Successful part recovery with version 6 but 7 fails

How to use TestDisk to recover lost partition
Post Reply
Message
Author
omersiar
Posts: 1
Joined: 25 Nov 2017, 17:27

Successful part recovery with version 6 but 7 fails

#1 Post by omersiar » 27 Nov 2017, 08:03

Hello,

I want to inform you that I tried to recover my Extended Logical Partition with the version 7.1-WIP for hours. Tried rebuilding BS, it searched throughly for mft but found nothing etc. Then I simply switched to version TestDisk 6.11.3 and I just managed to recover. I taught you @cgrenier may want to know this behaviour. Logs are attached.

Test Disk 7 LOG

Code: Select all

Sat Nov 25 19:05:46 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, November 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=640135028224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=640135028224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=83930724864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=76108515840
filewin32_getfilesize(\\.\E:) GetFileSize err Yanlış işlev.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Yanlış işlev.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=457026043904
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST3160318AS, S/N:563933594a345134202020202020202020202020, FW:HP34
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - Generic External, S/N:WD-WX51A21V8602, FW:1.14

Partition table type (auto): Intel
Disk /dev/sdb - 640 GB / 596 GiB - Generic External
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 E extended LBA         22261   0  1 77825 148 30  892645014
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992

ntfs_boot_sector
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992
file_pread(5,1,buffer,1250267978(77825/148/30)) lseek err Invalid argument
filesystem size           1705185789048592323 1
sectors_per_cluster       99 0
mft_lcn                   1255933242 0
mftmirr_lcn               791773374 0
clusters_per_mft_record   -23 0
clusters_per_index_record -43 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Boot sector                        Backup boot sector
0000 fc47bd67 4de08940   .G.gM..@  00000000 00000000   ........
0008 3839c018 af63122e   89...c..  00000000 00000000   ........
0010 7db0734f 52ae3a76   }.sOR.:v  00000000 00000000   ........
0018 39a6b173 56f5464a   9..sV.FJ  00000000 00000000   ........
0020 845b5b7f 573c26e3   .[[.W<&.  00000000 00000000   ........
0028 c21749d0 7009aa17   ..I.p...  00000000 00000000   ........
0030 3a05dc4a 46cc8506   :..JF...  00000000 00000000   ........
0038 be80312f 3ec6acdb   ..1/>...  00000000 00000000   ........
0040 e9c6e546 d5c82483   ...F..$.  00000000 00000000   ........
0048 5a53cc65 ccbd4ca7   ZS.e..L.  00000000 00000000   ........
0050 858f2bf4 67cc73da   ..+.g.s.  00000000 00000000   ........
0058 4f19c18c f039e2aa   O....9..  00000000 00000000   ........
0060 b0752495 e38afae6   .u$.....  00000000 00000000   ........
0068 dfc15f6a 0095c838   .._j...8  00000000 00000000   ........
0070 cf1ffd7a b7ff000a   ...z....  00000000 00000000   ........
0078 8e1bc183 18e40edf   ........  00000000 00000000   ........
0080 4f7af6e9 e2dbb5d7   Oz......  00000000 00000000   ........
0088 43caad46 296ecf8d   C..F)n..  00000000 00000000   ........
0090 5f39fce9 54e0e6be   _9..T...  00000000 00000000   ........
0098 b5d6be00 f9b6a5e0   ........  00000000 00000000   ........
00A0 18719e83 b7e75e4f   .q....^O  00000000 00000000   ........
00A8 e21f847a 869d2bf0   ...z..+.  00000000 00000000   ........
00B0 4e09ec3f c6bbe388   N..?....  00000000 00000000   ........
00B8 f776b1e7 2a37eab7   .v..*7..  00000000 00000000   ........
00C0 3c9a3eb9 ed915613   <.>...V.  00000000 00000000   ........
00C8 009f6c11 5b779e19   ..l.[w..  00000000 00000000   ........
00D0 bdb3621e 13c1249a   ..b...$.  00000000 00000000   ........
00D8 cc689a39 4ee5c638   .h.9N..8  00000000 00000000   ........
00E0 ab55131c a938c76e   .U...8.n  00000000 00000000   ........
00E8 a8899323 f01fad48   ...#...H  00000000 00000000   ........
00F0 a36a9cf5 39c53e3c   .j..9.><  00000000 00000000   ........
00F8 004f738a 685c9249   .Os.h\.I  00000000 00000000   ........
0100 eacd8fd6 aafef7cc   ........  00000000 00000000   ........
0108 cd6c2018 4cf7c8a5   .l .L...  00000000 00000000   ........
0110 57c03bba f34f5f94   W.;..O_.  00000000 00000000   ........
0118 723802a0 9f9e7dcd   r8....}.  00000000 00000000   ........
0120 5a7eebf5 224b4f91   Z~.."KO.  00000000 00000000   ........
0128 622901c8 f53c54e6   b)...<T.  00000000 00000000   ........
0130 505403e9 83598a39   PT...Y.9  00000000 00000000   ........
0138 51fed558 5e49fa1c   Q..X^I..  00000000 00000000   ........
0140 566f6f99 d14a175f   Voo..J._  00000000 00000000   ........
0148 7165a401 b1ee3151   qe....1Q  00000000 00000000   ........
0150 bcdc923d 39a8c1c9   ...=9...  00000000 00000000   ........
0158 e7dea23f 313e83ad   ...?1>..  00000000 00000000   ........
0160 35bfc8eb 6b45f316   5...kE..  00000000 00000000   ........
0168 6937020f a0fe5541   i7....UA  00000000 00000000   ........
0170 f05bdcd4 f295391d   .[....9.  00000000 00000000   ........
0178 f1c5450c 7b9b15ac   ..E.{...  00000000 00000000   ........
0180 5e879751 6bf793db   ^..Qk...  00000000 00000000   ........
0188 a121401c e6ad2ab7   .!@...*.  00000000 00000000   ........
0190 3f402ac5 8c440e07   ?@*..D..  00000000 00000000   ........
0198 6c1fc8d5 99210070   l....!.p  00000000 00000000   ........
01A0 383826b1 93b3f514   88&.....  00000000 00000000   ........
01A8 7a7ccc90 70483d39   z|..pH=9  00000000 00000000   ........
01B0 15621505 803dca9a   .b...=..  00000000 00000000   ........
01B8 9d6db2f9 1d31fe34   .m...1.4  00000000 00000000   ........
01C0 b14455f9 1d067f2a   .DU....*  00000000 00000000   ........
01C8 9e6d7e45 3ebfd763   .m~E>..c  00000000 00000000   ........
01D0 9e63ce73 cd21c91f   .c.s.!..  00000000 00000000   ........
01D8 89a43f33 7e0694e7   ..?3~...  00000000 00000000   ........
01E0 03ea2bb1 7ea4772c   ..+.~.w,  00000000 00000000   ........
01E8 5ae3a9f5 157d6356   Z....}cV  00000000 00000000   ........
01F0 407dff00 ad5084e0   @}...P..  00000000 00000000   ........
01F8 e47f7466 adac9918   ..tf....  00000000 00000000   ........

ntfs_boot_sector
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992
filesystem size           1705185789048592323 1
sectors_per_cluster       99 0
mft_lcn                   1255933242 0
mftmirr_lcn               791773374 0
clusters_per_mft_record   -23 0
clusters_per_index_record -43 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Analyse Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 E extended LBA         22261   0  1 77825 148 30  892645014
No partition is bootable
Invalid NTFS or exFAT boot
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992

