Thu Mar 12 08:41:43 2009 Command line: TestDisk TestDisk 6.10, Data Recovery Utility, July 2008 Christophe GRENIER http://www.cgsecurity.org OS: Linux, kernel 2.6.25.20-0.1-default (#1 SMP 2008-12-12 20:30:38 +0100) Compiler: GCC 3.4 - Jul 17 2008 09:51:30 ext2fs lib: 1.35, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501 Warning: can't get size for /dev/mapper/control Fix disk size using CHS Warning: can't get size for /dev/md0 Fix disk size using CHS Warning: can't get size for /dev/md1 Fix disk size using CHS Warning: can't get size for /dev/md2 Fix disk size using CHS Warning: can't get size for /dev/md3 Fix disk size using CHS Warning: can't get size for /dev/md4 Fix disk size using CHS Warning: can't get size for /dev/md5 Fix disk size using CHS Warning: can't get size for /dev/md6 Fix disk size using CHS Warning: can't get size for /dev/md7 Fix disk size using CHS Warning: can't get size for /dev/md8 Fix disk size using CHS Warning: can't get size for /dev/md9 Hard disk list Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63, sector size=512 - ATA FUJITSU MHV2040A Partition table type (auto): Intel Disk /dev/sda - 40 GB / 37 GiB - ATA FUJITSU MHV2040A Partition table type: Intel Analyse Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63 Geometry from i386 MBR: head=255 sector=63 NTFS at 0/1/1 heads/cylinder 240 (NTFS) != 255 (HD) Info: size boot_sector 20498865, partition 20498877 NTFS at 3460/1/1 heads/cylinder 240 (NTFS) != 255 (HD) Info: size boot_sector 8209145, partition 8209152 get_geometry_from_list_part_aux head=255 nbr=14 get_geometry_from_list_part_aux head=8 nbr=1 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=14 Current partition structure: Warning: Incorrect number of heads/cylinder 240 (NTFS) != 255 (HD) 1 P HPFS - NTFS 0 1 1 1275 254 63 20498877 [System] 2 P Linux Swap 1276 0 1 1371 254 63 1542240 3 * Linux 1372 0 1 3459 254 63 33543720 4 E extended LBA 3460 0 1 4863 254 63 22555260 Warning: Incorrect number of heads/cylinder 240 (NTFS) != 255 (HD) 5 L HPFS - NTFS 3460 1 1 3970 254 63 8209152 [Files] X extended 3971 0 1 4863 254 63 14346045 6 L Linux 3971 1 1 4863 254 63 14345982 Ask the user for vista mode Allow partial last cylinder : No search_vista_part: 0 search_part() Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63 NTFS at 0/1/1 heads/cylinder 240 (NTFS) != 255 (HD) filesystem size 20498865 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 1280471 clusters_per_mft_record -10 clusters_per_index_record 1 D HPFS - NTFS 0 1 1 1275 254 51 20498865 [System] NTFS, 10495 MB / 10009 MiB D Linux Swap 1276 0 1 1371 254 47 1542224 SWAP2 version 1, 789 MB / 753 MiB recover_EXT2: s_block_group_nr=0/127, s_mnt_count=597/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192 recover_EXT2: s_blocksize=4096 recover_EXT2: s_blocks_count 4192965 recover_EXT2: part_size 33543720 D Linux 1372 0 1 3459 254 63 33543720 EXT3 Large file Sparse superblock Recover, 17 GB / 15 GiB NTFS at 3460/1/1 heads/cylinder 240 (NTFS) != 255 (HD) filesystem size 8209145 sectors_per_cluster 8 mft_lcn 4 mftmirr_lcn 384612 clusters_per_mft_record -10 clusters_per_index_record 1 D HPFS - NTFS 3460 1 1 3970 254 56 8209145 [Files] NTFS, 4203 MB / 4008 MiB recover_EXT2: s_block_group_nr=0/54, s_mnt_count=7/23, s_blocks_per_group=32768, s_inodes_per_group=8160 recover_EXT2: s_blocksize=4096 recover_EXT2: s_blocks_count 1793247 recover_EXT2: part_size 14345976 D Linux 3971 1 1 4863 254 57 14345976 EXT3 Large file Sparse superblock Recover, 7345 MB / 7004 MiB get_geometry_from_list_part_aux head=255 nbr=10 get_geometry_from_list_part_aux head=8 nbr=1 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=10 Results * HPFS - NTFS 0 1 1 1275 254 63 20498877 [System] NTFS, 10495 MB / 10009 MiB P Linux Swap 1276 0 1 1371 254 63 1542240 SWAP2 version 1, 789 MB / 753 MiB P Linux 1372 0 1 3459 254 63 33543720 EXT3 Large file Sparse superblock Recover, 17 GB / 15 GiB L HPFS - NTFS 3460 1 1 3970 254 63 8209152 [Files] NTFS, 4203 MB / 4008 MiB L Linux 3971 1 1 4863 254 63 14345982 EXT3 Large file Sparse superblock Recover, 