Wed Sep 3 21:51:53 2008 Command line: TestDisk TestDisk 6.11-WIP, Data Recovery Utility, July 2008 Christophe GRENIER http://www.cgsecurity.org OS: Windows XP SP2 Compiler: GCC 4.3, Cygwin 1005.25 - Aug 25 2008 23:09:42 ext2fs lib: 1.41.0, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=8622931968 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=500107862016 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=8622931968 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=500107862016 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=320070288384 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=3026870784 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=838946304 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=157283771904 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=162786484224 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1579221504 disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=500105217024 file_read(4,1,buffer,625153409(38913/254/63)) lseek err Invalid argument file_read(5,1,buffer,625153409(38913/254/63)) lseek err Invalid argument file_read(6,1,buffer,16852184(1048/254/63)) lseek err Invalid argument file_read(7,1,buffer,976784129(60801/254/63)) lseek err Invalid argument Hard disk list Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - WDC WD3200AAKB-00WHA0 Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HDT725032VLAT80 Disk /dev/sdc - 8622 MB / 8223 MiB - CHS 1048 255 63, sector size=512 - ST38410A Disk /dev/sdd - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WD My Book Partition table type (auto): Intel Disk /dev/sdc - 8622 MB / 8223 MiB - ST38410A Partition table type: Intel file_read(6,1,buffer,16852184(1048/254/63)) lseek err Invalid argument Analyse Disk /dev/sdc - 8622 MB / 8223 MiB - CHS 1048 255 63 Geometry from i386 MBR: head=255 sector=63 FAT32 at 0/1/1 Info: size boot_sector 5911857, partition 5911857 FAT1 : 32-5795 FAT2 : 5796-11559 start_rootdir : 11560 root cluster : 2 Data : 11560-5911855 sectors : 5911857 cluster_size : 8 no_of_cluster : 737537 (2 - 737538) fat_length 5764 calculated 5763 test_FAT() 5 L FAT32 LBA 368 1 1 680 254 63 5028282 sector_size 20139 cluster_size 226 reserved 28890 fats 95 dir_entries 16474 sectors 38525 media 16 fat_length 23246 secs_track 62171 heads 1734 hidden 1783287892 total_sect 604411937 check_part_i386 failed for partition type 0C FAT32 at 681/1/1 Info: size boot_sector 1638567, partition 1638567 FAT1 : 32-1630 FAT2 : 1631-3229 start_rootdir : 3230 root cluster : 2 Data : 3230-1638565 sectors : 1638567 cluster_size : 8 no_of_cluster : 204417 (2 - 204418) fat_length 1599 calculated 1598 FAT32 at 783/1/1 Info: size boot_sector 3084417, partition 3084417 FAT1 : 32-3041 FAT2 : 3042-6051 start_rootdir : 6052 root cluster : 2 Data : 6052-3084411 sectors : 3084417 cluster_size : 8 no_of_cluster : 384795 (2 - 384796) fat_length 3010 calculated 3007 get_geometry_from_list_part_aux head=255 nbr=14 get_geometry_from_list_part_aux head=8 nbr=6 get_geometry_from_list_part_aux head=16 nbr=5 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=4 get_geometry_from_list_part_aux head=255 nbr=14 Current partition structure: 1 * FAT32 0 1 1 367 254 63 5911857 [SYSTEM] 2 E extended 368 0 1 974 254 63 9751455 Invalid FAT boot sector 5 L FAT32 LBA 368 1 1 680 254 63 5028282 5 L FAT32 LBA 368 1 1 680 254 63 5028282 X extended 681 0 1 782 254 63 1638630 6 L FAT32 681 1 1 782 254 63 1638567 [MIX] X extended 783 0 1 974 254 63 3084480 7 L FAT32 783 1 1 974 254 63 3084417 [MISCHMASCH] Ask the user for vista mode Allow partial last cylinder : No search_vista_part: 0 search_part() Disk /dev/sdc - 8622 MB / 8223 MiB - CHS 1048 255 63 FAT32 at 0/1/1 FAT1 : 32-5795 FAT2 : 5796-11559 start_rootdir : 11560 root cluster : 2 Data : 11560-5911855 sectors : 5911857 cluster_size : 8 no_of_cluster : 737537 (2 - 737538) fat_length 5764 calculated 5763 FAT32 at 0/1/1 D FAT32 0 1 1 367 254 63 5911857 [SYSTEM] FAT32, 3026 MB / 2886 MiB Search for partition aborted get_geometry_from_list_part_aux head=255 nbr=2 get_geometry_from_list_part_aux head=8 nbr=2 get_geometry_from_list_part_aux head=16 nbr=2 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=2 get_geometry_from_list_part_aux head=255 nbr=2 Results * FAT32 0 1 1 367 254 63 5911857 [SYSTEM] FAT32, 3026 MB / 2886 MiB interface_write() 1 * FAT32 0 1 1 367 254 63 5911857 [SYSTEM] simulate write! write_mbr_i386: starting... write_all_log_i386: starting... No extended partition Interface Advanced Geometry from i386 MBR: head=255 sector=63 FAT32 at 0/1/1 Info: size boot_sector 5911857, partition 5911857 FAT1 : 32-5795 FAT2 : 5796-11559 start_rootdir : 11560 root cluster : 2 Data : 11560-5911855 sectors : 5911857 cluster_size : 8 no_of_cluster : 737537 (2 - 737538) fat_length 5764 calculated 5763 test_FAT() 5 L FAT32 LBA 368 1 1 680 254 63 5028282 sector_size 20139 cluster_size 226 reserved 28890 fats 95 dir_entries 16474 sectors 38525 media 16 fat_length 23246 secs_track 62171 heads 1734 hidden 1783287892 total_sect 604411937 check_part_i386 failed for partition type 0C FAT32 at 681/1/1 Info: size boot_sector 1638567, partition 1638567 FAT1 : 32-1630 FAT2 : 1631-3229 start_rootdir : 3230 root cluster : 2 Data : 3230-1638565 sectors : 1638567 cluster_size : 8 no_of_cluster : 204417 (2 - 204418) fat_length 1599 calculated 1598 FAT32 at 783/1/1 Info: size boot_sector 3084417, partition 3084417 FAT1 : 32-3041 FAT2 : 3042-6051 start_rootdir : 6052 root cluster : 2 Data : 6052-3084411 sectors : 3084417 cluster_size : 8 no_of_cluster : 384795 (2 - 384796) fat_length 3010 calculated 3007 get_geometry_from_list_part_aux head=255 nbr=14 get_geometry_from_list_part_aux head=8 nbr=6 get_geometry_from_list_part_aux head=16 nbr=5 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=4 get_geometry_from_list_part_aux head=255 nbr=14 1 * FAT32 0 1 1 367 254 63 5911857 [SYSTEM] FAT32, 3026 MB / 2886 MiB 2 E extended 368 0 1 974 254 63 9751455 5 L FAT32 LBA 368 1 1 680 254 63 5028282 X extended 681 0 1 782 254 63 1638630 6 L FAT32 681 1 1 782 254 63 1638567 [MIX] FAT32, 838 MB / 800 MiB X extended 783 0 1 974 254 63 3084480 7 L FAT32 783 1 1 974 254 63 3084417 [MISCHMASCH] FAT32, 1579 MB / 1506 MiB fat32_boot_sector 5 L FAT32 LBA 368 1 1 680 254 63 5028282 Boot sector Bad Backup boot sector Bad First sectors (Boot code and partition information) are not identical. Second sectors (cluster information) are not identical. Third sectors (Second part of boot code) are not identical. A valid FAT Boot sector must be present in order to access any data; even if the partition is not bootable. 5 L FAT32 LBA 368 1 1 680 254 63 5028282 rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1 fat_find_type(max_offset=39347, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0) No FAT found, reserved=0, fat_length=0 find_sectors_per_cluster skip_sectors=230 (skip_offset=117760) sector 559769, cluster 178975 sector 1610737, cluster 310346 find_sectors_per_cluster_aux Can't find cluster size fat32_boot_sector 5 L FAT32 LBA 368 1 1 680 254 63 5028282 Boot sector Bad Backup boot sector Bad First sectors (Boot code and partition information) are not identical. Second sectors (cluster information) are not identical. Third sectors (Second part of boot code) are not identical. A valid FAT Boot sector must be present in order to access any data; even if the partition is not bootable. fat32_boot_sector 5 L FAT32 LBA 368 1 1 680 254 63 5028282 Boot sector Bad Backup boot sector Bad First sectors (Boot code and partition information) are not identical. Second sectors (cluster information) are not identical. Third sectors (Second part of boot code) are not identical. A valid FAT Boot sector must be present in order to access any data; even if the partition is not bootable. 5 L FAT32 LBA 368 1 1 680 254 63 5028282 rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1 fat_find_type(max_offset=39347, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0) No FAT found, reserved=0, fat_length=0 find_sectors_per_cluster skip_sectors=230 (skip_offset=117760) sector 559769, cluster 178975 sector 1610737, cluster 310346 find_sectors_per_cluster_aux Can't find cluster size fat32_boot_sector 5 L FAT32 LBA 368 1 1 680 254 63 5028282 Boot sector Bad Backup boot sector Bad First sectors (Boot code and partition information) are not identical. Second sectors (cluster information) are not identical. Third sectors (Second part of boot code) are not identical. A valid FAT Boot sector must be present in order to access any data; even if the partition is not bootable. Analyse Disk /dev/sdc - 8622 MB / 8223 MiB - CHS 1048 255 63 Geometry from i386 MBR: head=255 sector=63 FAT32 at 0/1/1 Info: size boot_sector 5911857, partition 5911857 FAT1 : 32-5795 FAT2 : 5796-11559 start_rootdir : 11560 root cluster : 2 Data : 11560-5911855 sectors : 5911857 cluster_size : 8 no_of_cluster : 737537 (2 - 737538) fat_length 5764 calculated 5763 test_FAT() 5 L FAT32 LBA 368 1 1 680 254 63 5028282 sector_size 20139 cluster_size 226 reserved 28890 fats 95 dir_entries 16474 sectors 38525 media 16 fat_length 23246 secs_track 62171 heads 1734 hidden 1783287892 total_sect 604411937 check_part_i386 failed for partition type 0C FAT32 at 681/1/1 Info: size boot_sector 1638567, partition 1638567 FAT1 : 32-1630 FAT2 : 1631-3229 start_rootdir : 3230 root cluster : 2 Data : 3230-1638565 sectors : 1638567 cluster_size : 8 no_of_cluster : 204417 (2 - 204418) fat_length 1599 calculated 1598 FAT32 at 783/1/1 Info: size boot_sector 3084417, partition 3084417 FAT1 : 32-3041 FAT2 : 3042-6051 start_rootdir : 6052 root cluster : 2 Data : 6052-3084411 sectors : 3084417 cluster_size : 8 no_of_cluster : 384795 (2 - 384796) fat_length 3010 calculated 3007 get_geometry_from_list_part_aux head=255 nbr=14 get_geometry_from_list_part_aux head=8 nbr=6 get_geometry_from_list_part_aux head=16 nbr=5 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=4 get_geometry_from_list_part_aux head=255 nbr=14 Current partition structure: 1 * FAT32 0 1 1 367 254 63 5911857 [SYSTEM] 2 E extended 368 0 1 974 254 63 9751455 Invalid FAT boot sector 5 L FAT32 LBA 368 1 1 680 254 63 5028282 5 L FAT32 LBA 368 1 1 680 254 63 5028282 X extended 681 0 1 782 254 63 1638630 6 L FAT32 681 1 1 782 254 63 1638567 [MIX] X extended 783 0 1 974 254 63 3084480 7 L FAT32 783 1 1 974 254 63 3084417 [MISCHMASCH] Ask the user for vista mode Allow partial last cylinder : No search_vista_part: 0 search_part() Disk /dev/sdc - 8622 MB / 8223 MiB - CHS 1048 255 63 FAT32 at 0/1/1 FAT1 : 32-5795 FAT2 : 5796-11559 start_rootdir : 11560 root cluster : 2 Data : 11560-5911855 sectors : 5911857 cluster_size : 8 no_of_cluster : 737537 (2 - 737538) fat_length 5764 calculated 5763 FAT32 at 0/1/1 D FAT32 0 1 1 367 254 63 5911857 [SYSTEM] FAT32, 3026 MB / 2886 MiB Search for partition aborted get_geometry_from_list_part_aux head=255 nbr=2 get_geometry_from_list_part_aux head=8 nbr=2 get_geometry_from_list_part_aux head=16 nbr=2 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=2 get_geometry_from_list_part_aux head=255 nbr=2 Results * FAT32 0 1 1 367 254 63 5911857 [SYSTEM] FAT32, 3026 MB / 2886 MiB interface_write() 1 * FAT32 0 1 1 367 254 63 5911857 [SYSTEM]