Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Doesn't work for my disk #118

Open
TishSerg opened this issue Jan 5, 2024 · 3 comments
Open

Doesn't work for my disk #118

TishSerg opened this issue Jan 5, 2024 · 3 comments

Comments

@TishSerg
Copy link

TishSerg commented Jan 5, 2024

My disk (to be more precise: the partition of interest) is perfectly recoverable by the top recovery tools (R-Studio and DMDE).

Since I read through your master thesis and liked it I wanted to test RecuperaBit on that disk/partition. To my disappointment it didn't work as expected. I would say it didn't work at all.

I boot live Caine 13.0. RecuperaBit v1.1.1 already present there. But since it's not the latest version, I downloaded v1.1.6 from GitHub and ran it using Python.

The disk condition:

  • Has some bads and slow regions
  • MBR is ok
  • Partition of interest has readable Boot sector, but missing the first 4 MFT entries (that 4 KB phisical sector has failed). Also it has missing MFT mirror (tha same 4 entries). The following MFT entries look ok.

First I wanted to check only the partition of interest:

caine@caine:~/Downloads/RecuperaBit-master$ sudo python ./main.py -s ../PHD_Data3_recuperabit.savefile -o ../PHD_Data3/ /dev/sdc6
     ___                                ___ _ _   
    | _ \___ __ _  _ _ __  ___ _ _ __ _| _ |_) |_ 
    |   / -_) _| || | '_ \/ -_) '_/ _` | _ \ |  _|
    |_|_\___\__|\_,_| .__/\___|_| \__,_|___/_|\__|
                    |_|   v1.1.6
    (c) 2014-2021, Andrea Lazzarotto <[email protected]>
    Released under the GPLv3

INFO:root:Checking if results already exist.
INFO:root:Unable to open save file.
INFO:root:Results will be saved to ../PHD_Data3_recuperabit.savefile
Type [Enter] to start the analysis or "exit" / "quit" / "q" to quit: 
INFO:root:Analysis started! This is going to take time...
INFO:root:Found NTFS boot sector at sector 0
INFO:root:Found NTFS index record at sector 16
INFO:root:Found NTFS index record at sector 24
INFO:root:Found NTFS index record at sector 40
WARNING:root:Cannot read sector(s). Filling with 0x00. Offset: 568 Size: 1 Bsize: 512
INFO:root:First scan completed
INFO:root:Saving results to ../PHD_Data3_recuperabit.savefile
INFO:root:Parsing MFT entries
INFO:root:Parsing INDX records
INFO:root:Reading boot sectors
INFO:root:Finding partition geometry
INFO:root:0 partitions found.

Write command ("help" for details):
> recoverable

Write command ("help" for details):
> allparts

Write command ("help" for details):
>

Surprised by that result, I ran it for whole disk:

caine@caine:~/Downloads/RecuperaBit-master$ sudo python ./main.py -s ../PHD_recuperabit.savefile -o ../PHD/ /dev/sdc
     ___                                ___ _ _   
    | _ \___ __ _  _ _ __  ___ _ _ __ _| _ |_) |_ 
    |   / -_) _| || | '_ \/ -_) '_/ _` | _ \ |  _|
    |_|_\___\__|\_,_| .__/\___|_| \__,_|___/_|\__|
                    |_|   v1.1.6
    (c) 2014-2021, Andrea Lazzarotto <[email protected]>
    Released under the GPLv3

