Code:
Wed Oct 3 08:32:17 2012
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.38-15-generic (#66-Ubuntu SMP Tue Aug 14 17:25:35 UTC 2012) i686
Compiler: GCC 4.4
Compilation date: 2011-11-15T02:42:19
ext2fs lib: 1.41.9, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
/dev/sdb: LBA, HPA, DCO support
/dev/sdb: size 240121728 sectors
/dev/sdb: user_max 240121728 sectors
/dev/sdb: native_max 240121728 sectors
/dev/sdb: dco 240121728 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKS-00YGA0, S/N:WD-WCAS80666962, FW:12.01C02
Disk /dev/sdb - 122 GB / 114 GiB - CHS 14946 255 63, sector size=512 - Maxtor 6Y120P0, S/N:Y428XQAE, FW:YAR41BW0
Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000AAKS-00YGA0
Partition table type: Intel
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 60800 254 63 976768002
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
file_pread(4,16,buffer,6291519(391/160/25)) read err: Partial read
file_pread(4,16,buffer,6291535(391/160/41)) read err: Input/output error
file_pread(4,1,buffer,6291535(391/160/41)) read err: Input/output error
file_pread(4,16,buffer,404067022(25152/2/17)) read err: Partial read
file_pread(4,1,buffer,404067024(25152/2/19)) read err: Input/output error
file_pread(4,16,buffer,434133118(27023/136/56)) read err: Input/output error
file_pread(4,16,buffer,489934321(30497/0/17)) read err: Partial read
file_pread(4,16,buffer,624117776(38849/136/24)) read err: Input/output error
file_pread(4,16,buffer,624117823(38849/137/8)) read err: Input/output error
file_pread(4,1,buffer,624117823(38849/137/8)) read err: Input/output error
Results
interface_write()
No partition found or selected for recovery
ntfs_mst_post_read_fixup: magic: 0x16f60725 size: 1024 usa_ofs: 45381 usa_count: 42767: Invalid argument
ntfs_mst_post_read_fixup: magic: 0x6f98f57e size: 1024 usa_ofs: 6458 usa_count: 53774: Invalid argument
ntfs_mst_post_read_fixup: magic: 0x3e1ceecb size: 1024 usa_ofs: 60487 usa_count: 3060: Invalid argument
ntfs_mst_post_read_fixup: magic: 0x9a1a8123 size: 1024 usa_ofs: 13201 usa_count: 61543: Invalid argument
$MFTMirr error: Invalid mft record for '$MFT'.
ntfs_mst_post_read_fixup: magic: 0x83ca33c3 size: 1024 usa_ofs: 34351 usa_count: 7159: Invalid argument
Record 5 has no FILE magic (0x83ca33c3)
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
file_pread(4,16,buffer,6291519(391/160/25)) read err: Partial read
file_pread(4,16,buffer,411987114(25645/3/1)) read err: Input/output error
file_pread(4,1,buffer,411987114(25645/3/1)) read err: Input/output error
file_pread(4,16,buffer,436132619(27147/254/63)) read err: Input/output error
file_pread(4,1,buffer,436132635(27148/0/16)) read err: Input/output error
file_pread(4,16,buffer,437997119(27264/15/15)) read err: Input/output error
file_pread(4,1,buffer,437997119(27264/15/15)) read err: Input/output error
file_pread(4,16,buffer,543326208(33820/125/34)) read err: Input/output error
file_pread(4,16,buffer,624117823(38849/137/8)) read err: Partial read
file_pread(4,1,buffer,624117824(38849/137/9)) read err: Input/output error
file_pread(4,16,buffer,675958910(42076/126/33)) read err: Partial read
NTFS at 60800/254/63
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS found using backup sector!, 500 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS found using backup sector!, 500 GB / 465 GiB
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.
ntfs_ucstoutf8: iconv_open failed
dir_partition inode=5
* HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS found using backup sector!, 500 GB / 465 GiB
ntfs_dir: ntfs_inode_open failed
Directory /
interface_write()
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS found using backup sector!, 500 GB / 465 GiB
NTFS at 0/1/1
filesystem size 4800649661878086548 976768002
sectors_per_cluster 41 8
mft_lcn 4144205775 61048000
mftmirr_lcn 968488652 2
clusters_per_mft_record -62 -10
clusters_per_index_record 81 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_mst_post_read_fixup: magic: 0x16f60725 size: 1024 usa_ofs: 45381 usa_count: 42767: Invalid argument
ntfs_mst_post_read_fixup: magic: 0x6f98f57e size: 1024 usa_ofs: 6458 usa_count: 53774: Invalid argument
ntfs_mst_post_read_fixup: magic: 0x3e1ceecb size: 1024 usa_ofs: 60487 usa_count: 3060: Invalid argument
ntfs_mst_post_read_fixup: magic: 0x9a1a8123 size: 1024 usa_ofs: 13201 usa_count: 61543: Invalid argument
$MFTMirr error: Invalid mft record for '$MFT'.
ntfs_mst_post_read_fixup: magic: 0x83ca33c3 size: 1024 usa_ofs: 34351 usa_count: 7159: Invalid argument
Record 5 has no FILE magic (0x83ca33c3)
rebuild_NTFS_BS
mft at 488384000, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 61048000
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 61048000
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 976768002 4800649661878086548
sectors_per_cluster 8 41
mft_lcn 61048000 4144205775
mftmirr_lcn 2 968488652
clusters_per_mft_record -10 -62
clusters_per_index_record 1 81
Extrapolated boot sector and current boot sector are different.
filesystem size 976768002 4800649661878086548
sectors_per_cluster 8 41
mft_lcn 61048000 4144205775
mftmirr_lcn 2 968488652
clusters_per_mft_record -10 -62
clusters_per_index_record 1 81
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.
ntfs_ucstoutf8: iconv_open failed
ntfs_dir: ntfs_inode_open failed
Directory /
filesystem size 976768002 4800649661878086548
sectors_per_cluster 8 41
mft_lcn 61048000 4144205775
mftmirr_lcn 2 968488652
clusters_per_mft_record -10 -62
clusters_per_index_record 1 81
Write new boot!
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS found using backup sector!, 500 GB / 465 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_mst_post_read_fixup: magic: 0x4874f1d4 size: 1024 usa_ofs: 33801 usa_count: 42269: Invalid argument
Record 6 has no FILE magic (0x4874f1d4)
Failed to open inode FILE_Bitmap: Input/output error
ntfs_mst_post_read_fixup: magic: 0x83ca33c3 size: 1024 usa_ofs: 34351 usa_count: 7159: Invalid argument
Record 5 has no FILE magic (0x83ca33c3)
ntfs_mst_post_read_fixup: magic: 0x16f60725 size: 1024 usa_ofs: 45381 usa_count: 42767: Invalid argument
Record 0 has no FILE magic (0x16f60725)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup: magic: 0x16f60725 size: 1024 usa_ofs: 45381 usa_count: 42767: Invalid argument
Record 0 has no FILE magic (0x16f60725)
Failed to load $MFT: Input/output error
repair_MFT
NTFS at 0/1/1
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.
ntfs_ucstoutf8: iconv_open failed
ntfs_dir: ntfs_inode_open failed
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS, 500 GB / 465 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 488384000, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 61048000
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 61048000
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Rebuild Boot sector Boot sector
0000 3cc0464e 54465320 <.FNTFS 3cc0464e 54465320 <.FNTFS
0008 20202000 02080000 ..... 20202000 02080000 .....
0010 00000000 00f80000 ........ 00000000 00f80000 ........
0018 3f00ff00 3f000000 ?...?... 3f00ff00 3f000000 ?...?...
0020 00000000 b3b29ddb ........ 00000000 b3b29ddb ........
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.
ntfs_ucstoutf8: iconv_open failed
ntfs_dir: ntfs_inode_open failed
Directory /
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS, 500 GB / 465 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_mst_post_read_fixup: magic: 0x4874f1d4 size: 1024 usa_ofs: 33801 usa_count: 42269: Invalid argument
Record 6 has no FILE magic (0x4874f1d4)
Failed to open inode FILE_Bitmap: Input/output error
ntfs_mst_post_read_fixup: magic: 0x83ca33c3 size: 1024 usa_ofs: 34351 usa_count: 7159: Invalid argument
Record 5 has no FILE magic (0x83ca33c3)
ntfs_mst_post_read_fixup: magic: 0x16f60725 size: 1024 usa_ofs: 45381 usa_count: 42767: Invalid argument
Record 0 has no FILE magic (0x16f60725)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup: magic: 0x16f60725 size: 1024 usa_ofs: 45381 usa_count: 42767: Invalid argument
Record 0 has no FILE magic (0x16f60725)
Failed to load $MFT: Input/output error
repair_MFT
NTFS at 0/1/1
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
NTFS filesystem need to be repaired.
ntfs_ucstoutf8: iconv_open failed
ntfs_dir: ntfs_inode_open failed
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.
ntfs_boot_sector
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [New_Volume]
NTFS, 500 GB / 465 GiB
NTFS at 0/1/1
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 61048000
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.
TestDisk exited normally.
Bookmarks