Sun Nov 1 17:27:37 2009
Command line: TestDisk
TestDisk 6.11-WIP, Data Recovery Utility, January 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.3, Cygwin 1005.25 - Jan 10 2009 15:50:09
ext2fs lib: 1.41.0, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=41174138880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=41174138880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=41159268864
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500105217024
file_read(4,1,buffer,80421389(5005/254/63)) lseek err Invalid argument
file_read(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 41 GB / 38 GiB - CHS 5005 255 63, sector size=512 - IC35L040AVVA07-0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - SAMSUNG HD501LJ
Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - SAMSUNG HD501LJ
Partition table type: Intel
Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0
search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS, 500 GB / 465 GiB
file_read(5,8,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_read(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_read(5,1,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_read(5,1,buffer,976773185(60801/81/18)) lseek err Invalid argument
file_read(5,1,buffer,976773186(60801/81/19)) lseek err Invalid argument
file_read(5,1,buffer,976773187(60801/81/20)) lseek err Invalid argument
file_read(5,1,buffer,976773188(60801/81/21)) lseek err Invalid argument
file_read(5,1,buffer,976773189(60801/81/22)) lseek err Invalid argument
file_read(5,1,buffer,976773190(60801/81/23)) lseek err Invalid argument
file_read(5,8,buffer,976773311(60801/83/18)) lseek err Invalid argument
file_read(5,8,buffer,976773439(60801/85/20)) lseek err Invalid argument
file_read(5,8,buffer,976773567(60801/87/22)) lseek err Invalid argument
file_read(5,8,buffer,976773695(60801/89/24)) lseek err Invalid argument
file_read(5,8,buffer,976773823(60801/91/26)) lseek err Invalid argument
file_read(5,8,buffer,976773951(60801/93/28)) lseek err Invalid argument
file_read(5,8,buffer,976774079(60801/95/30)) lseek err Invalid argument
file_read(5,8,buffer,976774207(60801/97/32)) lseek err Invalid argument
file_read(5,8,buffer,976774335(60801/99/34)) lseek err Invalid argument
file_read(5,8,buffer,976774463(60801/101/36)) lseek err Invalid argument
file_read(5,8,buffer,976774591(60801/103/38)) lseek err Invalid argument
file_read(5,8,buffer,976774719(60801/105/40)) lseek err Invalid argument
file_read(5,8,buffer,976774847(60801/107/42)) lseek err Invalid argument
file_read(5,8,buffer,976774975(60801/109/44)) lseek err Invalid argument
file_read(5,8,buffer,976775103(60801/111/46)) lseek err Invalid argument
file_read(5,8,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_read(5,8,buffer,976775359(60801/115/50)) lseek err Invalid argument
file_read(5,8,buffer,976775487(60801/117/52)) lseek err Invalid argument
file_read(5,8,buffer,976775615(60801/119/54)) lseek err Invalid argument
file_read(5,8,buffer,976775743(60801/121/56)) lseek err Invalid argument
file_read(5,8,buffer,976775871(60801/123/58)) lseek err Invalid argument
file_read(5,8,buffer,976775999(60801/125/60)) lseek err Invalid argument
file_read(5,8,buffer,976776127(60801/127/62)) lseek err Invalid argument
file_read(5,8,buffer,976776255(60801/130/1)) lseek err Invalid argument
file_read(5,8,buffer,976776383(60801/132/3)) lseek err Invalid argument
file_read(5,8,buffer,976776511(60801/134/5)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS, 500 GB / 465 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS, 500 GB / 465 GiB
NTFS at 1/1/1
filesystem size 976751937
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61046996
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 1 1 1 60800 254 63 976751937 [HD-HSQ]
NTFS, 500 GB / 465 GiB
NTFS at 60800/254/63
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS found using backup sector!, 500 GB / 465 GiB
file_read(5,8,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_read(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_read(5,1,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_read(5,1,buffer,976773185(60801/81/18)) lseek err Invalid argument
file_read(5,1,buffer,976773186(60801/81/19)) lseek err Invalid argument
file_read(5,1,buffer,976773187(60801/81/20)) lseek err Invalid argument
file_read(5,1,buffer,976773188(60801/81/21)) lseek err Invalid argument
file_read(5,1,buffer,976773189(60801/81/22)) lseek err Invalid argument
file_read(5,1,buffer,976773190(60801/81/23)) lseek err Invalid argument
file_read(5,8,buffer,976773248(60801/82/18)) lseek err Invalid argument
file_read(5,8,buffer,976773311(60801/83/18)) lseek err Invalid argument
file_read(5,8,buffer,976773376(60801/84/20)) lseek err Invalid argument
file_read(5,8,buffer,976773439(60801/85/20)) lseek err Invalid argument
file_read(5,8,buffer,976773504(60801/86/22)) lseek err Invalid argument
file_read(5,8,buffer,976773567(60801/87/22)) lseek err Invalid argument
file_read(5,8,buffer,976773632(60801/88/24)) lseek err Invalid argument
file_read(5,8,buffer,976773695(60801/89/24)) lseek err Invalid argument
file_read(5,8,buffer,976773760(60801/90/26)) lseek err Invalid argument
file_read(5,8,buffer,976773823(60801/91/26)) lseek err Invalid argument
file_read(5,8,buffer,976773888(60801/92/28)) lseek err Invalid argument
file_read(5,8,buffer,976773951(60801/93/28)) lseek err Invalid argument
file_read(5,8,buffer,976774016(60801/94/30)) lseek err Invalid argument
file_read(5,8,buffer,976774079(60801/95/30)) lseek err Invalid argument
file_read(5,8,buffer,976774144(60801/96/32)) lseek err Invalid argument
file_read(5,8,buffer,976774207(60801/97/32)) lseek err Invalid argument
file_read(5,8,buffer,976774272(60801/98/34)) lseek err Invalid argument
file_read(5,8,buffer,976774335(60801/99/34)) lseek err Invalid argument
file_read(5,8,buffer,976774400(60801/100/36)) lseek err Invalid argument
file_read(5,8,buffer,976774463(60801/101/36)) lseek err Invalid argument
file_read(5,8,buffer,976774528(60801/102/38)) lseek err Invalid argument
file_read(5,8,buffer,976774591(60801/103/38)) lseek err Invalid argument
file_read(5,8,buffer,976774656(60801/104/40)) lseek err Invalid argument
file_read(5,8,buffer,976774719(60801/105/40)) lseek err Invalid argument
file_read(5,8,buffer,976774784(60801/106/42)) lseek err Invalid argument
file_read(5,8,buffer,976774847(60801/107/42)) lseek err Invalid argument
file_read(5,8,buffer,976774912(60801/108/44)) lseek err Invalid argument
file_read(5,8,buffer,976774975(60801/109/44)) lseek err Invalid argument
file_read(5,8,buffer,976775040(60801/110/46)) lseek err Invalid argument
file_read(5,8,buffer,976775103(60801/111/46)) lseek err Invalid argument
file_read(5,8,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_read(5,8,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_read(5,8,buffer,976775296(60801/114/50)) lseek err Invalid argument
file_read(5,8,buffer,976775359(60801/115/50)) lseek err Invalid argument
file_read(5,8,buffer,976775424(60801/116/52)) lseek err Invalid argument
file_read(5,8,buffer,976775487(60801/117/52)) lseek err Invalid argument
file_read(5,8,buffer,976775552(60801/118/54)) lseek err Invalid argument
file_read(5,8,buffer,976775615(60801/119/54)) lseek err Invalid argument
file_read(5,8,buffer,976775680(60801/120/56)) lseek err Invalid argument
file_read(5,8,buffer,976775743(60801/121/56)) lseek err Invalid argument
file_read(5,8,buffer,976775808(60801/122/58)) lseek err Invalid argument
file_read(5,8,buffer,976775871(60801/123/58)) lseek err Invalid argument
file_read(5,8,buffer,976775936(60801/124/60)) lseek err Invalid argument
file_read(5,8,buffer,976775999(60801/125/60)) lseek err Invalid argument
file_read(5,8,buffer,976776064(60801/126/62)) lseek err Invalid argument
file_read(5,8,buffer,976776127(60801/127/62)) lseek err Invalid argument
file_read(5,8,buffer,976776192(60801/129/1)) lseek err Invalid argument
file_read(5,8,buffer,976776255(60801/130/1)) lseek err Invalid argument
file_read(5,8,buffer,976776320(60801/131/3)) lseek err Invalid argument
file_read(5,8,buffer,976776383(60801/132/3)) lseek err Invalid argument
file_read(5,8,buffer,976776448(60801/133/5)) lseek err Invalid argument
file_read(5,8,buffer,976776511(60801/134/5)) lseek err Invalid argument
file_read(5,2,buffer,976783377(60801/243/4)) lseek err Invalid argument
file_read(5,2,buffer,976783440(60801/244/4)) lseek err Invalid argument
file_read(5,2,buffer,976783503(60801/245/4)) lseek err Invalid argument
file_read(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
file_read(5,1,buffer,976784130(60802/0/1)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4
Results
HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS, 500 GB / 465 GiB
HPFS - NTFS 1 1 1 60800 254 63 976751937 [HD-HSQ]
NTFS, 500 GB / 465 GiB
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
No partition is bootable
Sun Nov 1 18:10:53 2009
Command line: TestDisk
TestDisk 6.11-WIP, Data Recovery Utility, January 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.3, Cygwin 1005.25 - Jan 10 2009 15:50:09
ext2fs lib: 1.41.0, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=41174138880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=41174138880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=41159268864
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=500105217024
file_read(4,1,buffer,80421389(5005/254/63)) lseek err Invalid argument
file_read(5,1,buffer,976784129(60801/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 41 GB / 38 GiB - CHS 5005 255 63, sector size=512 - IC35L040AVVA07-0
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - SAMSUNG HD501LJ
Partition table type (auto): Intel
Disk /dev/sdb - 500 GB / 465 GiB - SAMSUNG HD501LJ
Partition table type: Intel
Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 P HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0
search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 976768002
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 61048000
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS, 500 GB / 465 GiB
file_read(5,8,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_read(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_read(5,1,buffer,976773184(60801/81/17)) lseek err Invalid argument
file_read(5,1,buffer,976773185(60801/81/18)) lseek err Invalid argument
file_read(5,1,buffer,976773186(60801/81/19)) lseek err Invalid argument
file_read(5,1,buffer,976773187(60801/81/20)) lseek err Invalid argument
file_read(5,1,buffer,976773188(60801/81/21)) lseek err Invalid argument
file_read(5,1,buffer,976773189(60801/81/22)) lseek err Invalid argument
file_read(5,1,buffer,976773190(60801/81/23)) lseek err Invalid argument
file_read(5,8,buffer,976773311(60801/83/18)) lseek err Invalid argument
file_read(5,8,buffer,976773439(60801/85/20)) lseek err Invalid argument
file_read(5,8,buffer,976773567(60801/87/22)) lseek err Invalid argument
file_read(5,8,buffer,976773695(60801/89/24)) lseek err Invalid argument
file_read(5,8,buffer,976773823(60801/91/26)) lseek err Invalid argument
file_read(5,8,buffer,976773951(60801/93/28)) lseek err Invalid argument
file_read(5,8,buffer,976774079(60801/95/30)) lseek err Invalid argument
file_read(5,8,buffer,976774207(60801/97/32)) lseek err Invalid argument
file_read(5,8,buffer,976774335(60801/99/34)) lseek err Invalid argument
file_read(5,8,buffer,976774463(60801/101/36)) lseek err Invalid argument
file_read(5,8,buffer,976774591(60801/103/38)) lseek err Invalid argument
file_read(5,8,buffer,976774719(60801/105/40)) lseek err Invalid argument
file_read(5,8,buffer,976774847(60801/107/42)) lseek err Invalid argument
file_read(5,8,buffer,976774975(60801/109/44)) lseek err Invalid argument
file_read(5,8,buffer,976775103(60801/111/46)) lseek err Invalid argument
file_read(5,8,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_read(5,8,buffer,976775359(60801/115/50)) lseek err Invalid argument
file_read(5,8,buffer,976775487(60801/117/52)) lseek err Invalid argument
file_read(5,8,buffer,976775615(60801/119/54)) lseek err Invalid argument
file_read(5,8,buffer,976775743(60801/121/56)) lseek err Invalid argument
file_read(5,8,buffer,976775871(60801/123/58)) lseek err Invalid argument
file_read(5,8,buffer,976775999(60801/125/60)) lseek err Invalid argument
file_read(5,8,buffer,976776127(60801/127/62)) lseek err Invalid argument
file_read(5,8,buffer,976776255(60801/130/1)) lseek err Invalid argument
file_read(5,8,buffer,976776383(60801/132/3)) lseek err Invalid argument
file_read(5,8,buffer,976776511(60801/134/5)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]
NTFS, 500 GB / 465 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 60800 254 63 976768002 [HD-HSQ]