7345 MB / 7004 MiB interface_write() 1 * HPFS - NTFS 0 1 1 1275 254 63 20498877 [System] 2 P Linux Swap 1276 0 1 1371 254 63 1542240 3 P Linux 1372 0 1 3459 254 63 33543720 4 E extended LBA 3460 0 1 4863 254 63 22555260 5 L HPFS - NTFS 3460 1 1 3970 254 63 8209152 [Files] 6 L Linux 3971 1 1 4863 254 63 14345982 simulate write! write_mbr_i386: starting... write_all_log_i386: starting... write_all_log_i386: CHS: 3460/0/1,lba=55584900 write_all_log_i386: CHS: 3971/0/1,lba=63794115 Analyse Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63 Geometry from i386 MBR: head=255 sector=63 NTFS at 0/1/1 heads/cylinder 240 (NTFS) != 255 (HD) Info: size boot_sector 20498865, partition 20498877 NTFS at 3460/1/1 heads/cylinder 240 (NTFS) != 255 (HD) Info: size boot_sector 8209145, partition 8209152 get_geometry_from_list_part_aux head=255 nbr=14 get_geometry_from_list_part_aux head=8 nbr=1 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=14 Current partition structure: Warning: Incorrect number of heads/cylinder 240 (NTFS) != 255 (HD) 1 P HPFS - NTFS 0 1 1 1275 254 63 20498877 [System] 2 P Linux Swap 1276 0 1 1371 254 63 1542240 3 * Linux 1372 0 1 3459 254 63 33543720 4 E extended LBA 3460 0 1 4863 254 63 22555260 Warning: Incorrect number of heads/cylinder 240 (NTFS) != 255 (HD) 5 L HPFS - NTFS 3460 1 1 3970 254 63 8209152 [Files] X extended 3971 0 1 4863 254 63 14346045 6 L Linux 3971 1 1 4863 254 63 14345982 Ask the user for vista mode Allow partial last cylinder : No search_vista_part: 0 search_part() Disk /dev/sda - 40 GB / 37 GiB - CHS 4864 255 63 NTFS at 0/1/1 heads/cylinder 240 (NTFS) != 255 (HD) filesystem size 20498865 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 1280471 clusters_per_mft_record -10 clusters_per_index_record 1 D HPFS - NTFS 0 1 1 1275 254 51 20498865 [System] NTFS, 10495 MB / 10009 MiB D Linux Swap 1276 0 1 1371 254 47 1542224 SWAP2 version 1, 789 MB / 753 MiB recover_EXT2: s_block_group_nr=0/127, s_mnt_count=597/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192 recover_EXT2: s_blocksize=4096 recover_EXT2: s_blocks_count 4192965 recover_EXT2: part_size 33543720 D Linux 1372 0 1 3459 254 63 33543720 EXT3 Large file Sparse superblock Recover, 17 GB / 15 GiB NTFS at 3460/1/1 heads/cylinder 240 (NTFS) != 255 (HD) filesystem size 8209145 sectors_per_cluster 8 mft_lcn 4 mftmirr_lcn 384612 clusters_per_mft_record -10 clusters_per_index_record 1 D HPFS - NTFS 3460 1 1 3970 254 56 8209145 [Files] NTFS, 4203 MB / 4008 MiB recover_EXT2: s_block_group_nr=0/54, s_mnt_count=7/23, s_blocks_per_group=32768, s_inodes_per_group=8160 recover_EXT2: s_blocksize=4096 recover_EXT2: s_blocks_count 1793247 recover_EXT2: part_size 14345976 D Linux 3971 1 1 4863 254 57 14345976 EXT3 Large file Sparse superblock Recover, 7345 MB / 7004 MiB get_geometry_from_list_part_aux head=255 nbr=10 get_geometry_from_list_part_aux head=8 nbr=1 get_geometry_from_list_part_aux head=16 nbr=1 get_geometry_from_list_part_aux head=32 nbr=1 get_geometry_from_list_part_aux head=64 nbr=1 get_geometry_from_list_part_aux head=128 nbr=1 get_geometry_from_list_part_aux head=240 nbr=1 get_geometry_from_list_part_aux head=255 nbr=10 Results * HPFS - NTFS 0 1 1 1275 254 63 20498877 [System] NTFS, 10495 MB / 10009 MiB P Linux Swap 1276 0 1 1371 254 63 1542240 SWAP2 version 1, 789 MB / 753 MiB P Linux 1372 0 1 3459 254 63 33543720 EXT3 Large file Sparse superblock Recover, 17 GB / 15 GiB L HPFS - NTFS 3460 1 1 3970 254 63 8209152 [Files] NTFS, 4203 MB / 4008 MiB L Linux 3971 1 1 4863 254 63 14345982 EXT3 Large file Sparse superblock Recover, 7345 MB / 7004 MiB interface_write() 1 * HPFS - NTFS 0 1 1 1275 254 63 20498877 [System] 2 P Linux Swap 1276 0 1 1371 254 63 1542240 3 P Linux 1372 0 1 3459 254 63 33543720 4 E extended LBA 3460 0 1 4863 254 63 22555260 5 L HPFS - NTFS 3460 1 1 3970 254 63 8209152 [Files] 6 L Linux 3971 1 1 4863 254 63 14345982 simulate write! write_mbr_i386: starting... write_all_log_i386: starting... write_all_log_i386: CHS: 3460/0/1,lba=55584900 write_all_log_i386: CHS: 3971/0/1,lba=63794115 TestDisk exited normally.