cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Win 7->10 RAW recovery, all seemed okay but after reboot still broken.

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=9765

Page 1 of 1

Win 7->10 RAW recovery, all seemed okay but after reboot still broken.

Posted: 19 Jan 2020, 19:41
by mbourgon
Howdy, all. I upgraded Win 7 to Win 10, and my third hard drive (2tb) now shows up as "RAW".

I've tried to recover files from the drive using a different tool, just in case, but since not everything came back properly I want to try and fix the partition.

I am able to use Diskpart to Analyze the partition and I see files when I hit P.
I change it from * it to Primary or Logical (I've tried both), tell it to write it, then reboot, but on reboot it's still not showing up. I get "E:\ is not accessible. The file or directory is corrupted and unreadable."

Any help appreciated. I've included the logs below from multiple attempts.

MANY thanks in advance!!!
M







Sun Jan 19 11:42:51 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240065183744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240065183744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239455961088
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396746752
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL004 HD204UI, S/N:S2H7J9FC303728, FW:1AQ10001
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29186 255 63, sector size=512 - SanDisk SSD PLUS 240GB, S/N:183247803482, FW:UF4500RL

Partition table type (auto): Intel
Disk /dev/sda - 2000 GB / 1863 GiB - ST2000DL004 HD204UI
Partition table type: Intel

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
No partition is bootable

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(4,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(4,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(4,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(4,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(4,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(4,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(4,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(4,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(4,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(4,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(4,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]

interface_write()
1 * HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.



Sun Jan 19 11:49:23 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240065183744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240065183744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239455961088
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396746752
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL004 HD204UI, S/N:S2H7J9FC303728, FW:1AQ10001
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29186 255 63, sector size=512 - SanDisk SSD PLUS 240GB, S/N:183247803482, FW:UF4500RL

Partition table type (auto): Intel
Disk /dev/sda - 2000 GB / 1863 GiB - ST2000DL004 HD204UI
Partition table type: Intel

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(4,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(4,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(4,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(4,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(4,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(4,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(4,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(4,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(4,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(4,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(4,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,16,buffer,6293524(391/192/14)) ReadFile Data error (cyclic redundancy check).



dir_partition inode=5
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,16,buffer,6293514(391/192/4)) ReadFile Data error (cyclic redundancy check).

Directory /
5 dr-xr-xr-x 0 0 0 15-Jan-2020 03:02 .
5 dr-xr-xr-x 0 0 0 15-Jan-2020 03:02 ..
53 dr-xr-xr-x 0 0 0 27-Aug-2017 01:15 $RECYCLE.BIN
154120 dr-xr-xr-x 0 0 0 16-Jan-2020 06:52 .bzvol
177545 dr-xr-xr-x 0 0 0 21-Jul-2013 03:32 0cb23805342a9755fb1d4a9c52
141672 dr-xr-xr-x 0 0 0 4-Jan-2020 23:49 2019-09-26-raspbian-buster-full
...
635248 dr-xr-xr-x 0 0 0 3-Jan-2019 17:46 2b9462775a9deb839ac482c14daf9502fe4e3b09_blahblahblah
21181 dr-xr-xr-x 0 0 0 12-May-2018 10:02 5f237bc5ee0a34128292c93c39dab846
318808 dr-xr-xr-x 0 0 0 11-May-2016 20:54 Anathema 5.1
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 E extended LBA 0 32 32 243201 45 44 3907024897
5 L HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 0/32/32,lba=2047
You will have to reboot for the change to take effect.

TestDisk exited normally.



Sun Jan 19 11:54:17 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240065183744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240065183744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239455961088
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396746752
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL004 HD204UI, S/N:S2H7J9FC303728, FW:1AQ10001
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29186 255 63, sector size=512 - SanDisk SSD PLUS 240GB, S/N:183247803482, FW:UF4500RL

Partition table type (auto): Intel
Disk /dev/sda - 2000 GB / 1863 GiB - ST2000DL004 HD204UI
Partition table type: Intel

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 E extended LBA 0 32 32 243201 45 44 3907024897
No partition is bootable
5 L HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(4,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(4,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(4,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(4,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(4,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(4,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(4,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(4,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(4,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(4,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(4,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(4,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,16,buffer,6293524(391/192/14)) ReadFile Data error (cyclic redundancy check).



dir_partition inode=5
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,16,buffer,6293514(391/192/4)) ReadFile Data error (cyclic redundancy check).

Directory /
5 dr-xr-xr-x 0 0 0 15-Jan-2020 03:02 .
5 dr-xr-xr-x 0 0 0 15-Jan-2020 03:02 ..
53 dr-xr-xr-x 0 0 0 27-Aug-2017 01:15 $RECYCLE.BIN
154120 dr-xr-xr-x 0 0 0 16-Jan-2020 06:52 .bzvol
177545 dr-xr-xr-x 0 0 0 21-Jul-2013 03:32 0cb23805342a9755fb1d4a9c52
141672 dr-xr-xr-x 0 0 0 4-Jan-2020 23:49 2019-09-26-raspbian-buster-full
..
635248 dr-xr-xr-x 0 0 0 3-Jan-2019 17:46 2b9462775a9deb839ac482c14daf9502fe4e3b09_blahblahblah
21181 dr-xr-xr-x 0 0 0 12-May-2018 10:02 5f237bc5ee0a34128292c93c39dab846
318808 dr-xr-xr-x 0 0 0 11-May-2016 20:54 Anathema 5.1

interface_write()
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]

search_part()
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(4,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(4,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
Search for partition aborted

Results
* HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896 [TB2_2012]
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

Re: Win 7->10 RAW recovery, all seemed okay but after reboot still broken.

Posted: 19 Jan 2020, 21:00
by cgrenier
Run "cmd" (right click Run as Administrator) and "chkdsk /f e:".
Does it repair your filesystem ?

Re: Win 7->10 RAW recovery, all seemed okay but after reboot still broken.

Posted: 19 Jan 2020, 22:07
by mbourgon
WOOT! That fixed it!

Thanks!!!!!

(and I have to ask in case this ever comes up again - I hope not... so TestDisk fixed it and chkdsk finished it, or did it just take chkdsk?)

Either way, fantastic news, and thanks for the help!

Re: Win 7->10 RAW recovery, all seemed okay but after reboot still broken.

Posted: 19 Jan 2020, 22:45
by recuperation
mbourgon wrote: 19 Jan 2020, 22:07 (and I have to ask in case this ever comes up again - I hope not... so TestDisk fixed it and chkdsk finished it, or did it just take chkdsk?)
Chkdsk can only work on file systems that reside in partitions. From the view of the operating system, there were no partitions ("raw"). Testdisk fixed it and enabled the work of chkdsk.

Re: Win 7->10 RAW recovery, all seemed okay but after reboot still broken.

Posted: 19 Jan 2020, 23:23
by mbourgon
recuperation wrote: 19 Jan 2020, 22:45
mbourgon wrote: 19 Jan 2020, 22:07 (and I have to ask in case this ever comes up again - I hope not... so TestDisk fixed it and chkdsk finished it, or did it just take chkdsk?)
Chkdsk can only work on file systems that reside in partitions. From the view of the operating system, there were no partitions ("raw"). Testdisk fixed it and enabled the work of chkdsk.
Ah! Okay, thanks. Been too long since I've had to work with chkdsk/diskpart/etc. Thanks for the info! :D
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited