Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

External Drive changed to raw.


  • Please log in to reply
25 replies to this topic

#1 mnechi

mnechi

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 22 February 2013 - 12:30 PM

Hello all,

 

I have a small 20G HD from an old pc that I formatted and put in an enclosure that I use as an easy portable storage device.   I had a power fail and when restored, it came back in a RAW state.  Currently trying on a pc running XP.

 

I tried UBUNTU to see if it could access the drive so I could get the critical data off it without success, UBUNTU could not see the data.

 

I tried to access with several programs without luck.  I tried the free version of icare data which looks like it saw several files but do not display file names.  I don't want to spend $80 to find out if they recover or not.  

 

Finally I then stumbled upon PartedMagic off Mr. Litten's website.  Via testdisk at least I was able to see the drive however I could not get access to my data.  I ran it today and quick found nothing and said "No partition found or selected for recovery"; deeper scan said:

Warning Number of heads / cylinder mismatches 1(FAT)! = 255 (HD)

Number of sectors per track mismatches 48519(FAT)! = 63(HD)

FAT32 0 1 140 238 33 2264064

 

Thoughts on next steps on how to attempt recovery?

 

Thank you

 

 

I also ran with testdisk with logs, they are here.  The files listed are not those attempting to recover:

 

 


 

Fri Feb 22 11:56:33 2013
Command line: TestDisk


 

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=40007761920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=20003880960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=40007761920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=20003880960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=40007729664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=20003848704
file_pread(4,1,buffer,78156224(4864/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,39086144(2432/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63, sector size=512 - SAMSUNG MP0402H, FW:UC200-16
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63, sector size=512 - IC25N020 ATCS04-0


 

Partition table type (auto): Intel
Disk /dev/sdb - 20 GB / 18 GiB - IC25N020 ATCS04-0
Partition table type: Intel


 

Analyse Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
Geometry from i386 MBR: head=255 sector=63


 


test_FAT()
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
sector_size  0
cluster_size 0
reserved     10762
fats         0
dir_entries  0
sectors      16128
media        00
fat_length   256
secs_track   0
heads        0
hidden       3120562176
total_sect   910775269
check_part_i386 failed for partition type 0C
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid FAT boot sector
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1


 

search_part()
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
file_pread(5,2,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,1,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,8,buffer,39070088(2432/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,39070096(2432/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,39070143(2432/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,39070159(2432/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,39070206(2432/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,39072128(2432/32/33)) lseek err Invalid argument


 

Results


 

interface_write()
 
No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.


 

search_part()
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
FAT32 at 0/1/7
FAT1 : 36-9569
FAT2 : 9570-19103
start_rootdir : 19104 root cluster : 2
Data : 19104-39070015
sectors : 39070017
cluster_size : 32
no_of_cluster : 1220341 (2 - 1220342)
fat_length 9534 calculated 9534
heads/cylinder 1 (FAT) != 255 (HD)
sect/track 48519 (FAT) != 63 (HD)
set_FAT_info: name from BS used


 

FAT32 at 0/1/7
     FAT32                    0   1  1   140 238 33    2264064
     FAT found using backup sector!, 1159 MB / 1105 MiB
NTFS at 2430/254/63
filesystem size           39053952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
file_pread(5,2,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,1,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,7,buffer,39070081(2432/0/2)) lseek err Invalid argument
file_pread(5,8,buffer,39070088(2432/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,39070096(2432/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,39070143(2432/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,39070159(2432/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,39070206(2432/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,39072128(2432/32/33)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=3
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=3


 

Results
     FAT32                    0   1  1   140 254 63    2265102
     FAT found using backup sector!, 1159 MB / 1106 MiB
     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
Not an exFAT boot sector.


 

     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
Can't open filesystem. Filesystem seems damaged.


 


dir_partition inode=0
     FAT32                    0   1  1   140 254 63    2265102
     FAT found using backup sector!, 1159 MB / 1106 MiB
FAT: cluster=2(0x2), pos=19167
Directory /
 14614528 -rwxr-xr-x     0      0 2248146944  1-Jan-1980 01:00 USBC.
 236990512 dr-xr-xr-x     0      0 859387697 16-Jan-2004 01:17 .178
 257040440 dr-xr-xr-x     0      0 173154352 31-Aug-2006 15:35 trailer
.<</
 7623200 drwxr-xr-x     0      0 1145646858 31-Dec-2003 07:09 /Info
 21050168 -rwxr-xr-x     0      0 1177699137  2-Feb-2007 08:50 [<D004CB.15C
 120993346 dr-xr-xr-x     0      0 1128346424  4-Feb-2015 08:10 B0><D004.CB1
 120661258 drwxr-xr-x     0      0 1179600165 18-Jan-2005 06:49 2FB0>]
>.>
s
       0 -rwxr-xr-x     0      0         0  1-Jan-1980 00:00


 


interface_write()
 
No partition found or selected for recovery
simulate write!


