cgsecurity.org

I used AOMEI software to convert a disk from GPT to MBR with saving the data. It seemed to screw up the disk, it couldn't be recognized. They then they told me to use their partition wizard which didn't help, finally they said to try Testdisk.

I still can't get to the data on this disk. It's my sister-in-laws disk from her broken laptop, and I am afraid I have screwed it up.
I have attached the log file per the support directions.

Appreciate any help.


Tue Oct 22 14:18:42 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=32019111936
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=32019111936
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479498372608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=7988737365504
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=32019079680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=4000650887168
Hard disk list
Disk /dev/sda - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - KINGSTON SVP200S3480G, S/N:50026B7221067067, FW:332ABBF0
Disk /dev/sdb - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - WDC WD80EZAZ-11TDBA0, S/N:JEH6S04N, FW:83.H0A83
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - ST1000LM 035-1RK172, S/N:DE705DFFFFFF
Disk /dev/sdd - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Seagate BUP BL, S/N:NA9FMLZM, FW:0304
Disk /dev/sde - 32 GB / 29 GiB - CHS 3892 255 63, sector size=512 - Lexar CF USB_3_0 Read, S/N:00000000LX01, FW:LX01
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - ST1000LM 035-1RK172, S/N:DE705DFFFFFF

Partition table type defaults to Intel
Disk /dev/sdc - 1000 GB / 931 GiB - ST1000LM 035-1RK172
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 15200 255 63
Current partition structure:
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 15200 255 63
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
NTFS at 4/105/38
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 1925832704
sectors_per_cluster 8
mft_lcn 7985842
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4 105 38 14989 27 14 240729088 [Windows]
NTFS, blocksize=4096, 986 GB / 918 GiB
NTFS at 14989/27/15
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 2007040
sectors_per_cluster 8
mft_lcn 83626
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 14989 27 15 15004 184 28 250880 [Windows RE tools]
NTFS, blocksize=4096, 1027 MB / 980 MiB
NTFS at 15004/184/29
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 25104384
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 15004 184 29 15200 14 46 3138048 [RECOVERY]
NTFS, blocksize=4096, 12 GB / 11 GiB
file_pread(6,1,buffer,244190719(15200/43/11)) lseek err Invalid argument
file_pread(6,1,buffer,244190720(15200/43/12)) lseek err Invalid argument
file_pread(6,2,buffer,244190720(15200/43/12)) lseek err Invalid argument
file_pread(6,1,buffer,244190722(15200/43/14)) lseek err Invalid argument
file_pread(6,2,buffer,244190727(15200/43/19)) lseek err Invalid argument
file_pread(6,2,buffer,244190729(15200/43/21)) lseek err Invalid argument
file_pread(6,3,buffer,244190735(15200/43/27)) lseek err Invalid argument
file_pread(6,1,buffer,244190976(15200/47/16)) lseek err Invalid argument

Results
* HPFS - NTFS 4 105 38 14989 27 14 240729088 [Windows]
NTFS, blocksize=4096, 986 GB / 918 GiB
P HPFS - NTFS 14989 27 15 15004 184 28 250880 [Windows RE tools]
NTFS, blocksize=4096, 1027 MB / 980 MiB
P HPFS - NTFS 15004 184 29 15200 14 46 3138048 [RECOVERY]
NTFS, blocksize=4096, 12 GB / 11 GiB

interface_write()
1 * HPFS - NTFS 4 105 38 14989 27 14 240729088 [Windows]
2 P HPFS - NTFS 14989 27 15 15004 184 28 250880 [Windows RE tools]
3 P HPFS - NTFS 15004 184 29 15200 14 46 3138048 [RECOVERY]

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 15200 255 63
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
NTFS at 4/105/38
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 1925832704
sectors_per_cluster 8
mft_lcn 7985842
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4 105 38 14989 27 14 240729088 [Windows]
NTFS, blocksize=4096, 986 GB / 918 GiB
NTFS at 1479/239/40
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 189634560
sectors_per_cluster 8
mft_lcn 7985842
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 4 105 38 1479 239 41 23704320
NTFS found using backup sector, blocksize=4096, 97 GB / 90 GiB
NTFS at 1945/193/40
Warning: number of bytes per sector mismatches 512 (NTFS) != 4096 (HD)
filesystem size 248907776
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 9 9 1 1945 193 41 31113472
NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
file_pread(6,3,buffer,49313023(3069/151/26)) ReadFile The system cannot find the file specified.

file_pread(6,1,buffer,49313023(3069/151/26)) ReadFile The system cannot find the file specified.

file_pread(6,1,buffer,49313026(3069/151/29)) ReadFile The system cannot find the file specified.
(---------------I deleted a ton of these messages from the log--------)
file_pread(6,1,buffer,90154754(5611/222/54)) ReadFile The system cannot find the file specified.

file_pread(6,2,buffer,90154759(5611/222/59)) ReadFile The system cannot find the file specified.

file_pread(6,2,buffer,90154761(5611/222/61)) ReadFile The specified network resource or device is no longer available.

file_pread(6,3,buffer,90154767(5611/223/4)) ReadFile The specified network resource or device is no longer available.

(( ---- I deleted a ton of these messages too ----))
file_pread(6,1,buffer,145150(9/8/62)) ReadFile The specified network resource or device is no longer available.

file_pread(6,1,buffer,145151(9/8/63)) ReadFile The specified network resource or device is no longer available.

get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
HPFS - NTFS 4 105 38 14989 27 14 240729088 [Windows]
NTFS, blocksize=4096, 986 GB / 918 GiB
HPFS - NTFS 4 105 38 1479 239 41 23704320
NTFS found using backup sector, blocksize=4096, 97 GB / 90 GiB
HPFS - NTFS 9 9 1 1945 193 41 31113472
NTFS found using backup sector, blocksize=4096, 127 GB / 118 GiB
Error reading bootsector: Invalid argument.
Failed to startup volume: Invalid argument.
Error reading bootsector: Invalid argument.
Error reading bootsector: Invalid argument.
Failed to startup volume: Invalid argument.
Error reading bootsector: Invalid argument.
file_pread(6,1,buffer,70912(4/105/38)) ReadFile The specified network resource or device is no longer available.

Can't read exFAT boot sector.

HPFS - NTFS 4 105 38 14989 27 14 240729088 [Windows]
NTFS, blocksize=4096, 986 GB / 918 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
file_pread(6,1,buffer,0(0/0/1)) ReadFile The specified network resource or device is no longer available.


Partition: Read error
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

After Quick Search, choose Write, confirm, Quit and restart your computer.
It should be enough to recover the data.

OK, thanks for the fast reply. I can now see the disk in explorer as drive f:. Disk management says it is a 'raw' disk, explorer wants to format it to read it. Can I get to the data on it?

dansmail26 wrote: 22 Oct 2019, 22:08 OK, thanks for the fast reply. I can now see the disk in explorer as drive f:. Disk management says it is a 'raw' disk, explorer wants to format it to read it. Can I get to the data on it?

Do not format. Running "format" means deleting. Rerun Testdisk and try out if you can list the files with the p command.

Thanks all, I am hoping I have all the files. I was able to copy the windows 'user' directory off the disk.

Now do I have to just 'format' that disk or is there a command to save all those files as they are on the disk?

Thankssss!!!

dansmail26 wrote: 23 Oct 2019, 02:17 Thanks all, I am hoping I have all the files. I was able to copy the windows 'user' directory off the disk.

Now do I have to just 'format' that disk or is there a command to save all those files as they are on the disk?

Thankssss!!!

Have you read my last contribution about formatting?
If you want to copy all your files, you have to select them all - preferably at root level.

recuperation wrote: 23 Oct 2019, 11:44

dansmail26 wrote: 23 Oct 2019, 02:17 Thanks all, I am hoping I have all the files. I was able to copy the windows 'user' directory off the disk.

Now do I have to just 'format' that disk or is there a command to save all those files as they are on the disk?

Thankssss!!!

Have you read my last contribution about formatting?
If you want to copy all your files, you have to select them all - preferably at root level.

Yes, I did thanks. What I was asking is now that I have 'backed up' the files I want by copying them, is there any way to try and get the disk back to a usable state with the original files still on the disk or do I have to reformat the disk?

After having the desired files backed up, running chkdsk is on option that is worth a try.