Jeffgesicht
Cadet 2nd Year
- Registriert
- Jan. 2021
- Beiträge
- 17
Hallo liebe CB Gemeinde,
ich habe 2 Seagate Barracuda mit je 3TB für Daten. Das OS ist auf einer MP600 SSD.
Beide Platten waren auf NTFS mit je einer großen Partition formatiert.
Nach einer Neuinstallation von Win10 wurde eine der Platten nicht mehr im Explorer angezeigt (ST3000DM001-1ER1).
In der Datenträgerverwaltung wurde sie als "online" gelistet aber die Kapazität wurde nicht angezeigt.
Mein erster Ansatz war eine Wiederherstellung der Partition mit "MiniTool Partition Wizard". Dies schlug fehl. Aber ich habe die Sektoren prüfen lassen, alle konnten ausgelesen werden.
Daraufhin versuchte ich Testdisk. Hier habe ich erst ein Quick Search gestartet (ca.6h). Daraufhin wurden 3 fat16 Partitionen gefunden. Eine davon schien die korrekte zu sein, also versuchte ich nach einer Recherche den Typ unter advanced auf NTFS zu setzen. Kein Erfolg.
Dann erst erneut den Quick Scan (6h) und im Anschluss den Deep Scan (6h). Hier hat es die NTFS Partition erkannt und auch das wohl ein Backup vorhanden sei.
Ich lies die übrigen 2 Fat16 Partitionen auf deleted und stellte die NTFS Partition auf Primary, not bootable. Dann auf wirte.
Status Boot Sector: Bad, Status Backup BS: Ok.
Also lies ich den defekten BS vom Backup überschreiben.
Danach waren beide ok und identical.
Bevor ich neustartete schaute ich umgehend unter advanced/boot und dort wurden nun beide, BS und dessen Backup nun doch als Bad angezeigt und not identical.
Nach einem Neustart wird die Platte im Explorer angezeigt, muss aber formatiert werden.
Wieder in Testdisk versuchte ich unter Advanced/Boot RebuildBS. Nach ca 4h kein Erfolg.
Als nächstes würde ich von dem was ich gelesen hatte versuchen die MFT zu reparieren, auch weil ich sonst keine Optionen sehe...
Hier nun mal die Log File:
Die zweite Seagate Platte (ST3000DM001-1CH1) konnte kurz darauf nach einem Transport mit PKW nicht mehr gefunden werden. Hier war eine Kopie meines "wichtigen" Ordners drauf. Somit habe ich beide Backups auf 2 von einander unabhängigen, physischen Platten innerhalb von 2 Wochen verloren. Dies ist ein gesondertes Problem, dem ich mich widme wenn dieses gelöst ist.
Ich hoffe die Gute Fee Fiona ist noch aktiv, liebe Grüße und danke im Voraus für die Hilfe!
ich habe 2 Seagate Barracuda mit je 3TB für Daten. Das OS ist auf einer MP600 SSD.
Beide Platten waren auf NTFS mit je einer großen Partition formatiert.
Nach einer Neuinstallation von Win10 wurde eine der Platten nicht mehr im Explorer angezeigt (ST3000DM001-1ER1).
In der Datenträgerverwaltung wurde sie als "online" gelistet aber die Kapazität wurde nicht angezeigt.
Mein erster Ansatz war eine Wiederherstellung der Partition mit "MiniTool Partition Wizard". Dies schlug fehl. Aber ich habe die Sektoren prüfen lassen, alle konnten ausgelesen werden.
Daraufhin versuchte ich Testdisk. Hier habe ich erst ein Quick Search gestartet (ca.6h). Daraufhin wurden 3 fat16 Partitionen gefunden. Eine davon schien die korrekte zu sein, also versuchte ich nach einer Recherche den Typ unter advanced auf NTFS zu setzen. Kein Erfolg.
Dann erst erneut den Quick Scan (6h) und im Anschluss den Deep Scan (6h). Hier hat es die NTFS Partition erkannt und auch das wohl ein Backup vorhanden sei.
