TestDisk 6.9, Data Recovery Utility, February 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Linux version (ext2fs lib: 1.39, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20070512)
Hard disk list
Disk /dev/sda - 82 GB / 76 GiB - CHS 10011 255 63, sector size=512 - ATA ExcelStor Techno
Disk /dev/sda - 82 GB / 76 GiB - ATA ExcelStor Techno
Partition table type: Intel
Analyse Disk /dev/sda - 82 GB / 76 GiB - CHS 10011 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
LVM2 magic value at 6072/0/1
NTFS at 1/1/1
get_geometry_from_list_part_aux head=255 nbr=10
get_geometry_from_list_part_aux head=8 nbr=6
get_geometry_from_list_part_aux head=16 nbr=4
get_geometry_from_list_part_aux head=32 nbr=4
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=10
Current partition structure:
1 E extended LBA 1 0 1 4767 254 63 76581855
Invalid NTFS boot
2 * HPFS - NTFS 4768 0 1 6046 254 63 20547135
2 * HPFS - NTFS 4768 0 1 6046 254 63 20547135
3 P Linux 6047 0 1 6071 254 63 401625 [/boot]
4 P Linux LVM 6072 0 1 10010 254 63 63280035
5 L HPFS - NTFS 1 1 1 4767 254 63 76581792
Backup partition structure
partition_save
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0
search_part()
Disk /dev/sda - 82 GB / 76 GiB - CHS 10011 255 63
NTFS at 0/1/1
filesystem size 30716209
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1919763
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 1911 254 55 30716209
NTFS, 15 GB / 14 GiB
recover_EXT2: s_block_group_nr=0/24, s_mnt_count=49/4294967295, s_blocks_per_group=8192
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 200812
recover_EXT2: part_size 401624
D Linux 6047 0 1 6071 254 62 401624 [/boot]
EXT3 Sparse superblock Recover, 205 MB / 196 MiB
LVM2 magic value at 6072/0/1
part_size 63280035
D Linux LVM 6072 0 1 10010 254 63 63280035
LVM2, 32 GB / 30 GiB
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=5
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Results
* HPFS - NTFS 0 1 1 1911 254 63 30716217
NTFS, 15 GB / 14 GiB
P Linux 6047 0 1 6071 254 63 401625 [/boot]
EXT3 Sparse superblock Recover, 205 MB / 196 MiB
P Linux LVM 6072 0 1 10010 254 63 63280035
LVM2, 32 GB / 30 GiB
interface_write()
1 * HPFS - NTFS 0 1 1 1911 254 63 30716217
2 P Linux 6047 0 1 6071 254 63 401625 [/boot]
3 P Linux LVM 6072 0 1 10010 254 63 63280035
search_part()
Disk /dev/sda - 82 GB / 76 GiB - CHS 10011 255 63
NTFS at 0/1/1
filesystem size 30716209
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 1919763
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 1911 254 55 30716209
NTFS, 15 GB / 14 GiB
NTFS at 1/1/1
filesystem size 76581792
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4786361
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 1 1 1 4767 254 63 76581792
NTFS, 39 GB / 36 GiB
NTFS at 4767/254/63
filesystem size 76581792
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4786361
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 1 1 1 4767 254 63 76581792
NTFS found using backup sector!, 39 GB / 36 GiB
NTFS at 6046/254/63
filesystem size 20547121
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 1223998
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 4768 0 15 6046 254 63 20547121
NTFS found using backup sector!, 10520 MB / 10032 MiB
recover_EXT2: s_block_group_nr=0/24, s_mnt_count=49/4294967295, s_blocks_per_group=8192
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 200812
recover_EXT2: part_size 401624
D Linux 6047 0 1 6071 254 62 401624 [/boot]
EXT3 Sparse superblock Recover, 205 MB / 196 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/24, s_mnt_count=0/4294967295, s_blocks_per_group=8192
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 200812
recover_EXT2: part_size 401624
D Linux 6047 0 1 6071 254 62 401624 [/boot]
EXT3 Sparse superblock Backup superblock, 205 MB / 196 MiB
LVM2 magic value at 6072/0/1
part_size 63280035
D Linux LVM 6072 0 1 10010 254 63 63280035
LVM2, 32 GB / 30 GiB
recover_EXT2: s_block_group_nr=0/237, s_mnt_count=43/4294967295, s_blocks_per_group=32768
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7766016
recover_EXT2: part_size 62128128
D Linux 6080 0 1 9947 75 48 62128128
EXT3 Large file Sparse superblock Recover, 31 GB / 29 GiB
recover_EXT2: s_block_group_nr=0/76, s_mnt_count=1/30, s_blocks_per_group=32768
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2502123
recover_EXT2: part_size 20016984
D Linux 6118 0 1 7363 254 57 20016984
EXT3 Sparse superblock, 10248 MB / 9773 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/76, s_mnt_count=0/30, s_blocks_per_group=32768
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2502123
recover_EXT2: part_size 20016984
D Linux 6118 0 1 7363 254 57 20016984
EXT3 Sparse superblock Backup superblock, 10248 MB / 9773 MiB
NTFS at 10009/254/63
filesystem size 160810587
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 10050661
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 0 1 1 10009 254 63 160810587
NTFS found using backup sector!, 82 GB / 76 GiB
NTFS at 10010/254/63
filesystem size 84228795
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 5264299
clusters_per_mft_record -10
clusters_per_index_record 1
D HPFS - NTFS 4768 0 1 10010 254 63 84228795
NTFS found using backup sector!, 43 GB / 40 GiB
NTFS at 4767/254/63
filesystem size 76581792
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4786361
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS at 4767/254/63
filesystem size 76581792
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 4786361
clusters_per_mft_record -10
clusters_per_index_record 1
get_geometry_from_list_part_aux head=255 nbr=15
get_geometry_from_list_part_aux head=8 nbr=10
get_geometry_from_list_part_aux head=16 nbr=7
get_geometry_from_list_part_aux head=32 nbr=7
get_geometry_from_list_part_aux head=64 nbr=4
get_geometry_from_list_part_aux head=128 nbr=3
get_geometry_from_list_part_aux head=240 nbr=4
get_geometry_from_list_part_aux head=255 nbr=15
Results
D HPFS - NTFS 0 1 1 1911 254 63 30716217
NTFS, 15 GB / 14 GiB
D HPFS - NTFS 0 1 1 10009 254 63 160810587
NTFS found using backup sector!, 82 GB / 76 GiB
D HPFS - NTFS 1 1 1 4767 254 63 76581792
NTFS, 39 GB / 36 GiB
D HPFS - NTFS 4767 254 63 9534 254 63 76581856
NTFS, 39 GB / 36 GiB
D HPFS - NTFS 4768 0 1 10010 254 63 84228795
NTFS found using backup sector!, 43 GB / 40 GiB
D HPFS - NTFS 4768 0 15 6046 254 63 20547121
NTFS found using backup sector!, 10520 MB / 10032 MiB
D Linux 6047 0 1 6071 254 63 401625 [/boot]
EXT3 Sparse superblock Recover, 205 MB / 196 MiB
D Linux LVM 6072 0 1 10010 254 63 63280035
LVM2, 32 GB / 30 GiB
D Linux 6080 0 1 9947 254 63 62139420
EXT3 Large file Sparse superblock Recover, 31 GB / 29 GiB
D Linux 6118 0 1 7363 254 63 20016990
EXT3 Sparse superblock, 10248 MB / 9773 MiB