INFO:root:Checking if results already exist.
INFO:root:Unable to open save file.
INFO:root:Results will be saved to ../PHD_recuperabit.savefile
Type [Enter] to start the analysis or "exit" / "quit" / "q" to quit: 
INFO:root:Analysis started! This is going to take time...
Snip those 'INFO:root:Found NTFS * at sector *' 
INFO:root:Found NTFS boot sector at sector 2
INFO:root:Found NTFS boot sector at sector 1427750
INFO:root:Found NTFS file record at sector 1427766
INFO:root:Found NTFS file record at sector 1427768
INFO:root:Found NTFS file record at sector 1427770
INFO:root:Found NTFS file record at sector 1427772
INFO:root:Found NTFS file record at sector 1427774
INFO:root:Found NTFS file record at sector 1427776
INFO:root:Found NTFS file record at sector 1427778
INFO:root:Found NTFS file record at sector 1427780
INFO:root:Found NTFS file record at sector 1427782
INFO:root:Found NTFS file record at sector 1427784
INFO:root:Found NTFS file record at sector 1427786
INFO:root:Found NTFS file record at sector 1427788
INFO:root:Found NTFS file record at sector 1427790
INFO:root:Found NTFS file record at sector 1429808
INFO:root:Found NTFS file record at sector 1429810
INFO:root:Found NTFS file record at sector 1429812
INFO:root:Found NTFS file record at sector 1429814
INFO:root:Found NTFS file record at sector 1429816
INFO:root:Found NTFS file record at sector 1429818
INFO:root:Found NTFS file record at sector 1429820
INFO:root:Found NTFS file record at sector 1429822
INFO:root:Found NTFS file record at sector 1429824
INFO:root:Found NTFS file record at sector 1429826
INFO:root:Found NTFS file record at sector 1429828
INFO:root:Found NTFS file record at sector 1429830
INFO:root:Found NTFS file record at sector 1429832
INFO:root:Found NTFS file record at sector 1429834
INFO:root:Found NTFS file record at sector 1429836
INFO:root:Found NTFS file record at sector 1429838
INFO:root:Found NTFS file record at sector 1432912
INFO:root:Found NTFS file record at sector 1432914
INFO:root:Found NTFS file record at sector 1432916
INFO:root:Found NTFS file record at sector 1432918
INFO:root:Found NTFS index record at sector 1432991
INFO:root:Found NTFS file record at sector 4931838
INFO:root:Found NTFS boot sector at sector 5524399
INFO:root:Found NTFS boot sector at sector 5864066
INFO:root:Found NTFS file record at sector 5864118
INFO:root:Found NTFS file record at sector 5864120
INFO:root:Found NTFS file record at sector 5864122
INFO:root:Found NTFS file record at sector 5864124
INFO:root:Found NTFS file record at sector 5864126
INFO:root:Found NTFS file record at sector 5864128
INFO:root:Found NTFS file record at sector 5864130
INFO:root:Found NTFS file record at sector 5864132
INFO:root:Found NTFS file record at sector 5864134
INFO:root:Found NTFS file record at sector 5864136
INFO:root:Found NTFS file record at sector 5864138
INFO:root:Found NTFS file record at sector 5864140
INFO:root:Found NTFS file record at sector 5864142
INFO:root:Found NTFS file record at sector 5864144
INFO:root:Found NTFS file record at sector 5864146
INFO:root:Found NTFS file record at sector 5864148
INFO:root:Found NTFS file record at sector 5864150
INFO:root:Found NTFS file record at sector 5864152
INFO:root:Found NTFS file record at sector 5864154
INFO:root:Found NTFS file record at sector 5864156
INFO:root:Found NTFS file record at sector 5864158
INFO:root:Found NTFS file record at sector 5864160
INFO:root:Found NTFS file record at sector 5864162
INFO:root:Found NTFS file record at sector 5864164
INFO:root:Found NTFS file record at sector 5864166
INFO:root:Found NTFS file record at sector 5864168
INFO:root:Found NTFS file record at sector 5864170
INFO:root:Found NTFS file record at sector 5864172
INFO:root:Found NTFS index record at sector 5865526
INFO:root:Found NTFS file record at sector 5865534
INFO:root:Found NTFS file record at sector 5865536
INFO:root:Found NTFS file record at sector 5865538
INFO:root:Found NTFS boot sector at sector 5865962
INFO:root:Found NTFS boot sector at sector 6605323
INFO:root:Found NTFS boot sector at sector 6605851
INFO:root:Found NTFS boot sector at sector 6606379
INFO:root:Found NTFS boot sector at sector 6606907
INFO:root:Found NTFS boot sector at sector 7493810
INFO:root:Found NTFS file record at sector 7493862
INFO:root:Found NTFS file record at sector 7493864
INFO:root:Found NTFS file record at sector 7493866
INFO:root:Found NTFS file record at sector 7493868
INFO:root:Found NTFS file record at sector 7493870
INFO:root:Found NTFS file record at sector 7493872
INFO:root:Found NTFS file record at sector 7493874
INFO:root:Found NTFS file record at sector 7493876
INFO:root:Found NTFS file record at sector 7493878
INFO:root:Found NTFS file record at sector 7493880
INFO:root:Found NTFS file record at sector 7493882
INFO:root:Found NTFS file record at sector 7493884
INFO:root:Found NTFS file record at sector 7493886
INFO:root:Found NTFS file record at sector 7493888
INFO:root:Found NTFS file record at sector 7493890
INFO:root:Found NTFS file record at sector 7493892
INFO:root:Found NTFS file record at sector 7493894
INFO:root:Found NTFS file record at sector 7493896
INFO:root:Found NTFS file record at sector 7493898
INFO:root:Found NTFS file record at sector 7493900
INFO:root:Found NTFS file record at sector 7493902
INFO:root:Found NTFS file record at sector 7493904
INFO:root:Found NTFS file record at sector 7493906
INFO:root:Found NTFS file record at sector 7493908
INFO:root:Found NTFS file record at sector 7493910
INFO:root:Found NTFS file record at sector 7493912
INFO:root:Found NTFS file record at sector 7493914
INFO:root:Found NTFS file record at sector 7493916
INFO:root:Found NTFS index record at sector 7495270
INFO:root:Found NTFS file record at sector 7495278
INFO:root:Found NTFS file record at sector 7495280
INFO:root:Found NTFS file record at sector 7495282
INFO:root:Found NTFS boot sector at sector 7495706
INFO:root:Found NTFS boot sector at sector 7525488
INFO:root:Found NTFS file record at sector 13311448
INFO:root:Found NTFS boot sector at sector 15612162
INFO:root:Found NTFS file record at sector 15612178
INFO:root:Found NTFS file record at sector 15612180
INFO:root:Found NTFS file record at sector 15612182
INFO:root:Found NTFS file record at sector 15612184
INFO:root:Found NTFS file record at sector 15612186
INFO:root:Found NTFS file record at sector 15612188
INFO:root:Found NTFS file record at sector 15612190
INFO:root:Found NTFS file record at sector 15612192
INFO:root:Found NTFS file record at sector 15612194
INFO:root:Found NTFS file record at sector 15612196
INFO:root:Found NTFS file record at sector 15612198
INFO:root:Found NTFS file record at sector 15612200
INFO:root:Found NTFS file record at sector 15612202
INFO:root:Found NTFS file record at sector 15614220
INFO:root:Found NTFS file record at sector 15614222
INFO:root:Found NTFS file record at sector 15614224
INFO:root:Found NTFS file record at sector 15614226
INFO:root:Found NTFS file record at sector 15614228
INFO:root:Found NTFS file record at sector 15614230
INFO:root:Found NTFS file record at sector 15614232
INFO:root:Found NTFS file record at sector 15614234
INFO:root:Found NTFS file record at sector 15614236
INFO:root:Found NTFS file record at sector 15614238
INFO:root:Found NTFS file record at sector 15614240
INFO:root:Found NTFS file record at sector 15614242
INFO:root:Found NTFS file record at sector 15614244
INFO:root:Found NTFS file record at sector 15614246
INFO:root:Found NTFS file record at sector 15614248
INFO:root:Found NTFS file record at sector 15614250
INFO:root:Found NTFS file record at sector 15617324
INFO:root:Found NTFS file record at sector 15617326
INFO:root:Found NTFS file record at sector 15617328
INFO:root:Found NTFS file record at sector 15617330
INFO:root:Found NTFS index record at sector 15617403
INFO:root:Found NTFS boot sector at sector 15620092
INFO:root:Found NTFS file record at sector 17850956
INFO:root:Found NTFS boot sector at sector 17859444
INFO:root:Found NTFS file record at sector 17859985
INFO:root:Found NTFS file record at sector 17866669
INFO:root:Found NTFS boot sector at sector 17875944
INFO:root:Found NTFS file record at sector 17876485
INFO:root:Found NTFS boot sector at sector 17879444
INFO:root:Found NTFS file record at sector 17879985
INFO:root:Found NTFS boot sector at sector 17883075
INFO:root:Found NTFS boot sector at sector 17897560
INFO:root:Found NTFS file record at sector 17898101
INFO:root:Found NTFS boot sector at sector 17901792
INFO:root:Found NTFS file record at sector 17902333