search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
NTFS at 0/1/1
filesystem size           357622902
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 22260 254 63  357622902
     NTFS, blocksize=4096, 183 GB / 170 GiB
check_part_i386 failed for partition type 07
     HPFS - NTFS          22261 254 21 77825 148 30  892628992
file_pread(5,8,buffer,1250267979(77825/148/31)) lseek err Invalid argument
file_pread(5,1,buffer,1250267979(77825/148/31)) lseek err Invalid argument
file_pread(5,15,buffer,1250267980(77825/148/32)) lseek err Invalid argument
file_pread(5,3,buffer,1250267995(77825/148/47)) lseek err Invalid argument
file_pread(5,3,buffer,1250268042(77825/149/31)) lseek err Invalid argument
file_pread(5,8,buffer,1250268058(77825/149/47)) lseek err Invalid argument
file_pread(5,11,buffer,1250268105(77825/150/31)) lseek err Invalid argument
file_pread(5,2,buffer,1250270027(77825/180/63)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0   1  1 22260 254 63  357622902
     NTFS, blocksize=4096, 183 GB / 170 GiB
   L HPFS - NTFS          22261 254 21 77825 148 30  892628992
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 * HPFS - NTFS              0   1  1 22260 254 63  357622902
 2 E extended LBA         22261   0  1 77825 148 30  892645014
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 22261/0/1,lba=357622965
You will have to reboot for the change to take effect.

TestDisk exited normally.

Test Disk 6 LOG

Code: Select all

Sat Nov 25 19:19:22 2017
Command line: TestDisk

TestDisk 6.11.3, Data Recovery Utility, May 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 2007 (7601) SP1
Compiler: GCC 4.3, Cygwin 1005.25 - May  6 2009 20:35:43
ext2fs lib: 1.41.4, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=640135028224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=640135028224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=83930724864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=76108515840
filewin32_getfilesize(\\.\E:) GetFileSize err Yanlış işlev.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Yanlış işlev.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=183102925824
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=457026043904
file_pread(4,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,1250274689(77825/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST3160318AS
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63, sector size=512 - Generic External

Partition table type (auto): Intel
Disk /dev/sdb - 640 GB / 596 GiB - Generic External
Partition table type: Intel

Analyse Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=3
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=3
Current partition structure:
 1 * HPFS - NTFS              0   1  1 22260 254 63  357622902
 2 E extended LBA         22261   0  1 77825 148 30  892645014
Invalid NTFS or EXFAT boot
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992
 5 L HPFS - NTFS          22261 254 21 77825 148 30  892628992
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 640 GB / 596 GiB - CHS 77826 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 640 GB / 596 GiB - CHS 77826 255 63
NTFS at 0/1/1
filesystem size           357622902
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1 22260 254 63  357622902
     NTFS, 183 GB / 170 GiB
NTFS at 22261/143/27
filesystem size           892628992
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          22261 143 27 77825  37 36  892628992 [Data]
     NTFS, 457 GB / 425 GiB
file_pread(5,8,buffer,1250263808(77825/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,1250263808(77825/82/18)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
   * HPFS - NTFS              0   1  1 22260 254 63  357622902
     NTFS, 183 GB / 170 GiB
   P HPFS - NTFS          22261 143 27 77825  37 36  892628992 [Data]
     NTFS, 457 GB / 425 GiB