 

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition


 

TestDisk exited normally.


Edited by mnechi, 22 February 2013 - 01:28 PM.


BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 22 February 2013 - 04:12 PM

Hi

 

I would definitely make an image of the drive using ddrescue and then work on recovering files from the image. It is realtively small and should take less than an hour and it may recover the filesystem data that appears to be missing or corrupted.

 

To do it the way that I do it, you'll need at least 22GB of free space on another drive to write the image to (20GB plus 10%).

Here are some instructions for making the image.

http://fixit.litten.com/datarecoveryflowchart.htm#flow6

 

Once you've made the image, you can check it with TestDisk by going into the terminal in PartedMagic and typing

testdisk imagefilename

 

It may see things better on the image that you make but if not, let us know and we'll tell you how to proceed.

If you have any questions or problems let us know.

 

James

 

EDIT: If you do not have the resources to make an image, you can try these free programs. I don't reccomend it except as a last resort and I have not had much luck with them when there is damage but sometimes they do work...

http://findandmount.com/

http://www.partition-tool.com/personal.htm


Edited by James Litten, 22 February 2013 - 04:29 PM.


#3 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 22 February 2013 - 10:02 PM

James,

Thank you, I was able to make an image but closed partedmagic before attempting the testdisk of the image so I booted it back up and see it however, I must be getting the syntax incorrect

it is named "image.dd"   I've tried several combinations based on the suggested usage within testdisk utility without success.  I have mounted the drive I have the image on also.   What am I missing?

 

Also, lets assume it is a good image, then how would you suggest I proceed to get my data?   I read on your links about using OSFMount? 

Lastly, would you suggest using a utility on partedmagic to format and wipe the drive that went RAW and try to reuse it (after testing of course)

 

Again, thank you for the help



#4 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 22 February 2013 - 10:32 PM

Excellent.

 

Can you see where the image.dd file is by using the FILE MANAGER on the desktop in PartedMagic? After you mount the drive, you should be able to use the File Manager to navigate to where it is. When you find it, you will see the path to use with TestDisk in the address bar of the File Manager.

 

For example, let's say it was in the root of partition sda1.

That means in PartedMagic, you would mount sda1 and the TestDisk command would be

testdisk /media/sda1/image.dd

 

You can also do this in Windows from a command prompt once you know where image.dd was in Windows.

 

For this example, let's say it is in the root directory of the C: drive so the TestDisk command would be (I'm using my path to testdisk_win.exe I'm sure yours is different)

C:\Users\Brak\Desktop\tools\testdisk-6.13.win\testdisk-6.13\testdisk_win.exe c:\image.dd

 

In Windows you can probably search for the file image.dd more easily than in PartedMagic if you aren't sure where it was written to.

 

I like OSFMount and how it makes the mounted image read only by default so you can copy files and not worry about accidentally overwriting them (you can uncheck a box to make it writable).

I often recover straight from TestDisk.

On the screen where you see your files and folders in Testdisk there are instructions at the bottom that tell how to copy recovered files straight from there.

 

Whenever you are ready, let me know and I'll give you some directions for checking the health of the drive and formatting it if it looks safe to use still.

 

Let us know if you have any other questions.

James



#5 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2013 - 08:42 PM

How embarassing, I left off "media"
In your windows example, you have testdisk installed (in your case in desktop tools,) you run the executable and specify the image you are "testing"

 

I ran from within partedmagic and got the same result.  I guess the good news is I have an image (simply a copy of my hd, literally "created in the bad one's image" :) )

 

I got the same error message about the mismatches and upon deeper scan found the same files listed however my missing data still hides.  Any suggestion on next steps?

 

Thank you



#6 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 24 February 2013 - 08:54 PM

LOL! Don't be embarassed. That kind of thing happens to me still on occassion.

 

Let me ask you a question that can help us a lot if you know the answer.

Do you know if the partition that was on that drive before you had problems was a FAT partition or an NTFS partition?

 

It looks like that at one time in the past it was one (NTFS or FAT) and then at a later time was formatted with the other type.

Knowing which type it was last will help us target the proper boot sector for repair.

 

James



#7 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2013 - 09:01 PM

Mr. Litten,
 

Thank you, it was NTFS...

 

Do you sleep?  :)



#8 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 24 February 2013 - 09:49 PM

smile.png I do a lot of work on active servers so my clients prefer that I do that during off-hours so if there is a problem, it causes a minimal impact on their traffic (like Sunday night).

 

Let's see if we can repair the NTFS boot sector and view the files.

 

Run TestDisk on the image again.


Make sure that your external disk is highlighted
Choose Proceed and hit enter
Select Intel and hit enter
Select Advanced and hit enter
If you see the NTFS partition listed, highlight it.
Select Boot and hit enter

 

Does it say that both the Boot sector and Backup boot sector are OK and Identical

 

Let us know if you do not see the NTFS partition listed.

 

James



#9 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2013 - 10:00 PM

Ah, makes sense.  Do that too for our change windows.
 

To be certain, you want me to run testdisk again on the image  but you mention to highlight the external disk? 

(I'm unclear do you want me to runtestdisk on the image or the external drive?)



#10 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 24 February 2013 - 10:18 PM

Sorry, run it on the image.

 

I copied that from pre-made scripts that I have :)

 

James



#11 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2013 - 10:32 PM

I do not see the NTFS but the FAT, not identical and not ok

 

 

Disk f:\image.dd - 20 GB / 18 GiB - CHS 2432 255 63
     Partition                  Start        End    Size in sectors
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017

Boot sector
Bad

Backup boot sector
OK

First sectors (Boot code and partition information) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.



#12 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 24 February 2013 - 10:47 PM

Okay, I'm not surprised.

 

I need to double-check the next step before telling you what I think needs to be done. I'm wrapped up in a job right now so I'll check this and post some instructions tomorrow.

 

We're going to try to make the NTFS partition visible and then fix its boot sector. At that point we might be able to see the files. If so, we'll do it on the actual drive and check its health. If it is okay then you'll be able to continue to use it and delete the image (unless you want to keep the image as a backup).

 

You're doing very well so far. If you have questions about what we are doing at any point, feel free to ask.

 

James



#13 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2013 - 10:52 PM

That sounds great, good time for me to focus elsewhere too. Thank you, your instructions are very good.   I'm not 100% on the capabilities testdisk is doing for me (or actually, what it is telling you) but I think you are letting me lead you to some logical paths. Thank you again for the great instruction, patience and guidance.  I will check back tomorrow.



#14 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:03:59 AM

Posted 25 February 2013 - 01:05 PM

Let's try to get a testdisk.log file for the QUICK SEARCH, DEEPER SEARCH and attempt to view the files in the NTFS partition (if it lets us)

Run TestDisk on the image again. But this time add the /log switch for example...
testdisk /log /media/sdb1/image.dd (or whatever your path is to image.dd)

The file testdisk.log will be created in the root folder which is a folder stored in the computer's RAM so it is erased when the computer is shutdown).
Select the image and choose Proceed and hit enter
It should automatically have Intel (if not, select Intel and let me know) hit enter
Select Analyse and hit enter
Select Quick Search and hit enter
Say 'Y' if it asks if the disk was made in Vista/Win7 (even if it was made in XP say 'yes')

If you see The NTFS partition, highlight it and press
p
and see if you can see your files and folders there.
If there is more than one NTFS partition listed check each one for files and folders by getting back to the list of partitions found (pressing q), highlighting the next one and pressing p again.

If you can see your files and folders and it all looks normal then stop here and go down to the section below called POST TESTDISK.LOG

If anything does not look correct then continue on to the DEEPER SEARCH. Get to the screen showing the partitions that it found and press ENTER to coninue.
DEEPER SEARCH is an option at the bottom of the screen.
Highlight it and press ENTER

After the DEEPER SEARCH finishes, if you see the NTFS partition, do the same thing with pressing p to see if you can see your files and folders in any of the partitions found and then press
q
a bunch of times to get out of TestDisk.

POST TESTDISK.LOG

On the PartedMagic desktop, double-click the File Manager icon.
In the left pane, you should see a folder called

root

Locate the testdisk.log file in that folder
Double-click it to open it.
Select all of the text in it and paste that text in your reply for us to look at.
Hopefully, you can open Firefox in PartedMagic and login here and reply. There is a wireless network connection icon in the lower right (by the clock) of the PartedMagic desktop if you need to connect to a wireless network.

If you can not get an internet connection from PartedMagic, you will need to mount the internal drive or a flash drive and copy the testdisk.log file from the root folder to it. Then you can get it to us via posting from Windows (Let us know if you need directions for doing this).

If anything looks different than I described or you have any questions/problems, stop and ask.

