Sat Feb 17 21:48:12 2024
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=6001175126016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001175126016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=937332572160
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=490667503616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=998857768960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=6001157734400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=6001157734400
Hard disk list
Disk \\.\PhysicalDrive0 - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - WDC WD60PURZ-85ZUFY1, S/N:WD-WX41D97L24T4, FW:80.00A80
Disk \\.\PhysicalDrive1 - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - WDC WD60PURZ-85ZUFY1, S/N:WD-WX61D9755A6P, FW:80.00A80
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - NVMe Samsung SSD 970, S/N:0025_385C_9150_A39A., FW:2B2Q
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 980 1TB, S/N:0025_38D6_1142_BC32., FW:1B4QFXO7
Disk \\.\PhysicalDrive4 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM0 12 HN-M500MBB, S/N:F1F182902240

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive4 - 500 GB / 465 GiB - ST500LM0 12 HN-M500MBB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
796badd3 6bbf 4d9f b6 31 46 6e b7 1a 49 65
check_part_gpt failed for partition
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
 1 P EFI System                  2048    1026047    1024000 [EFI system partition]
796badd3 6bbf 4d9f b6 31 46 6e b7 1a 49 65
 2 P Unknown                  1026048    1107967      81920 [Basic data partition]
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
 4 P Windows Recovery Env     1370112    2394111    1024000 [Basic data partition]
 5 P MS Data                  2394112  960729079  958334968 [Basic data partition] [OS]
     NTFS, blocksize=4096, 490 GB / 456 GiB
 6 P Windows Recovery Env   960729088  961650687     921600
 7 P Windows Recovery Env   961650688  976771119   15120432 [Microsoft recovery partition]
796badd3 6bbf 4d9f b6 31 46 6e b7 1a 49 65
796badd3 6bbf 4d9f b6 31 46 6e b7 1a 49 65

Analyse Disk \\.\PhysicalDrive4 - 500 GB / 465 GiB - CHS 60801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976773167 (expected 976773167)
hdr_lba_start=34
hdr_lba_end=976773134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
796badd3 6bbf 4d9f b6 31 46 6e b7 1a 49 65
check_part_gpt failed for partition
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
Current partition structure:
 1 P EFI System                  2048    1026047    1024000 [EFI system partition]
 2 P Unknown                  1026048    1107967      81920 [Basic data partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
 3 P MS Reserved              1107968    1370111     262144 [Microsoft reserved partition]
 4 P Windows Recovery Env     1370112    2394111    1024000 [Basic data partition]
 5 P MS Data                  2394112  960729079  958334968 [Basic data partition] [OS]
 6 P Windows Recovery Env   960729088  961650687     921600
 7 P Windows Recovery Env   961650688  976771119   15120432 [Microsoft recovery partition]
Backup partition structure
partition_save

search_part()
Disk \\.\PhysicalDrive4 - 500 GB / 465 GiB - CHS 60801 255 63
FAT32 at 0/32/33
FAT1 : 6206-7198
FAT2 : 7199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1023999
sectors : 1024000
cluster_size : 8
no_of_cluster : 126976 (2 - 126977)
fat_length 993 calculated 993

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
     EFI System                  2048    1026047    1024000 [EFI System Partition] [ESP]
     FAT32, blocksize=4096, 524 MB / 500 MiB
FAT32 at 63/221/31
FAT1 : 7038-7614
FAT2 : 7615-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-81919
sectors : 81920
cluster_size : 1
no_of_cluster : 73728 (2 - 73729)
fat_length 577 calculated 577

FAT32 at 63/221/31
FAT: cluster=2(0x2), pos=1034240
     MS Data                  1026048    1107967      81920 [DIAGS]
     FAT32, blocksize=512, 41 MB / 40 MiB
NTFS at 85/72/52
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   346113    1370112    1024000
     NTFS found using backup sector, blocksize=4096, 524 MB / 500 MiB
NTFS at 85/72/52
filesystem size           1024000
sectors_per_cluster       8
mft_lcn                   42666
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  1370112    2394111    1024000 [WINRETOOLS]
     NTFS, blocksize=4096, 524 MB / 500 MiB
NTFS at 149/6/50
filesystem size           958334968
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1225785344, part_size=490667503616, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 149/6/50
filesystem size           958334968
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  2394112  960729079  958334968 [OS]
     NTFS, blocksize=4096, 490 GB / 456 GiB
NTFS at 59802/158/5
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                959807489  960729088     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
NTFS at 59802/158/5
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                960729088  961650687     921600
     NTFS, blocksize=4096, 471 MB / 450 MiB
NTFS at 59859/251/41
filesystem size           15120432
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                946530257  961650688   15120432
     NTFS found using backup sector, blocksize=4096, 7741 MB / 7383 MiB
NTFS at 59859/251/41
filesystem size           15120432
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                961650688  976771119   15120432 [PBR Image]
     NTFS, blocksize=4096, 7741 MB / 7383 MiB
file_win32_pread(620,11,buffer,976773160(60801/80/56)) read err: read after end of file
file_win32_pread(620,11,buffer,976773164(60801/80/60)) read err: read after end of file
file_win32_pread(620,8,buffer,976773163(60801/80/59)) read err: read after end of file
NTFS at 60801/80/15
filesystem size           974379008
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  2394112  976773119  974379008 [OS]
     NTFS found using backup sector, blocksize=4096, 498 GB / 464 GiB
NTFS at 60801/80/15
filesystem size           974379008
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     MS Data                976773119 1951152126  974379008
     NTFS, blocksize=4096, 498 GB / 464 GiB
This partition ends after the disk limits. (start=976773119, size=974379008, end=1951152126, disk end=976773168)
file_win32_pread(620,14,buffer,976773155(60801/80/51)) read err: read after end of file
file_win32_pread(620,14,buffer,976773156(60801/80/52)) read err: read after end of file
file_win32_pread(620,14,buffer,976773157(60801/80/53)) read err: read after end of file
file_win32_pread(620,14,buffer,976773158(60801/80/54)) read err: read after end of file
file_win32_pread(620,14,buffer,976773159(60801/80/55)) read err: read after end of file
file_win32_pread(620,14,buffer,976773160(60801/80/56)) read err: read after end of file
file_win32_pread(620,14,buffer,976773162(60801/80/58)) read err: read after end of file
file_win32_pread(620,14,buffer,976773164(60801/80/60)) read err: read after end of file
file_win32_pread(620,14,buffer,976773166(60801/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive4 - 500 GB / 465 GiB - CHS 60801 255 63
Check the hard disk size: HD jumper settings, BIOS detection...
The hard disk (500 GB / 465 GiB) seems too small! (< 998 GB / 930 GiB)
The following partition can't be recovered:
     MS Data                976773119 1951152126  974379008
     NTFS, blocksize=4096, 498 GB / 464 GiB
SIGHUP detected! PhotoRec has been killed.