INFO:root:Found NTFS boot sector at sector 17932392
INFO:root:Found NTFS file record at sector 17932933
INFO:root:Found NTFS boot sector at sector 17936008
INFO:root:Found NTFS file record at sector 17936549
INFO:root:Found NTFS boot sector at sector 17940220
INFO:root:Found NTFS file record at sector 17940761
INFO:root:Found NTFS boot sector at sector 17953412
INFO:root:Found NTFS file record at sector 17953953
INFO:root:Found NTFS file record at sector 20630019
INFO:root:Found NTFS boot sector at sector 24247578
INFO:root:Found NTFS file record at sector 24247594
INFO:root:Found NTFS file record at sector 24247596
INFO:root:Found NTFS file record at sector 24247598
INFO:root:Found NTFS file record at sector 24247600
INFO:root:Found NTFS file record at sector 24247602
INFO:root:Found NTFS file record at sector 24247604
INFO:root:Found NTFS file record at sector 24247606
INFO:root:Found NTFS file record at sector 24247608
INFO:root:Found NTFS file record at sector 24247610
INFO:root:Found NTFS file record at sector 24247612
INFO:root:Found NTFS file record at sector 24247614
INFO:root:Found NTFS file record at sector 24247616
INFO:root:Found NTFS file record at sector 24247618
INFO:root:Found NTFS file record at sector 24249636
INFO:root:Found NTFS file record at sector 24249638
INFO:root:Found NTFS file record at sector 24249640
INFO:root:Found NTFS file record at sector 24249642
INFO:root:Found NTFS file record at sector 24249644
INFO:root:Found NTFS file record at sector 24249646
INFO:root:Found NTFS file record at sector 24249648
INFO:root:Found NTFS file record at sector 24249650
INFO:root:Found NTFS file record at sector 24249652
INFO:root:Found NTFS file record at sector 24249654
INFO:root:Found NTFS file record at sector 24249656
INFO:root:Found NTFS file record at sector 24249658
INFO:root:Found NTFS file record at sector 24249660
INFO:root:Found NTFS file record at sector 24249662
INFO:root:Found NTFS file record at sector 24249664
INFO:root:Found NTFS file record at sector 24249666
INFO:root:Found NTFS file record at sector 24252740
INFO:root:Found NTFS file record at sector 24252742
INFO:root:Found NTFS file record at sector 24252744
INFO:root:Found NTFS file record at sector 24252746
INFO:root:Found NTFS index record at sector 24252819
INFO:root:Found NTFS boot sector at sector 24881982
INFO:root:Found NTFS file record at sector 24881998
INFO:root:Found NTFS file record at sector 24882000
INFO:root:Found NTFS file record at sector 24882002
INFO:root:Found NTFS file record at sector 24882004
INFO:root:Found NTFS file record at sector 24882006
INFO:root:Found NTFS file record at sector 24882008
INFO:root:Found NTFS file record at sector 24882010
INFO:root:Found NTFS file record at sector 24882012
INFO:root:Found NTFS file record at sector 24882014
INFO:root:Found NTFS file record at sector 24882016
INFO:root:Found NTFS file record at sector 24882018
INFO:root:Found NTFS file record at sector 24882020
INFO:root:Found NTFS file record at sector 24882022
INFO:root:Found NTFS file record at sector 24884040
INFO:root:Found NTFS file record at sector 24884042
INFO:root:Found NTFS file record at sector 24884044
INFO:root:Found NTFS file record at sector 24884046
INFO:root:Found NTFS file record at sector 24884048
INFO:root:Found NTFS file record at sector 24884050
INFO:root:Found NTFS file record at sector 24884052
INFO:root:Found NTFS file record at sector 24884054
INFO:root:Found NTFS file record at sector 24884056
INFO:root:Found NTFS file record at sector 24884058
INFO:root:Found NTFS file record at sector 24884060
INFO:root:Found NTFS file record at sector 24884062
INFO:root:Found NTFS file record at sector 24884064
INFO:root:Found NTFS file record at sector 24884066
INFO:root:Found NTFS file record at sector 24884068
INFO:root:Found NTFS file record at sector 24884070
INFO:root:Found NTFS file record at sector 24887144
INFO:root:Found NTFS file record at sector 24887146
INFO:root:Found NTFS file record at sector 24887148
INFO:root:Found NTFS file record at sector 24887150
INFO:root:Found NTFS index record at sector 24887223
INFO:root:Found NTFS file record at sector 30925445
INFO:root:Found NTFS file record at sector 30962038
INFO:root:Found NTFS file record at sector 31011884

