:101A

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1862 GiB - WD My Book 1140
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243197 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 243197 57 60 3906961408
Computes LBA from CHS for Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243198 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 2000 GB / 1862 GiB - CHS 243198 255 63
NTFS at 0/32/33
filesystem size 3906961408
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243197 57 60 3906961408
NTFS, 2000 GB / 1862 GiB
file_pread(6,7,buffer,3906963457(243197/57/62)) lseek err Invalid argument
file_pread(6,8,buffer,3906963464(243197/58/6)) lseek err Invalid argument
file_pread(6,3,buffer,3906963472(243197/58/14)) lseek err Invalid argument
file_pread(6,3,buffer,3906963519(243197/58/61)) lseek err Invalid argument
file_pread(6,8,buffer,3906963535(243197/59/14)) lseek err Invalid argument
file_pread(6,11,buffer,3906963582(243197/59/61)) lseek err Invalid argument
file_pread(6,2,buffer,3906965504(243197/90/30)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243197 57 60 3906961408
NTFS, 2000 GB / 1862 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 243197 57 60 3906961408
Dekker
Posts: 9
Joined: 04 Jun 2012, 15:58

Re: SYstem Files Corrupted

#2 Post by Dekker »

I've used PhotoRec to try to recover my files and it worked, but, it is impossible to me to get any files name or directories, how could I get so ? Is there anything I could do with TestDisk to recover my disk ? (Dump or any other function I may not know yet ?)

Many thanks
Locked