Ich lies die übrigen 2 Fat16 Partitionen auf deleted und stellte die NTFS Partition auf Primary, not bootable. Dann auf wirte.
Status Boot Sector: Bad, Status Backup BS: Ok.
Also lies ich den defekten BS vom Backup überschreiben.
Danach waren beide ok und identical.
Bevor ich neustartete schaute ich umgehend unter advanced/boot und dort wurden nun beide, BS und dessen Backup nun doch als Bad angezeigt und not identical.
Nach einem Neustart wird die Platte im Explorer angezeigt, muss aber formatiert werden.
Wieder in Testdisk versuchte ich unter Advanced/Boot RebuildBS. Nach ca 4h kein Erfolg.
Als nächstes würde ich von dem was ich gelesen hatte versuchen die MFT zu reparieren, auch weil ich sonst keine Optionen sehe...
Hier nun mal die Log File:
Mon Jan 4 11:53:45 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
Failed to startup volume: Invalid argument.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=127909494784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=127909494784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C=499443990528
filewin32_getfilesize(\\.\F GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1ER1, S/N:Z5032ML6, FW:CC26
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, S/N:W1F2YV66, FW:CC24
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Force MP600, S/N:19358231000128545120, FW:EGFM
Disk /dev/sdd - 127 GB / 119 GiB - CHS 15550 255 63, sector size=512 - SAMSUNG SSD 830, S/N:S0WJNYAC308110, FW:CXM0
Partition table type (auto): Intel
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM001-1ER1
Partition table type: Intel
Interface Advanced
BAD_RS LBA=0 4294967295
check_part_i386 1 type 73: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 P Sys=73 0 0 1 715961557 87 2 0
Change partition type:
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Not an exFAT boot sector.
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Can't open filesystem. Filesystem seems damaged.
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
BAD_RS LBA=0 4294967295
check_part_i386 1 type 73: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 P Sys=73 0 0 1 715961557 87 2 0
Change partition type:
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
ntfs_boot_sector
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
file_pread(4,16,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
file_pread(4,1,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
filesystem size 18307350751681511485 1
sectors_per_cluster 31 0
mft_lcn 3455022539 0
mftmirr_lcn 4002087500 0
clusters_per_mft_record -53 0
clusters_per_index_record 60 0
Boot sector
Status: Bad
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
file_pread(4,1,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
filesystem size 18307350751681511485 1
sectors_per_cluster 31 0
mft_lcn 3455022539 0
mftmirr_lcn 4002087500 0
clusters_per_mft_record -53 0
clusters_per_index_record 60 0
Boot sector
Status: Bad
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
file_pread(4,1,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
filesystem size 18307350751681511485 1
sectors_per_cluster 31 0
mft_lcn 3455022539 0
mftmirr_lcn 4002087500 0
clusters_per_mft_record -53 0
clusters_per_index_record 60 0
Boot sector
Status: Bad
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=0 4294967295
check_part_i386 1 type 73: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P Sys=73 0 0 1 715961557 87 2 0
Warning: Bad starting sector (CHS and LBA don't match)
No partition is bootable
search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=2619618731 1670887
check_part_i386 failed for partition type 04
FAT16 <32M 163063 184 45 423830 115 17 4189217481
This partition ends after the disk limits. (start=2619618731, size=4189217481, end=6808836211, disk end=5860533168)
BAD_RS LBA=1691910741 8063
check_part_i386 failed for partition type 06
FAT16 >32M 105316 146 4 156898 74 4 828660295
NTFS at 209418/237/36
filesystem size 6102142976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
This partition ends after the disk limits. (start=3364315136, size=6102142976, end=9466458111, disk end=5860533168)
BAD_RS LBA=2751688591 15794273
file_pread(4,3,buffer,2751688591(438634/10/48)) lseek err Invalid argument
file_pread(4,1,buffer,2751688591(438634/10/48)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 438634 10 48 527537 191 1 1428238052
This partition ends after the disk limits. (start=7046655887, size=1428238052, end=8474893938, disk end=5860533168)
file_pread(4,2,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(4,14,buffer,1565566978(364801/98/36)) lseek err Invalid argument
file_pread(4,3,buffer,1565566992(364801/98/50)) lseek err Invalid argument
file_pread(4,3,buffer,1565567039(364801/99/34)) lseek err Invalid argument
file_pread(4,8,buffer,1565567055(364801/99/50)) lseek err Invalid argument
file_pread(4,11,buffer,1565567102(364801/100/34)) lseek err Invalid argument
file_pread(4,2,buffer,1565569024(364801/131/3)) lseek err Invalid argument
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4846 GB / 4513 GiB)
The following partitions can't be recovered:
FAT16 <32M 163063 184 45 423830 115 17 4189217481
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
FAT16 >32M 438634 10 48 527537 191 1 1428238052
Results
L FAT16 >32M 105316 146 4 156898 74 4 828660295
Change partition type:
* HPFS - NTFS 105316 146 4 156898 74 4 828660295
Can't open backup.log file: No such file or directory
interface_load
interface_write()
1 * HPFS - NTFS 105316 146 4 156898 74 4 828660295
search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=2619618731 1670887
check_part_i386 failed for partition type 04
FAT16 <32M 163063 184 45 423830 115 17 4189217481
This partition ends after the disk limits. (start=2619618731, size=4189217481, end=6808836211, disk end=5860533168)
NTFS at 70840/135/15
filesystem size 6102142976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=582683196928, part_size=3124297203712, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
BAD_RS LBA=1691910741 8063
check_part_i386 failed for partition type 06
FAT16 >32M 105316 146 4 156898 74 4 828660295
NTFS at 209418/237/36
filesystem size 6102142976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
This partition ends after the disk limits. (start=3364315136, size=6102142976, end=9466458111, disk end=5860533168)
BAD_RS LBA=2751688591 15794273
file_pread(4,3,buffer,2751688591(438634/10/48)) lseek err Invalid argument
file_pread(4,1,buffer,2751688591(438634/10/48)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 438634 10 48 527537 191 1 1428238052
This partition ends after the disk limits. (start=7046655887, size=1428238052, end=8474893938, disk end=5860533168)
NTFS at 364801/33/32
filesystem size 5860497408
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
file_pread(4,2,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,1565565952(364801/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,1565565952(364801/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1565566080(364801/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,1565566208(364801/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,1565566336(364801/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,1565566464(364801/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1565566592(364801/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,1565566720(364801/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,1565566848(364801/96/32)) lseek err Invalid argument
file_pread(4,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4846 GB / 4513 GiB)
The following partitions can't be recovered:
FAT16 <32M 163063 184 45 423830 115 17 4189217481
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
FAT16 >32M 438634 10 48 527537 191 1 1428238052
Results
HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
FAT16 >32M 105316 146 4 156898 74 4 828660295
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.
HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
interface_write()
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Can't open backup.log file: No such file or directory
interface_load
Not an exFAT boot sector.
P HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 2/10/9
filesystem size 15771701373372225491 5860497408
sectors_per_cluster 208 8
mft_lcn 2160906051 786432
mftmirr_lcn 553028721 2
clusters_per_mft_record -34 -10
clusters_per_index_record 39 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 2/10/9
NTFS at 2/10/9
filesystem size 5860497408
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
You will have to reboot for the change to take effect.
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Not an exFAT boot sector.
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
filesystem size 5860497408 16505260845100713232
sectors_per_cluster 8 215
mft_lcn 786432 110686519
mftmirr_lcn 2 2483146982
clusters_per_mft_record -10 -116
clusters_per_index_record 1 32
Boot sector
Error: size boot_sector 1565530112 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.
Tue Jan 5 19:55:31 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C=499443990528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D=2199023255040
filewin32_getfilesize(\\.\F GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG SSD 830, S/N:S0WJNYAC308110, FW:CXM0
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1ER1, S/N:Z5032ML6, FW:CC26
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, S/N:W1F2YV66, FW:CC24
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Force MP600, S/N:19358231000128545120, FW:EGFM
TestDisk exited normally.
Tue Jan 5 19:56:13 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C=499443990528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D=2199023255040
filewin32_getfilesize(\\.\F GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG SSD 830, S/N:S0WJNYAC308110, FW:CXM0
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1ER1, S/N:Z5032ML6, FW:CC26
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, S/N:W1F2YV66, FW:CC24
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Force MP600, S/N:19358231000128545120, FW:EGFM
Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM001-1ER1
Partition table type: Intel
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Not an exFAT boot sector.
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
filesystem size 5860497408 16505260845100713232
sectors_per_cluster 8 215
mft_lcn 786432 110686519
mftmirr_lcn 2 2483146982
clusters_per_mft_record -10 -116
clusters_per_index_record 1 32
Boot sector
Error: size boot_sector 1565530112 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 3117194542
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024
mft at 3117197646
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024
mft at 3364282384
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
Potential partition:
1 P HPFS - NTFS 194038 75 58 461387 164 60 4294967295
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
filesystem size 5860497408 16505260845100713232
sectors_per_cluster 8 215
mft_lcn 786432 110686519
mftmirr_lcn 2 2483146982
clusters_per_mft_record -10 -116
clusters_per_index_record 1 32
Boot sector
Error: size boot_sector 1565530112 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
Failed to startup volume: Invalid argument.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=127909494784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=127909494784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C=499443990528
filewin32_getfilesize(\\.\F GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1ER1, S/N:Z5032ML6, FW:CC26
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, S/N:W1F2YV66, FW:CC24
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Force MP600, S/N:19358231000128545120, FW:EGFM
Disk /dev/sdd - 127 GB / 119 GiB - CHS 15550 255 63, sector size=512 - SAMSUNG SSD 830, S/N:S0WJNYAC308110, FW:CXM0
Partition table type (auto): Intel
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM001-1ER1
Partition table type: Intel
Interface Advanced
BAD_RS LBA=0 4294967295
check_part_i386 1 type 73: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 P Sys=73 0 0 1 715961557 87 2 0
Change partition type:
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Not an exFAT boot sector.
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Can't open filesystem. Filesystem seems damaged.
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
BAD_RS LBA=0 4294967295
check_part_i386 1 type 73: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 P Sys=73 0 0 1 715961557 87 2 0
Change partition type:
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
ntfs_boot_sector
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
file_pread(4,16,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
file_pread(4,1,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
filesystem size 18307350751681511485 1
sectors_per_cluster 31 0
mft_lcn 3455022539 0
mftmirr_lcn 4002087500 0
clusters_per_mft_record -53 0
clusters_per_index_record 60 0
Boot sector
Status: Bad
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
file_pread(4,1,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
filesystem size 18307350751681511485 1
sectors_per_cluster 31 0
mft_lcn 3455022539 0
mftmirr_lcn 4002087500 0
clusters_per_mft_record -53 0
clusters_per_index_record 60 0
Boot sector
Status: Bad
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P HPFS - NTFS 0 0 1 715961557 87 2 0
file_pread(4,1,buffer,4294967295(715961557/87/2)) lseek err Invalid argument
filesystem size 18307350751681511485 1
sectors_per_cluster 31 0
mft_lcn 3455022539 0
mftmirr_lcn 4002087500 0
clusters_per_mft_record -53 0
clusters_per_index_record 60 0
Boot sector
Status: Bad
Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=0 4294967295
check_part_i386 1 type 73: no test
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P Sys=73 0 0 1 715961557 87 2 0
Warning: Bad starting sector (CHS and LBA don't match)
No partition is bootable
search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=2619618731 1670887
check_part_i386 failed for partition type 04
FAT16 <32M 163063 184 45 423830 115 17 4189217481
This partition ends after the disk limits. (start=2619618731, size=4189217481, end=6808836211, disk end=5860533168)
BAD_RS LBA=1691910741 8063
check_part_i386 failed for partition type 06
FAT16 >32M 105316 146 4 156898 74 4 828660295
NTFS at 209418/237/36
filesystem size 6102142976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
This partition ends after the disk limits. (start=3364315136, size=6102142976, end=9466458111, disk end=5860533168)
BAD_RS LBA=2751688591 15794273
file_pread(4,3,buffer,2751688591(438634/10/48)) lseek err Invalid argument
file_pread(4,1,buffer,2751688591(438634/10/48)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 438634 10 48 527537 191 1 1428238052
This partition ends after the disk limits. (start=7046655887, size=1428238052, end=8474893938, disk end=5860533168)
file_pread(4,2,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(4,14,buffer,1565566978(364801/98/36)) lseek err Invalid argument
file_pread(4,3,buffer,1565566992(364801/98/50)) lseek err Invalid argument
file_pread(4,3,buffer,1565567039(364801/99/34)) lseek err Invalid argument
file_pread(4,8,buffer,1565567055(364801/99/50)) lseek err Invalid argument
file_pread(4,11,buffer,1565567102(364801/100/34)) lseek err Invalid argument
file_pread(4,2,buffer,1565569024(364801/131/3)) lseek err Invalid argument
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4846 GB / 4513 GiB)
The following partitions can't be recovered:
FAT16 <32M 163063 184 45 423830 115 17 4189217481
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
FAT16 >32M 438634 10 48 527537 191 1 1428238052
Results
L FAT16 >32M 105316 146 4 156898 74 4 828660295
Change partition type:
* HPFS - NTFS 105316 146 4 156898 74 4 828660295
Can't open backup.log file: No such file or directory
interface_load
interface_write()
1 * HPFS - NTFS 105316 146 4 156898 74 4 828660295
search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=2619618731 1670887
check_part_i386 failed for partition type 04
FAT16 <32M 163063 184 45 423830 115 17 4189217481
This partition ends after the disk limits. (start=2619618731, size=4189217481, end=6808836211, disk end=5860533168)
NTFS at 70840/135/15
filesystem size 6102142976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=582683196928, part_size=3124297203712, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
BAD_RS LBA=1691910741 8063
check_part_i386 failed for partition type 06
FAT16 >32M 105316 146 4 156898 74 4 828660295
NTFS at 209418/237/36
filesystem size 6102142976
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
This partition ends after the disk limits. (start=3364315136, size=6102142976, end=9466458111, disk end=5860533168)
BAD_RS LBA=2751688591 15794273
file_pread(4,3,buffer,2751688591(438634/10/48)) lseek err Invalid argument
file_pread(4,1,buffer,2751688591(438634/10/48)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 438634 10 48 527537 191 1 1428238052
This partition ends after the disk limits. (start=7046655887, size=1428238052, end=8474893938, disk end=5860533168)
NTFS at 364801/33/32
filesystem size 5860497408
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
file_pread(4,2,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(4,8,buffer,1565565952(364801/82/18)) lseek err Invalid argument
file_pread(4,1,buffer,1565565952(364801/82/18)) lseek err Invalid argument
file_pread(4,8,buffer,1565566080(364801/84/20)) lseek err Invalid argument
file_pread(4,8,buffer,1565566208(364801/86/22)) lseek err Invalid argument
file_pread(4,8,buffer,1565566336(364801/88/24)) lseek err Invalid argument
file_pread(4,8,buffer,1565566464(364801/90/26)) lseek err Invalid argument
file_pread(4,8,buffer,1565566592(364801/92/28)) lseek err Invalid argument
file_pread(4,8,buffer,1565566720(364801/94/30)) lseek err Invalid argument
file_pread(4,8,buffer,1565566848(364801/96/32)) lseek err Invalid argument
file_pread(4,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(4,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4846 GB / 4513 GiB)
The following partitions can't be recovered:
FAT16 <32M 163063 184 45 423830 115 17 4189217481
HPFS - NTFS 209418 237 36 589259 194 55 6102142976
NTFS, blocksize=4096, 3124 GB / 2909 GiB
FAT16 >32M 438634 10 48 527537 191 1 1428238052
Results
HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
FAT16 >32M 105316 146 4 156898 74 4 828660295
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.
HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
Can't open backup.log file: No such file or directory
interface_load
interface_write()
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Can't open backup.log file: No such file or directory
interface_load
Not an exFAT boot sector.
P HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 2/10/9
filesystem size 15771701373372225491 5860497408
sectors_per_cluster 208 8
mft_lcn 2160906051 786432
mftmirr_lcn 553028721 2
clusters_per_mft_record -34 -10
clusters_per_index_record 39 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 2/10/9
NTFS at 2/10/9
filesystem size 5860497408
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
You will have to reboot for the change to take effect.
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Not an exFAT boot sector.
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
filesystem size 5860497408 16505260845100713232
sectors_per_cluster 8 215
mft_lcn 786432 110686519
mftmirr_lcn 2 2483146982
clusters_per_mft_record -10 -116
clusters_per_index_record 1 32
Boot sector
Error: size boot_sector 1565530112 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.
Tue Jan 5 19:55:31 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C=499443990528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D=2199023255040
filewin32_getfilesize(\\.\F GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG SSD 830, S/N:S0WJNYAC308110, FW:CXM0
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1ER1, S/N:Z5032ML6, FW:CC26
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, S/N:W1F2YV66, FW:CC24
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Force MP600, S/N:19358231000128545120, FW:EGFM
TestDisk exited normally.
Tue Jan 5 19:56:13 2021
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C=499443990528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D=2199023255040
filewin32_getfilesize(\\.\F GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\F SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\F:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG SSD 830, S/N:S0WJNYAC308110, FW:CXM0
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1ER1, S/N:Z5032ML6, FW:CC26
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM001-1CH1, S/N:W1F2YV66, FW:CC24
Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Force MP600, S/N:19358231000128545120, FW:EGFM
Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB - ST3000DM001-1ER1
Partition table type: Intel
New options :
Dump : No
Align partition: Yes
Expert mode : No
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Not an exFAT boot sector.
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
Can't open filesystem. Filesystem seems damaged.
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
filesystem size 5860497408 16505260845100713232
sectors_per_cluster 8 215
mft_lcn 786432 110686519
mftmirr_lcn 2 2483146982
clusters_per_mft_record -10 -116
clusters_per_index_record 1 32
Boot sector
Error: size boot_sector 1565530112 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 3117194542
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024
mft at 3117197646
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024
mft at 3364282384
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
Potential partition:
1 P HPFS - NTFS 194038 75 58 461387 164 60 4294967295
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
1 P HPFS - NTFS 2 10 9 267351 99 11 4294967295
NTFS at 2/10/9
Error: size boot_sector 1565530112 > partition 4294967295
filesystem size 5860497408 16505260845100713232
sectors_per_cluster 8 215
mft_lcn 786432 110686519
mftmirr_lcn 2 2483146982
clusters_per_mft_record -10 -116
clusters_per_index_record 1 32
Boot sector
Error: size boot_sector 1565530112 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
- Bei all dem habe ich keinen Schritt getan ohne zuvor (meist hier) Anleitungen zu studieren um nichts dauerhaft zu beschädigen. Ich habe auch den FAQ (https://www.computerbase.de/forum/threads/faq-datenrettung-testdisk-anleitung.110869/) dazu zu Rate gezogen.
- Eine Sache ist mir aufgefallen, nach dem Deep Scan waren die Startwerte der Partition für cylinder head und sector weder 0 noch 1, sondern
1 P HPFS - NTFS 2 10 9 364801 33 32 5860497408 - Ich konnte mir zu keinem Zeitpunkt den Inhalt der Platte bei Testdisk anzeigen lassen.
Die zweite Seagate Platte (ST3000DM001-1CH1) konnte kurz darauf nach einem Transport mit PKW nicht mehr gefunden werden. Hier war eine Kopie meines "wichtigen" Ordners drauf. Somit habe ich beide Backups auf 2 von einander unabhängigen, physischen Platten innerhalb von 2 Wochen verloren. Dies ist ein gesondertes Problem, dem ich mich widme wenn dieses gelöst ist.
Ich hoffe die Gute Fee Fiona ist noch aktiv, liebe Grüße und danke im Voraus für die Hilfe!
Zuletzt bearbeitet von einem Moderator: