Partion is raw cannot recover pictures

How to use TestDisk to recover lost partition
Post Reply
Message
Author
younes012
Posts: 3
Joined: 25 Sep 2017, 00:51

Partion is raw cannot recover pictures

#1 Post by younes012 » 25 Sep 2017, 01:04

Hi
A Thosiba external hard drive went raw.
I used photorec but cannot recover any pictures.
I cannot attach the log file. I keep getting invalid file extention error message.
here is the log file
.
Any help is much appreciated.

**********************************************


Sat Sep 23 10:21:25 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-28-generic (#32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: dco 976773168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 976773168 sectors
/dev/sdb: user_max 976773168 sectors
/dev/sdb: native_max 976773168 sectors
/dev/sdb: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
/dev/sr1 is not an ATA disk
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500DM002-1BD142, S/N:Z6E1XBN7, FW:HP73
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA MK5076GSX, S/N:81OAP0TNT, FW:GS001A
Disk /dev/sr1 - 616 MB / 588 MiB - 301160 sectors (RO), sector size=2048 - HL-DT-STDVD-RAM GH22NS30, FW:1.01

Partition table type default to Intel
Disk /dev/sdb - 500 GB / 465 GiB - TOSHIBA MK5076GSX
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
No partition is bootable
ntfs_mst_post_read_fixup_warn: magic: 0x4ef7fd0a size: 1024 usa_ofs: 64020 usa_count: 40430: Invalid argument
Record 0 has no FILE magic (0x4ef7fd0a)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x4ef7fd0a size: 1024 usa_ofs: 64020 usa_count: 40430: Invalid argument
Record 0 has no FILE magic (0x4ef7fd0a)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x4ef7fd0a size: 1024 usa_ofs: 64020 usa_count: 40430: Invalid argument
Record 0 has no FILE magic (0x4ef7fd0a)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0x4ef7fd0a size: 1024 usa_ofs: 64020 usa_count: 40430: Invalid argument
Record 0 has no FILE magic (0x4ef7fd0a)
Failed to load $MFT: Input/output error

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 60800/254/63
filesystem size 976768001
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 60800 254 63 976768001
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size 976768001
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60800 254 63 121601 253 61 976768001
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976768001, end=1953536064, disk end=976773168)
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60800 254 63 121601 253 61 976768001
NTFS, blocksize=4096, 500 GB / 465 GiB

Results
L HPFS - NTFS 0 1 2 60800 254 63 976768001
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 976768001 linear /dev/sdb 64" | dmsetup create test0
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

L HPFS - NTFS 0 1 2 60800 254 63 976768001
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
Can't open filesystem. Filesystem seems damaged.
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 0 1 1 60800 254 63 976768002
5 L HPFS - NTFS 0 1 2 60800 254 63 976768001

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 60800/254/63
filesystem size 976768001
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 60800 254 63 976768001
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size 976768001
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 48
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60800 254 63 121601 253 61 976768001
NTFS, blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=976768064, size=976768001, end=1953536064, disk end=976773168)
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
HPFS - NTFS 60800 254 63 121601 253 61 976768001
NTFS, blocksize=4096, 500 GB / 465 GiB

Results
L HPFS - NTFS 0 1 2 60800 254 63 976768001
NTFS found using backup sector, blocksize=4096, 500 GB / 465 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 976768001 linear /dev/sdb 64" | dmsetup create test0
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 0 1 1 60800 254 63 976768002
5 L HPFS - NTFS 0 1 2 60800 254 63 976768001
*********************************************************

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3813
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partion is raw cannot recover pictures

#2 Post by cgrenier » 25 Sep 2017, 05:54

Run TestDisk, Analyze, Quick Search, Stop, use 'a' to manually add the following partition
HPFS - NTFS 0 1 1 60800 254 63
Set the partition as *(bootable).
On next screen, choose Write and confirm.
In Advanced, select
1 * HPFS - NTFS 0 1 1 60800 254 63
Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.

younes012
Posts: 3
Joined: 25 Sep 2017, 00:51

Re: Partion is raw cannot recover pictures

#3 Post by younes012 » 25 Sep 2017, 10:46

Thank you for the prompt reply.
I will try and post the results.
Younes

younes012
Posts: 3
Joined: 25 Sep 2017, 00:51

Re: Partion is raw cannot recover pictures

#4 Post by younes012 » 27 Sep 2017, 00:54

hi
I have tried the solution you suggested.
Rebuilding the BS failed. So I had an option to use the back up BS. I did.
But i still could not see my the files.
I tried repairing the $mft file. but I could not. I get the terrible message $mft and $mftmirr are bad. Fail to repair.
Any other suggestions?
All my borther's kids pictures are in this drive

User avatar
cgrenier
Site Admin
Posts: 3813
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partion is raw cannot recover pictures

#5 Post by cgrenier » 27 Sep 2017, 06:04

Try PhotoRec. It will not recover the original filenames and you will have to sort the files (see https://www.cgsecurity.org/testdisk.pdf) but it's better than nothing.

Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests