Code:
Mon Dec 27 13:47:15 2010
Command line: TestDisk
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.35-24-generic (#42-Ubuntu SMP Thu Dec 2 02:41:37 UTC 2010)
Compiler: GCC 4.4 - Jun 23 2009 17:48:38
ext2fs lib: 1.41.12, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ATA SAMSUNG HM320HJ
Partition table type (auto): Intel
/dev/sda: Device Configuration Overlay (DCO) present.
Disk /dev/sda - 320 GB / 298 GiB - ATA SAMSUNG HM320HJ
Partition table type: Intel
Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type 42: no test
check_part_i386 2 type 42: no test
check_part_i386 3 type 42: no test
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=5
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=4
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P W2K Dynamic/SFS 0 1 1 0 32 32 1985
2 * W2K Dynamic/SFS 0 32 33 38 94 56 614400
3 P W2K Dynamic/SFS 38 94 57 26495 94 31 425031680
4 E extended 26495 126 62 38913 70 5 199491586
5 L Linux 26495 127 1 27740 91 63 19998720
X extended 38664 0 1 38913 70 5 4004600
6 L Linux Swap 38664 77 6 38913 70 5 3999744
X extended 27740 92 1 38663 234 35 175486976
7 L Linux 27740 124 33 38663 234 35 175484928
Computes LBA from CHS for Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
NTFS at 0/32/33
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size 425031680
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 26495 94 31 425031680
NTFS, 217 GB / 202 GiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=19/34, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 26495 127 1 27740 91 63 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
recover_EXT2: s_block_group_nr=0/669, s_mnt_count=17/21, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 21935616
recover_EXT2: part_size 175484928
Linux 27740 124 33 38663 234 35 175484928
EXT3 Large file Sparse superblock Recover, 89 GB / 83 GiB
Linux Swap 38664 77 6 38913 69 52 3999728
SWAP2 version 1, 2047 MB / 1952 MiB
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.
Results
* HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS, 314 MB / 300 MiB
P HPFS - NTFS 38 94 57 26495 94 31 425031680
NTFS, 217 GB / 202 GiB
P Linux 26495 127 1 27740 91 63 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
L Linux 27740 124 33 38663 234 35 175484928
EXT3 Large file Sparse superblock Recover, 89 GB / 83 GiB
L Linux Swap 38664 77 6 38913 69 52 3999728
SWAP2 version 1, 2047 MB / 1952 MiB
ntfs_device_testdisk_io_ioctl() unimplemented
dir_partition inode=5
* HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS, 314 MB / 300 MiB
Directory /
5 dr-xr-xr-x 0 0 0 3-Sep-2010 16:43 .
5 dr-xr-xr-x 0 0 0 3-Sep-2010 16:43 ..
38 dr-xr-xr-x 0 0 0 3-Sep-2010 16:31 $RECYCLE.BIN
43 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 Boot
97 -r--r--r-- 0 0 383562 14-Oct-2010 15:47 bootmgr
35 -r--r--r-- 0 0 33 3-Sep-2010 16:43 SYSTEM
36 dr-xr-xr-x 0 0 0 3-Sep-2010 16:24 System Volume Information
dir_partition inode=43
* HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS, 314 MB / 300 MiB
Directory /Boot
43 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 .
5 dr-xr-xr-x 0 0 0 3-Sep-2010 16:43 ..
104 -r--r--r-- 0 0 28672 14-Oct-2010 15:47 BCD
105 -r--r--r-- 0 0 25600 14-Oct-2010 15:47 BCD.LOG
106 -r--r--r-- 0 0 0 14-Oct-2010 15:47 BCD.LOG1
107 -r--r--r-- 0 0 0 14-Oct-2010 15:47 BCD.LOG2
44 -r--r--r-- 0 0 65536 14-Oct-2010 15:47 BOOTSTAT.DAT
45 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 cs-CZ
47 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 da-DK
49 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 de-DE
51 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 el-GR
54 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 en-US
57 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 es-ES
59 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 fi-FI
98 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 Fonts
61 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 fr-FR
63 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 hu-HU
66 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 it-IT
68 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 ja-JP
70 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 ko-KR
72 -r--r--r-- 0 0 485440 14-Oct-2010 15:47 memtest.exe
73 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 nb-NO
75 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 nl-NL
77 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 pl-PL
80 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 pt-BR
82 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 pt-PT
84 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 ru-RU
86 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 sv-SE
88 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 tr-TR
91 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 zh-CN
93 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 zh-HK
95 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 zh-TW
Directory /
5 dr-xr-xr-x 0 0 0 3-Sep-2010 16:43 .
5 dr-xr-xr-x 0 0 0 3-Sep-2010 16:43 ..
38 dr-xr-xr-x 0 0 0 3-Sep-2010 16:31 $RECYCLE.BIN
43 dr-xr-xr-x 0 0 0 14-Oct-2010 15:47 Boot
97 -r--r--r-- 0 0 383562 14-Oct-2010 15:47 bootmgr
35 -r--r--r-- 0 0 33 3-Sep-2010 16:43 SYSTEM
36 dr-xr-xr-x 0 0 0 3-Sep-2010 16:24 System Volume Information
interface_write()
1 * HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
2 P HPFS - NTFS 38 94 57 26495 94 31 425031680
3 P Linux 26495 127 1 27740 91 63 19998720
4 E extended LBA 27740 93 1 38913 254 63 179504451
5 L Linux 27740 124 33 38663 234 35 175484928
6 L Linux Swap 38664 77 6 38913 69 52 3999728
search_part()
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
NTFS at 0/32/33
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS, 314 MB / 300 MiB
NTFS at 38/94/56
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS found using backup sector!, 314 MB / 300 MiB
NTFS at 38/94/57
filesystem size 425031680
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 26495 94 31 425031680
NTFS, 217 GB / 202 GiB
recover_EXT2: s_block_group_nr=0/130, s_mnt_count=2/25, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4286464
recover_EXT2: part_size 34291712
Linux 6271 122 60 8406 10 52 34291712
EXT4 Large file Sparse superblock Recover, 17 GB / 16 GiB
recover_EXT2: s_block_group_nr=0/130, s_mnt_count=1/25, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4286464
recover_EXT2: part_size 34291712
Linux 6271 187 61 8406 75 53 34291712
EXT4 Large file Sparse superblock Recover, 17 GB / 16 GiB
NTFS at 19525/105/37
filesystem size 588873728
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 19525 105 37 56181 27 38 588873728
NTFS, 301 GB / 280 GiB
This partition ends after the disk limits. (start=313675776, size=588873728, end=902549503, disk end=625153410)
NTFS at 19635/239/61
filesystem size 588873728
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 19635 239 61 56291 161 62 588873728
NTFS, 301 GB / 280 GiB
This partition ends after the disk limits. (start=315451392, size=588873728, end=904325119, disk end=625153410)
NTFS at 20085/177/60
filesystem size 322060288
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 20085 177 60 322060288
NTFS found using backup sector!, 164 GB / 153 GiB
NTFS at 20085/177/61
filesystem size 266811392
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 20085 177 61 36693 239 26 266811392 [Linux]
NTFS, 136 GB / 127 GiB
NTFS at 20092/18/22
filesystem size 322162688
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 20092 18 22 322162688
NTFS found using backup sector!, 164 GB / 153 GiB
NTFS at 23945/185/48
filesystem size 384071680
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 23945 185 48 384071680
NTFS found using backup sector!, 196 GB / 183 GiB
NTFS at 26495/94/31
filesystem size 425031680
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 26495 94 31 425031680
NTFS found using backup sector!, 217 GB / 202 GiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=19/34, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 26495 127 1 27740 91 63 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=10/34, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 27107 40 6 28352 5 5 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=10/34, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 27109 82 46 28354 47 45 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=10/34, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 27111 157 55 28356 122 54 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=10/34, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2499840
recover_EXT2: part_size 19998720
Linux 27114 205 36 28359 170 35 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
recover_EXT2: s_block_group_nr=0/669, s_mnt_count=17/21, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 21935616
recover_EXT2: part_size 175484928
Linux 27740 124 33 38663 234 35 175484928
EXT3 Large file Sparse superblock Recover, 89 GB / 83 GiB
recover_EXT2: s_block_group_nr=0/669, s_mnt_count=17/21, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 21935616
recover_EXT2: part_size 175484928
Linux 33174 170 21 44098 25 23 175484928
EXT3 Large file Sparse superblock Recover, 89 GB / 83 GiB
This partition ends after the disk limits. (start=532951040, size=175484928, end=708435967, disk end=625153410)
NTFS at 36693/239/26
filesystem size 266811392
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 20085 177 61 36693 239 26 266811392 [Linux]
NTFS found using backup sector!, 136 GB / 127 GiB
NTFS at 36694/16/58
filesystem size 588873728
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 38 94 57 36694 16 58 588873728
NTFS found using backup sector!, 301 GB / 280 GiB
NTFS at 36694/16/59
filesystem size 31457280
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 36694 16 59 38652 48 52 31457280 [HP_RECOVERY]
NTFS, 16 GB / 15 GiB
NTFS at 38652/48/52
filesystem size 31457280
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 36694 16 59 38652 48 52 31457280 [HP_RECOVERY]
NTFS found using backup sector!, 16 GB / 15 GiB
FAT32 at 38652/48/53
FAT1 : 8242-12312
FAT2 : 12313-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4184063
sectors : 4184064
cluster_size : 8
no_of_cluster : 520960 (2 - 520961)
fat_length 4071 calculated 4071
FAT32 at 38652/48/53
FAT32 LBA 38652 48 53 38912 162 34 4184064 [HP_TOOLS]
FAT32, 2142 MB / 2043 MiB
FAT32 at 38652/48/59
FAT1 : 8242-12312
FAT2 : 12313-16383
start_rootdir : 16384 root cluster : 2
Data : 16384-4184063
sectors : 4184064
cluster_size : 8
no_of_cluster : 520960 (2 - 520961)
fat_length 4071 calculated 4071
FAT32 at 38652/48/59
FAT32 LBA 38652 48 53 38912 162 34 4184064 [[HP_Tools]]
FAT found using backup sector!, 2142 MB / 2043 MiB
Linux Swap 38664 77 6 38913 69 52 3999728
SWAP2 version 1, 2047 MB / 1952 MiB
NTFS at 38/94/56
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 38/94/56
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 38/94/56
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 38/94/56
filesystem size 614400
sectors_per_cluster 8
mft_lcn 25600
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 463 GB / 431 GiB)
The following partitions can't be recovered:
HPFS - NTFS 19525 105 37 56181 27 38 588873728
NTFS, 301 GB / 280 GiB
HPFS - NTFS 19635 239 61 56291 161 62 588873728
NTFS, 301 GB / 280 GiB
Linux 33174 170 21 44098 25 23 175484928
EXT3 Large file Sparse superblock Recover, 89 GB / 83 GiB
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.
Results
HPFS - NTFS 0 32 33 38 94 56 614400 [SYSTEM]
NTFS, 314 MB / 300 MiB
HPFS - NTFS 38 94 56 76 157 16 614400
NTFS, 314 MB / 300 MiB
HPFS - NTFS 38 94 57 20085 177 60 322060288
NTFS found using backup sector!, 164 GB / 153 GiB
HPFS - NTFS 38 94 57 20092 18 22 322162688
NTFS found using backup sector!, 164 GB / 153 GiB
HPFS - NTFS 38 94 57 23945 185 48 384071680
NTFS found using backup sector!, 196 GB / 183 GiB
HPFS - NTFS 38 94 57 26495 94 31 425031680
NTFS, 217 GB / 202 GiB
HPFS - NTFS 38 94 57 36694 16 58 588873728
NTFS found using backup sector!, 301 GB / 280 GiB
Linux 6271 122 60 8406 10 52 34291712
EXT4 Large file Sparse superblock Recover, 17 GB / 16 GiB
Linux 6271 187 61 8406 75 53 34291712
EXT4 Large file Sparse superblock Recover, 17 GB / 16 GiB
HPFS - NTFS 20085 177 61 36693 239 26 266811392 [Linux]
NTFS, 136 GB / 127 GiB
Linux 26495 127 1 27740 91 63 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
Linux 27107 40 6 28352 5 5 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
Linux 27109 82 46 28354 47 45 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
Linux 27111 157 55 28356 122 54 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
Linux 27114 205 36 28359 170 35 19998720
EXT3 Large file Sparse superblock Recover, 10239 MB / 9765 MiB
Linux 27740 124 33 38663 234 35 175484928
EXT3 Large file Sparse superblock Recover, 89 GB / 83 GiB
HPFS - NTFS 36694 16 59 38652 48 52 31457280 [HP_RECOVERY]
NTFS, 16 GB / 15 GiB
FAT32 LBA 38652 48 53 38912 162 34 4184064 [HP_TOOLS]
FAT32, 2142 MB / 2043 MiB
Linux Swap 38664 77 6 38913 69 52 3999728
SWAP2 version 1, 2047 MB / 1952 MiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Bookmarks