James



#15 mnechi

mnechi
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 26 February 2013 - 08:50 PM

Here goes, I think I ran it twice with the log:

 



Tue Feb 26 18:36:27 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=40007761920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=20003880960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=40007761920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=20003880960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=40007729664
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=20003848704
file_pread(4,1,buffer,78156224(4864/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,39086144(2432/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63, sector size=512 - SAMSUNG MP0402H, FW:UC200-16
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63, sector size=512 - IC25N020 ATCS04-0

Partition table type (auto): Intel
Disk /dev/sdb - 20 GB / 18 GiB - IC25N020 ATCS04-0
Partition table type: Intel

Analyse Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
sector_size  0
cluster_size 0
reserved     10762
fats         0
dir_entries  0
sectors      16128
media        00
fat_length   256
secs_track   0
heads        0
hidden       3120562176
total_sect   910775269
check_part_i386 failed for partition type 0C
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid FAT boot sector
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
file_pread(5,2,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,1,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,8,buffer,39070088(2432/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,39070096(2432/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,39070143(2432/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,39070159(2432/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,39070206(2432/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,39072128(2432/32/33)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
FAT32 at 0/1/7
FAT1 : 36-9569
FAT2 : 9570-19103
start_rootdir : 19104 root cluster : 2
Data : 19104-39070015
sectors : 39070017
cluster_size : 32
no_of_cluster : 1220341 (2 - 1220342)
fat_length 9534 calculated 9534
heads/cylinder 1 (FAT) != 255 (HD)
sect/track 48519 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/1/7
     FAT32                    0   1  1   140 238 33    2264064
     FAT found using backup sector!, 1159 MB / 1105 MiB
NTFS at 2430/254/63
filesystem size           39053952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
file_pread(5,2,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,1,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,7,buffer,39070081(2432/0/2)) lseek err Invalid argument
file_pread(5,8,buffer,39070088(2432/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,39070096(2432/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,39070143(2432/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,39070159(2432/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,39070206(2432/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,39072128(2432/32/33)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=3
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=3

Results
     FAT32                    0   1  1   140 254 63    2265102
     FAT found using backup sector!, 1159 MB / 1106 MiB
     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
Not an exFAT boot sector.

     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
sector_size  0
cluster_size 0
reserved     10762
fats         0
dir_entries  0
sectors      16128
media        00
fat_length   256
secs_track   0
heads        0
hidden       3120562176
total_sect   910775269
check_part_i386 failed for partition type 0C
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid FAT boot sector
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
 1 * FAT32 LBA                0   1  1  2431 254 63   39070017
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
file_pread(5,2,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,1,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,8,buffer,39070088(2432/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,39070096(2432/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,39070143(2432/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,39070159(2432/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,39070206(2432/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,39072128(2432/32/33)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sdb - 20 GB / 18 GiB - CHS 2432 255 63
FAT32 at 0/1/7
FAT1 : 36-9569
FAT2 : 9570-19103
start_rootdir : 19104 root cluster : 2
Data : 19104-39070015
sectors : 39070017
cluster_size : 32
no_of_cluster : 1220341 (2 - 1220342)
fat_length 9534 calculated 9534
heads/cylinder 1 (FAT) != 255 (HD)
sect/track 48519 (FAT) != 63 (HD)
set_FAT_info: name from BS used

FAT32 at 0/1/7
     FAT32                    0   1  1   140 238 33    2264064
     FAT found using backup sector!, 1159 MB / 1105 MiB
NTFS at 2430/254/63
filesystem size           39053952
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               16
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
file_pread(5,2,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,1,buffer,39071744(2432/26/27)) lseek err Invalid argument
file_pread(5,7,buffer,39070081(2432/0/2)) lseek err Invalid argument
file_pread(5,8,buffer,39070088(2432/0/9)) lseek err Invalid argument
file_pread(5,3,buffer,39070096(2432/0/17)) lseek err Invalid argument
file_pread(5,3,buffer,39070143(2432/1/1)) lseek err Invalid argument
file_pread(5,8,buffer,39070159(2432/1/17)) lseek err Invalid argument
file_pread(5,11,buffer,39070206(2432/2/1)) lseek err Invalid argument
file_pread(5,2,buffer,39072128(2432/32/33)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=3
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=3

Results
     FAT32                    0   1  1   140 254 63    2265102
     FAT found using backup sector!, 1159 MB / 1106 MiB
     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
Not an exFAT boot sector.

     HPFS - NTFS              0   1  1  2430 254 63   39053952
     NTFS found using backup sector!, 19 GB / 18 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.
 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users