dir_partition inode=5
   P HPFS - NTFS          22261 143 27 77825  37 36  892628992 [Data]
     NTFS, 457 GB / 425 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 21-Apr-2011 08:42 .
       5 dr-xr-xr-x     0      0         0 21-Apr-2011 08:42 ..
      37 dr-xr-xr-x     0      0         0 16-Nov-2011 21:24 $RECYCLE.BIN
    4356 dr-xr-xr-x     0      0         0 11-Jan-2012 22:52 3e546790181f3dff58db63cb42eb1e
    4025 dr-xr-xr-x     0      0         0 29-Nov-2011 13:09 656b214dc2a8a31a9c6a2279b3ba
     734 -r--r--r--     0      0    180583  5-Mar-2017 19:31 ads25c425b1z11.jpg
      77 -r--r--r--     0      0      9131 21-Dec-2014 20:42 AlbumArtSmall.jpg
     148 -r--r--r--     0      0    189851 29-Dec-2014 18:11 Ali ku_çu=matematikçi.pptx
     141 -r--r--r--     0      0    115091 24-Dec-2014 19:45 buymearose.mid
    1626 -r--r--r--     0      0   6197044  5-Dec-2016 11:05 CANIM BABAM B0TANEM.pptx
    1293 -r--r--r--     0      0   1069925 26-Feb-2015 20:51 DOAL ÇEVRE VE YAPAY ÇEVRE NE DEMEK.pptx
    1648 -r--r--r--     0      0   3013443  5-Dec-2016 11:17 DUA NED0R.pptx
     147 -r--r--r--     0      0   3763348 11-Feb-2016 22:38 Etme ^iiri (Mevlana) Fon Müzii (Hüsnü ^ENLEND0R0C0).mp3
    4156 dr-xr-xr-x     0      0         0 29-Nov-2011 14:45 f33a369c11866868662354f3
     140 -r--r--r--     0      0     48953 21-Dec-2014 20:42 Folder.jpg
    3678 dr-xr-xr-x     0      0         0 28-Nov-2011 22:32 Fotolar
     146 -r--r--r--     0      0     19018 24-Dec-2014 19:48 givethanx.mid
    1630 -r--r--r--     0      0    211767 31-Jan-2015 21:51 Heppy Street.pptx
    1671 dr-xr-xr-x     0      0         0 18-Oct-2016 20:54 MÜZ0KLER 2
    5034 dr-xr-xr-x     0      0         0 17-Nov-2012 21:40 Revo Uninstaller
      35 dr-xr-xr-x     0      0         0 17-Nov-2011 12:15 System Volume Information
    1659 -r--r--r--     0      0   6697306  3-Mar-2015 13:44 UZAY.pptx
     161 -r--r--r--     0      0    235169 29-Dec-2014 18:20 YARASALAR NASIL YÖN BULUR.pptx
    3035 dr-xr-xr-x     0      0         0 24-Nov-2017 11:21 Yedekler
    1872 dr-xr-xr-x     0      0         0 24-Jan-2015 19:39 Yeni klasör (2)
    1660 -r--r--r--     0      0      8019 31-Jan-2015 21:51 Yeni Microsoft Office Excel Çal1_ma Sayfas1.xlsx
    1279 -r--r--r--     0      0       458 16-Feb-2015 20:08 Yerel Disk (C) - K1sayol (2).lnk
    1668 -r--r--r--     0      0       458  1-Feb-2015 20:17 Yerel Disk (C) - K1sayol.lnk
    1656 -r--r--r--     0      0    139392 31-Jan-2015 21:51 0ngilizce aile mireyleri.pptx
      68 dr-xr-xr-x     0      0         0 31-Jan-2015 21:48 kar_1dan yuklenen
    1641 -r--r--r--     0      0   3880226  5-Dec-2016 11:05 MEVLANANIN HAYATI.pptx
    1644 -r--r--r--     0      0   6971743  5-Dec-2016 11:05 mp3indirdur-Pera-Sensiz-Ben.mp3
    1645 -r--r--r--     0      0   6099393  5-Dec-2016 11:05 mp3indirdur-Sila-Aslan-gibi.mp3
    3078 -r--r--r--     0      0     80158  8-Mar-2017 22:04 Must & Mustn't Konu Anlat1m1 ve Örnek Cümleler.htm
    1625 dr-xr-xr-x     0      0         0  8-Mar-2017 22:04 Must & Mustn't Konu Anlat1m1 ve Örnek Cümleler_dosyalar
    1637 -r--r--r--     0      0   338569702  5-Dec-2016 11:05 Hz Muhammed- Son Peygamber - The Last Prophet.mp4
     168 dr-xr-xr-x     0      0         0 16-Nov-2011 22:35 Müzik

interface_write()
 1 * HPFS - NTFS              0   1  1 22260 254 63  357622902
 2 P HPFS - NTFS          22261 143 27 77825  37 36  892628992 [Data]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3808
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Successful part recovery with version 6 but 7 fails

#2 Post by cgrenier » 28 Nov 2017, 06:57

The log files shows that
- the first NTFS partition has been recovered using TestDisk 7.0
- the second partition saved by TestDisk 7.0 and by TestDisk 6.11 is not the same.
You should have used 'p' to list the files from the second partition and used Deeper Search if the partition was not matching what you were expecting.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests