cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

undelete files from SSD not working with resulting 00 content files

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=9685

Page 1 of 1

undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 18:48
by Nubber
Hi all,

I try to recover some deleted files on a SSD from yesterday. I quite fast forced power off with switch.
So I'd like to know if I had any chance to recover these files.
Recovery-Test-Failed.png
Recovery-Test-Failed.png (95.01 KiB) Viewed 12374 times
One weird thing is that all files share the same inode apparently.
Can I somehow solve that issue?


Code: Select all

Sun Dec  1 17:11:33 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, November 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=510652142592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=119664541696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=367001600
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\G:
filewin32_getfilesize(\\.\H:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=8001427603456
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=104857600
filewin32_getfilesize(\\.\K:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\K:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\K:
filewin32_getfilesize(\\.\L:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\L:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=449990123520
Hard disk list
Disk /dev/sda - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - ST8000AS0002-1NA17Z, S/N:Z84029XK, FW:AR13
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - USB 3.0 , S/N:2017101901F4, FW:0101
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EFRX-68AX9N0, S/N:WD-WMC1T2337098, FW:80.00A80
Disk /dev/sdd - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - OCZ-VERTEX3 MI, S/N:OCZ-APCC97S3G873IJHG, FW:2.25
Disk /dev/sde - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 950 PRO 512GB, S/N:0025_3853_5B16_3796., FW:2B0QBXX7

Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - USB 3.0 
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 18446744073709551615
NTFS at 0/32/33
NTFS at 12/223/20
 1 * HPFS - NTFS              0  32 33    12 223 19     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
 2 P HPFS - NTFS             12 223 20 54721  14 61  878886960 [Windows 7]
     NTFS, blocksize=4096, 449 GB / 419 GiB


Files with potentially recoverable content: 65899
 2 P HPFS - NTFS             12 223 20 54721  14 61  878886960 [Windows 7]
     NTFS, blocksize=4096, 449 GB / 419 GiB  
....
list of files
....
ERROR: Couldn't set the file's date and time for inode_910647
ERROR: Couldn't set the file's date and time for inode_910647
ERROR: Couldn't set the file's date and time for inode_910647
....
Lots of error messages at the end of logfile. So how can I recover these files? That means I can recover them but apperently they have something like null values in them.
The recovered file have the correct size and everything. But apparently no content in them, only Hex 00.

Would be nice if somebody had a glue, how to solve that.

I think possibly that was a trim action, does that mean, there is completely no chance any more?

Thank you.

Nubber

Re: undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 20:24
by recuperation
Read here:

viewtopic.php?f=4&t=9636

Are you running Testdisk from /dev/sdb?

Re: undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 21:01
by Nubber
Hi, no testdisk is not run from sdb but from another disk.

Re: undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 21:05
by Nubber
And @recuperation thank you for the parallel forum task, but I switched off computer immediately, like I already wrote. All actions I forgot to mention is by accessing SSD by testdisk having it in a USB mounting device .

Re: undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 21:43
by recuperation
Try running Photorec.

What I don't understand is the "inode"-labeling in your linked picture. The report suggests that it's probably NTFS, the partition label "Windows 7" is an additional indicator for NTFS.
NTFS uses entries in the MFT which are not called inodes and there is typically one entry per file.
So even if the inode-labeling is a generalized description there should not be the same inode number for different files.

Re: undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 23:11
by Nubber
Ok, but I am not sure, possibly wear leveling did it's work here already. If not, possibly, how can I do a recovery of eml files with photorec?

Re: undelete files from SSD not working with resulting 00 content files

Posted: 01 Dec 2019, 23:11
by Nubber
Yes, it is a NTFS file system.

Re: undelete files from SSD not working with resulting 00 content files

Posted: 02 Dec 2019, 10:08
by recuperation
If your eml file means Microsoft Email file, I just read about the content on a third party site:
Those eml files seem to be txt files.

Unfortunately I expect lots of false positives when searching for txt files, because only a few txt files will be genuine eml files.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited