boardbreaker
Cadet 1st Year
- Registriert
- Okt. 2012
- Beiträge
- 14
Hallo zusammen,
habe mich hier durch eure interessanten Beiträge gelesen und habe seit gestern ein Problem:
Windows meldete mir "$Mft: "Datenverlust beim schreiben"
Im Ereignisprotokoll fand sich Folgendes:
Dann habe ich noch Folgendes Ereignis:
Siehe Anhang Auslagerungsvorgang.
Habe dann das Tool testdisk drüber laufen lassen und wolte mal fragen,
ob meine HD ('s) soweit in Ordnung sind ?
Abgeklemmt habe ich die zweite externe Platte ( 1 GB ) . Die teste ich gerade an meinem NOtebook und dauert noch ..
Hier ist das LOG vom Tool:
Wäre klasse, wenn da jemand mal drauf schauen und mir was dazu sagen könnte.
TX in advance
Roger
EDITH: Übersichtlichkeit verbessert
habe mich hier durch eure interessanten Beiträge gelesen und habe seit gestern ein Problem:
Windows meldete mir "$Mft: "Datenverlust beim schreiben"
Im Ereignisprotokoll fand sich Folgendes:
Code:
Anwendungspopup: Windows - Datenverlust
beim Schreiben: Es konnten nicht alle Daten für
die Datei \$Mft gespeichert werden. Die Daten
gingen verloren. Mögliche Ursache könnten
Computerhardware oder Netzwerkverbindungen
sein. Versuchen Sie, die Dateien woanders zu
speichern.
Dann habe ich noch Folgendes Ereignis:
Siehe Anhang Auslagerungsvorgang.
Habe dann das Tool testdisk drüber laufen lassen und wolte mal fragen,
ob meine HD ('s) soweit in Ordnung sind ?
Abgeklemmt habe ich die zweite externe Platte ( 1 GB ) . Die teste ich gerade an meinem NOtebook und dauert noch ..
Hier ist das LOG vom Tool:
Code:
Tue Dec 11 14:13:00 2012
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
[url]http://www.cgsecurity.org[/url]
OS: Windows XP SP2
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=19707738624
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=20974431744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=320070288384
file_pread(4,1,buffer,156312449(9729/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,625153409(38913/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - WDC WD800JB-00ETA0, S/N:4457572d41434c48373435333031 033 0 0 0 0, FW:77.07W77
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Seagate FreeAgent Go, FW:102F
Partition table type (auto): Intel
Disk /dev/sda - 80 GB / 74 GiB - WDC WD800JB-00ETA0
Partition table type: Intel
Analyse Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 2396/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
2 E extended LBA 2396 0 1 4945 254 63 40965750
5 L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0
search_part()
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63
NTFS at 0/1/1
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
NTFS at 2396/1/1
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
2 E extended LBA 2396 0 1 4945 254 63 40965750
5 L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
search_part()
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63
NTFS at 0/1/1
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
NTFS at 2395/254/63
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS found using backup sector!, 19 GB / 18 GiB
NTFS at 2396/1/1
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
NTFS at 4945/254/63
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS found using backup sector!, 20 GB / 19 GiB
NTFS at 9727/254/63
filesystem size 156280257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 9767516
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 9727 254 63 156280257 [BOOT XP]
NTFS found using backup sector!, 80 GB / 74 GiB
file_pread(4,2,buffer,156311697(9729/243/4)) lseek err Invalid argument
file_pread(4,1,buffer,156311697(9729/243/4)) lseek err Invalid argument
file_pread(4,2,buffer,156311760(9729/244/4)) lseek err Invalid argument
file_pread(4,2,buffer,156311823(9729/245/4)) lseek err Invalid argument
file_pread(4,1,buffer,156312449(9729/254/63)) lseek err Invalid argument
file_pread(4,1,buffer,156312450(9730/0/1)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=6
Results
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
HPFS - NTFS 0 1 1 9727 254 63 156280257 [BOOT XP]
NTFS found using backup sector!, 80 GB / 74 GiB
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 2396/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
2 E extended LBA 2396 0 1 4945 254 63 40965750
5 L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sda - 80 GB / 74 GiB - CHS 9730 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sda - 80 GB / 74 GiB - CHS 9730 255 63
NTFS at 0/1/1
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
NTFS at 2396/1/1
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
file_pread(4,2,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(4,7,buffer,156303361(9729/110/47)) lseek err Invalid argument
file_pread(4,8,buffer,156303368(9729/110/54)) lseek err Invalid argument
file_pread(4,3,buffer,156303376(9729/110/62)) lseek err Invalid argument
file_pread(4,3,buffer,156303423(9729/111/46)) lseek err Invalid argument
file_pread(4,8,buffer,156303439(9729/111/62)) lseek err Invalid argument
file_pread(4,11,buffer,156303486(9729/112/46)) lseek err Invalid argument
file_pread(4,2,buffer,156305408(9729/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
2 E extended LBA 2396 0 1 4945 254 63 40965750
5 L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
search_part()
Disk /dev/sda - 80 GB / 74 GiB - CHS 9730 255 63
NTFS at 0/1/1
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
NTFS at 2395/254/63
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS found using backup sector!, 19 GB / 18 GiB
NTFS at 2396/1/1
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
NTFS at 4945/254/63
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS found using backup sector!, 20 GB / 19 GiB
NTFS at 9727/254/63
filesystem size 156280257
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 9767516
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 9727 254 63 156280257 [BOOT XP]
NTFS found using backup sector!, 80 GB / 74 GiB
file_pread(4,2,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,156303359(9729/110/45)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=3
get_geometry_from_list_part_aux head=32 nbr=3
get_geometry_from_list_part_aux head=64 nbr=3
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=6
Results
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
HPFS - NTFS 0 1 1 9727 254 63 156280257 [BOOT XP]
NTFS found using backup sector!, 80 GB / 74 GiB
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sda - 80 GB / 74 GiB - CHS 9730 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 2396/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
2 E extended LBA 2396 0 1 4945 254 63 40965750
5 L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sda - 80 GB / 74 GiB - CHS 9730 255 63
NTFS at 0/1/1
filesystem size 38491677
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 601579
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
NTFS at 2396/1/1
filesystem size 40965687
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2560355
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
file_pread(4,2,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(4,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(4,7,buffer,156303361(9729/110/47)) lseek err Invalid argument
file_pread(4,8,buffer,156303368(9729/110/54)) lseek err Invalid argument
file_pread(4,3,buffer,156303376(9729/110/62)) lseek err Invalid argument
file_pread(4,3,buffer,156303423(9729/111/46)) lseek err Invalid argument
file_pread(4,8,buffer,156303439(9729/111/62)) lseek err Invalid argument
file_pread(4,11,buffer,156303486(9729/112/46)) lseek err Invalid argument
file_pread(4,2,buffer,156305408(9729/143/15)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
* HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
NTFS, 19 GB / 18 GiB
L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
NTFS, 20 GB / 19 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 2395 254 63 38491677 [BOOT XP]
2 E extended LBA 2396 0 1 4945 254 63 40965750
5 L HPFS - NTFS 2396 1 1 4945 254 63 40965687 [DATA E]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 2396/0/1,lba=38491740
TestDisk exited normally.
Wäre klasse, wenn da jemand mal drauf schauen und mir was dazu sagen könnte.
TX in advance
Roger
EDITH: Übersichtlichkeit verbessert
Anhänge
Zuletzt bearbeitet: