Sat Nov 13 21:26:06 2010 Command line: TestDisk TestDisk 6.12-WIP, Data Recovery Utility, April 2010 Christophe GRENIER http://www.cgsecurity.org OS: Linux, kernel 2.6.31.2 (#5 SMP Mon Dec 7 11:56:35 UTC 2009) i686 Compiler: GCC 4.4 - Jul 27 2010 17:00:22 ext2fs lib: 1.41.9, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501 /dev/sda: LBA, HPA, LBA48, DCO support /dev/sda: size 625142448 sectors /dev/sda: user_max 625142448 sectors /dev/sda: native_max 625142448 sectors /dev/sda: dco 625142448 sectors Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512 Hard disk list Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ATA WDC WD3200AAKS-7 Disk /dev/sdb - 529 MB / 505 MiB - CHS 1013 17 60, sector size=512 - Alcor USB 2.0 FLASH Disk /dev/sdc - 4141 MB / 3950 MiB - CHS 1019 128 62, sector size=512 - Kingston DataTraveler 2.0 Partition table type (auto): Intel Disk /dev/sda - 320 GB / 298 GiB - ATA WDC WD3200AAKS-7 Partition table type: Intel Analyse Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63 Geometry from i386 MBR: head=255 sector=63 check_part_i386 1 type DE: no test NTFS at 7/2/60 Info: size boot_sector 20971520, partition 20980705 NTFS at 1312/109/14 Info: size boot_sector 604055552, partition 604069250 get_geometry_from_list_part_aux head=255 nbr=2 get_geometry_from_list_part_aux head=8 nbr=1 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=2 Current partition structure: 1 P Dell Utility 0 1 1 6 254 63 112392 2 P HPFS - NTFS 7 2 60 1312 254 63 20980705 [RECOVERY] 3 * HPFS - NTFS 1312 109 14 38913 254 63 604069250 Space conflict between the following two partitions 2 P HPFS - NTFS 7 2 60 1312 254 63 20980705 [RECOVERY] 3 * HPFS - NTFS 1312 109 14 38913 254 63 604069250 Ask the user for vista mode Computes LBA from CHS for Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63 Allow partial last cylinder : Yes search_vista_part: 1 search_part() Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63 FAT16 at 0/1/1 FAT1 : 1-110 FAT2 : 111-220 start_rootdir : 221 Data : 253-112388 sectors : 112392 cluster_size : 4 no_of_cluster : 28034 (2 - 28035) fat_length 110 calculated 110 FAT16 at 0/1/1 FAT16 >32M 0 1 1 6 254 63 112392 [DellUtility] FAT16, 57 MB / 54 MiB FAT32 at 7/0/1 FAT1 : 32-8229 FAT2 : 8230-16427 start_rootdir : 16428 root cluster : 2 Data : 16428-67119531 sectors : 67119570 cluster_size : 64 no_of_cluster : 1048486 (2 - 1048487) fat_length 8198 calculated 8192 FAT differs, FAT sectors=0-16/8198 set_FAT_info: name from BS used FAT32 at 7/0/1 FAT32 LBA 7 0 1 4184 254 63 67119570 [ Unlabeled] FAT32, 34 GB / 32 GiB NTFS at 21158/52/15 filesystem size 604055552 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 2 clusters_per_mft_record -10 clusters_per_index_record 1 HPFS - NTFS 21158 52 15 58758 235 37 604055552 NTFS, 309 GB / 288 GiB This partition ends after the disk limits. (start=339906560, size=604055552, end=943962111, disk end=625153410) Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63 Check the harddisk size: HD jumpers settings, BIOS detection... The harddisk (320 GB / 298 GiB) seems too small! (< 483 GB / 450 GiB) The following partition can't be recovered: HPFS - NTFS 21158 52 15 58758 235 37 604055552 NTFS, 309 GB / 288 GiB get_geometry_from_list_part_aux head=255 nbr=4 get_geometry_from_list_part_aux head=8 nbr=2 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=4 Results * FAT16 >32M 0 1 1 6 254 63 112392 [DellUtility] FAT16, 57 MB / 54 MiB P FAT32 LBA 7 0 1 4184 254 63 67119570 [ Unlabeled] FAT32, 34 GB / 32 GiB dir_partition inode=0 P FAT32 LBA 7 0 1 4184 254 63 67119570 [ Unlabeled] FAT32, 34 GB / 32 GiB FAT: cluster=2(0x2), pos=128883 Directory / 151259910 -rwxr-xr-x 0 0 135530748 30-Jan-1984 01:08  33427710 -rwxr-xr-x 0 0 296226928 2-Sep-1988 10:09 URP 16519935 -r-xr-xr-x 0 0 294786130 2-Dec-1988 10:04 "" 16388862 -rwxr-xr-x 0 0 290067714 31-Jul-1988 10:28 ""* 16523140 -r-xr-xr-x 0 0 252184828 28-Jul-1988 04:00 $ interface_write() 1 * FAT16 >32M 0 1 1 6 254 63 112392 [DellUtility] 2 P FAT32 LBA 7 0 1 4184 254 63 67119570 [ Unlabeled] simulate write! write_mbr_i386: starting... write_all_log_i386: starting... No extended partition Interface Advanced Geometry from i386 MBR: head=255 sector=63 check_part_i386 1 type DE: no test NTFS at 7/2/60 Info: size boot_sector 20971520, partition 20980705 NTFS at 1312/109/14 Info: size boot_sector 604055552, partition 604069250 get_geometry_from_list_part_aux head=255 nbr=2 get_geometry_from_list_part_aux head=8 nbr=1 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=2 1 P Dell Utility 0 1 1 6 254 63 112392 2 P HPFS - NTFS 7 2 60 1312 254 63 20980705 [RECOVERY] NTFS, 10 GB / 10 GiB 3 * HPFS - NTFS 1312 109 14 38913 254 63 604069250 NTFS, 309 GB / 288 GiB ntfs_boot_sector 3 * HPFS - NTFS 1312 109 14 38913 254 63 604069250 NTFS, 309 GB / 288 GiB NTFS at 1312/109/14 Info: size boot_sector 604055552, partition 604069250 filesystem size 604055552 1 sectors_per_cluster 8 0 mft_lcn 786432 0 mftmirr_lcn 2 0 clusters_per_mft_record -10 0 clusters_per_index_record 1 0 Boot sector Status: OK Backup boot sector ntfs_boot_sector: Can't read backup boot sector. Status: Bad Sectors are not identical. A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable. Boot sector Backup boot sector 0000 eb52904e 54465320 .R.NTFS 00000000 00000000 ........ 0008 20202000 02080000 ..... 00000000 00000000 ........ 0010 00000000 00f80000 ........ 00000000 00000000 ........ 0018 3f00ff00 00b84101 ?.....A. 00000000 00000000 ........ 0020 00000000 80008000 ........ 00000000 00000000 ........ 0028 ff270124 00000000 .'.$.... 00000000 00000000 ........ 0030 00000c00 00000000 ........ 00000000 00000000 ........ 0038 02000000 00000000 ........ 00000000 00000000 ........ 0040 f6000000 01000000 ........ 00000000 00000000 ........ 0048 6130f8b4 58f8b462 a0..X..b 00000000 00000000 ........ 0050 00000000 fa33c08e .....3.. 00000000 00000000 ........ 0058 d0bc007c fb68c007 ...|.h.. 00000000 00000000 ........ 0060 1f1e6866 00cb8816 ..hf.... 00000000 00000000 ........ 0068 0e006681 3e03004e ..f.>..N 00000000 00000000 ........ 0070 54465375 15b441bb TFSu..A. 00000000 00000000 ........ 0078 aa55cd13 720c81fb .U..r... 00000000 00000000 ........ 0080 55aa7506 f7c10100 U.u..... 00000000 00000000 ........ 0088 7503e9d2 001e83ec u....... 00000000 00000000 ........ 0090 18681a00 b4488a16 .h...H.. 00000000 00000000 ........ 0098 0e008bf4 161fcd13 ........ 00000000 00000000 ........ 00A0 9f83c418 9e581f72 .....X.r 00000000 00000000 ........ 00A8 e13b060b 0075dba3 .;...u.. 00000000 00000000 ........ 00B0 0f00c12e 0f00041e ........ 00000000 00000000 ........ 00B8 5a33dbb9 00202bc8 Z3... +. 00000000 00000000 ........ 00C0 66ff0611 0003160f f....... 00000000 00000000 ........ 00C8 008ec2ff 061600e8 ........ 00000000 00000000 ........ 00D0 40002bc8 77efb800 @.+.w... 00000000 00000000 ........ 00D8 bbcd1a66 23c0752d ...f#.u- 00000000 00000000 ........ 00E0 6681fb54 43504175 f..TCPAu 00000000 00000000 ........ 00E8 2481f902 01721e16 $....r.. 00000000 00000000 ........ 00F0 6807bb16 68700e16 h...hp.. 00000000 00000000 ........ 00F8 68090066 53665366 h..fSfSf 00000000 00000000 ........ 0100 55161616 68b80166 U...h..f 00000000 00000000 ........ 0108 610e07cd 1ae96a01 a.....j. 00000000 00000000 ........ 0110 90906660 1e0666a1 ..f`..f. 00000000 00000000 ........ 0118 11006603 061c001e ..f..... 00000000 00000000 ........ 0120 66680000 00006650 fh....fP 00000000 00000000 ........ 0128 06536801 00681000 .Sh..h.. 00000000 00000000 ........ 0130 b4428a16 0e00161f .B...... 00000000 00000000 ........ 0138 8bf4cd13 66595b5a ....fY[Z 00000000 00000000 ........ 0140 66596659 1f0f8216 fYfY.... 00000000 00000000 ........ 0148 0066ff06 11000316 .f...... 00000000 00000000 ........ 0150 0f008ec2 ff0e1600 ........ 00000000 00000000 ........ 0158 75bc071f 6661c3a0 u...fa.. 00000000 00000000 ........ 0160 f801e808 00a0fb01 ........ 00000000 00000000 ........ 0168 e80200eb feb4018b ........ 00000000 00000000 ........ 0170 f0ac3c00 7409b40e ..<.t... 00000000 00000000 ........ 0178 bb0700cd 10ebf2c3 ........ 00000000 00000000 ........ 0180 0d0a4120 6469736b ..A disk 00000000 00000000 ........ 0188 20726561 64206572 read er 00000000 00000000 ........ 0190 726f7220 6f636375 ror occu 00000000 00000000 ........ 0198 72726564 000d0a42 rred...B 00000000 00000000 ........ 01A0 4f4f544d 47522069 OOTMGR i 00000000 00000000 ........ 01A8 73206d69 7373696e s missin 00000000 00000000 ........ 01B0 67000d0a 424f4f54 g...BOOT 00000000 00000000 ........ 01B8 4d475220 69732063 MGR is c 00000000 00000000 ........ 01C0 6f6d7072 65737365 ompresse 00000000 00000000 ........ 01C8 64000d0a 50726573 d...Pres 00000000 00000000 ........ 01D0 73204374 726c2b41 s Ctrl+A 00000000 00000000 ........ 01D8 6c742b44 656c2074 lt+Del t 00000000 00000000 ........ 01E0 6f207265 73746172 o restar 00000000 00000000 ........ 01E8 740d0a00 00000000 t....... 00000000 00000000 ........ 01F0 00000000 00000000 ........ 00000000 00000000 ........ 01F8 809db2ca 000055aa ......U. 00000000 00000000 ........ ntfs_boot_sector 3 * HPFS - NTFS 1312 109 14 38913 254 63 604069250 NTFS, 309 GB / 288 GiB NTFS at 1312/109/14 Info: size boot_sector 604055552, partition 604069250 filesystem size 604055552 1 sectors_per_cluster 8 0 mft_lcn 786432 0 mftmirr_lcn 2 0 clusters_per_mft_record -10 0 clusters_per_index_record 1 0 Boot sector Status: OK Backup boot sector ntfs_boot_sector: Can't read backup boot sector. Status: Bad Sectors are not identical. A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable. TestDisk exited normally.