WARNING:root:Cannot read sector(s). Filling with 0x00. Offset: 31519712 Size: 1 Bsize: 512
INFO:root:First scan completed
INFO:root:Saving results to ../PHD_recuperabit.savefile
INFO:root:Parsing MFT entries
INFO:root:Parsing INDX records
INFO:root:Reading boot sectors
DEBUG:root:Dropping bogus NTFS partition with MFT position 24887144 generated by MFT mirror of partition at offset 24881982
DEBUG:root:Dropping bogus NTFS partition with MFT position 24252740 generated by MFT mirror of partition at offset 24247578
DEBUG:root:Dropping bogus NTFS partition with MFT position 15617324 generated by MFT mirror of partition at offset 15612162
DEBUG:root:Dropping bogus NTFS partition with MFT position 1432912 generated by MFT mirror of partition at offset 1427750
INFO:root:Finding partition geometry
INFO:root:Finalizing MFT reconstruction of partition at offset 24881982
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
INFO:root:Finalizing MFT reconstruction of partition at offset 24247578
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
INFO:root:Finalizing MFT reconstruction of partition at offset 15612162
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
INFO:root:Finalizing MFT reconstruction of partition at offset 1427750
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
INFO:root:MFT for partition at offset 24881982 is fragmented. Trying to merge 2 parts...
DEBUG:root:Merging partition with MFT offset 24881966 into Partition (NTFS, 3.01 MB, 14 files, Recoverable, Offset: 24881982, Offset (b): 12739574784, Sec/Clus: 1, MFT offset: 24884040, MFT mirror offset: 24887144) (fragmented MFT)
INFO:root:MFT for partition at offset 24247578 is fragmented. Trying to merge 2 parts...
DEBUG:root:Merging partition with MFT offset 24247562 into Partition (NTFS, 3.01 MB, 14 files, Recoverable, Offset: 24247578, Offset (b): 12414759936, Sec/Clus: 1, MFT offset: 24249636, MFT mirror offset: 24252740) (fragmented MFT)
INFO:root:MFT for partition at offset 15612162 is fragmented. Trying to merge 2 parts...
DEBUG:root:Merging partition with MFT offset 15612146 into Partition (NTFS, 3.01 MB, 14 files, Recoverable, Offset: 15612162, Offset (b): 7993426944, Sec/Clus: 1, MFT offset: 15614220, MFT mirror offset: 15617324) (fragmented MFT)
INFO:root:MFT for partition at offset 1427750 is fragmented. Trying to merge 2 parts...
DEBUG:root:Merging partition with MFT offset 1427734 into Partition (NTFS, 3.01 MB, 14 files, Recoverable, Offset: 1427750, Offset (b): 731008000, Sec/Clus: 1, MFT offset: 1429808, MFT mirror offset: 1432912) (fragmented MFT)
INFO:root:6 partitions found.

Write command ("help" for details):
> recoverable
Partition #0 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 24881982, Offset (b): 12739574784, Sec/Clus: 1, MFT offset: 24884040, MFT mirror offset: 24887144)
Partition #1 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 24247578, Offset (b): 12414759936, Sec/Clus: 1, MFT offset: 24249636, MFT mirror offset: 24252740)
Partition #4 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 15612162, Offset (b): 7993426944, Sec/Clus: 1, MFT offset: 15614220, MFT mirror offset: 15617324)
Partition #5 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 1427750, Offset (b): 731008000, Sec/Clus: 1, MFT offset: 1429808, MFT mirror offset: 1432912)

Write command ("help" for details):
> allparts
Partition #0 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 24881982, Offset (b): 12739574784, Sec/Clus: 1, MFT offset: 24884040, MFT mirror offset: 24887144)
Partition #1 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 24247578, Offset (b): 12414759936, Sec/Clus: 1, MFT offset: 24249636, MFT mirror offset: 24252740)
Partition #2 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 5865486, MFT mirror offset: None)
Partition #3 -> Partition (NTFS, ??? b, 3 files, Offset: None, Offset (b): None, Sec/Clus: None, MFT offset: 7495230, MFT mirror offset: None)
Partition #4 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 15612162, Offset (b): 7993426944, Sec/Clus: 1, MFT offset: 15614220, MFT mirror offset: 15617324)
Partition #5 -> Partition (NTFS, 3.01 MB, 19 files, Recoverable, Offset: 1427750, Offset (b): 731008000, Sec/Clus: 1, MFT offset: 1429808, MFT mirror offset: 1432912)

Write command ("help" for details):
>

See all the found partitions have same size and files? That's bullshit! Actual layout is:

root@caine:/home/caine# fdisk -l /dev/sdc
Disk /dev/sdc: 931,51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: Silicon-Power   
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x8eb658a1

Device     Boot      Start        End    Sectors   Size Id Type
/dev/sdc1  *      75497472  314572799  239075328   114G  c W95 FAT32 (LBA)
/dev/sdc2        314572800  314638335      65536    32M ef EFI (FAT-12/16/32)
/dev/sdc3        356515777 1953521663 1597005887 761,5G  f W95 Ext'd (LBA)
/dev/sdc5        356515840 1352660991  996145152   475G  7 HPFS/NTFS/exFAT
/dev/sdc6       1352663040 1751119871  398456832   190G  7 HPFS/NTFS/exFAT

Partition 3 does not start on physical sector boundary.
root@caine:/home/caine#

Additional info:

root@caine:/home/caine# file -s /dev/sdc6
/dev/sdc6: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 63, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63, sectors 398456824, $MFT start cluster 2286, $MFTMirror start cluster 4, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 01d741ab62d63ee0; contains bootstrap NTLDR
root@caine:/home/caine# 
root@caine:/home/caine# hexdump -C -s 0 -n 512 -v /dev/sdc6
00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 3f 00 00 00  |........?...?...|
00000020  00 00 00 00 80 00 80 00  f8 f7 bf 17 00 00 00 00  |................|
00000030  ee 08 00 00 00 00 00 00  04 00 00 00 00 00 00 00  |................|
00000040  f6 00 00 00 01 00 00 00  e0 3e d6 62 ab 41 d7 01  |.........>.b.A..|
00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb b8 c0 07  |.....3.....|....|
00000060  8e d8 e8 16 00 b8 00 0d  8e c0 33 db c6 06 0e 00  |..........3.....|
00000070  10 e8 53 00 68 00 0d 68  6a 02 cb 8a 16 24 00 b4  |..S.h..hj....$..|
00000080  08 cd 13 73 05 b9 ff ff  8a f1 66 0f b6 c6 40 66  |...s......f...@f|
00000090  0f b6 d1 80 e2 3f f7 e2  86 cd c0 ed 06 41 66 0f  |.....?.......Af.|
000000a0  b7 c9 66 f7 e1 66 a3 20  00 c3 b4 41 bb aa 55 8a  |..f..f. ...A..U.|
000000b0  16 24 00 cd 13 72 0f 81  fb 55 aa 75 09 f6 c1 01  |.$...r...U.u....|
000000c0  74 04 fe 06 14 00 c3 66  60 1e 06 66 a1 10 00 66  |t......f`..f...f|
000000d0  03 06 1c 00 66 3b 06 20  00 0f 82 3a 00 1e 66 6a  |....f;. ...:..fj|
000000e0  00 66 50 06 53 66 68 10  00 01 00 80 3e 14 00 00  |.fP.Sfh.....>...|
000000f0  0f 85 0c 00 e8 b3 ff 80  3e 14 00 00 0f 84 61 00  |........>.....a.|
00000100  b4 42 8a 16 24 00 16 1f  8b f4 cd 13 66 58 5b 07  |.B..$.......fX[.|
00000110  66 58 66 58 1f eb 2d 66  33 d2 66 0f b7 0e 18 00  |fXfX..-f3.f.....|
00000120  66 f7 f1 fe c2 8a ca 66  8b d0 66 c1 ea 10 f7 36  |f......f..f....6|
00000130  1a 00 86 d6 8a 16 24 00  8a e8 c0 e4 06 0a cc b8  |......$.........|
00000140  01 02 cd 13 0f 82 19 00  8c c0 05 20 00 8e c0 66  |........... ...f|
00000150  ff 06 10 00 ff 0e 0e 00  0f 85 6f ff 07 1f 66 61  |..........o...fa|
00000160  c3 a0 f8 01 e8 09 00 a0  fb 01 e8 03 00 fb eb fe  |................|
00000170  b4 01 8b f0 ac 3c 00 74  09 b4 0e bb 07 00 cd 10  |.....<.t........|
00000180  eb f2 c3 0d 0a 41 20 64  69 73 6b 20 72 65 61 64  |.....A disk read|
00000190  20 65 72 72 6f 72 20 6f  63 63 75 72 72 65 64 00  | error occurred.|
000001a0  0d 0a 4e 54 4c 44 52 20  69 73 20 6d 69 73 73 69  |..NTLDR is missi|
000001b0  6e 67 00 0d 0a 4e 54 4c  44 52 20 69 73 20 63 6f  |ng...NTLDR is co|
000001c0  6d 70 72 65 73 73 65 64  00 0d 0a 50 72 65 73 73  |mpressed...Press|
000001d0  20 43 74 72 6c 2b 41 6c  74 2b 44 65 6c 20 74 6f  | Ctrl+Alt+Del to|
000001e0  20 72 65 73 74 61 72 74  0d 0a 00 00 00 00 00 00  | restart........|
000001f0  00 00 00 00 00 00 00 00  83 a0 b3 c9 00 00 55 aa  |..............U.|
00000200
root@caine:/home/caine#
First 8K of MFT Sorry, GitHub didn't allow me to post that much text, so I give you a file instead. As a bonus it's 1M instead of just 8K ;)

dd if=/dev/sdc6 bs=4K skip=$((0x8ee)) count=256 of=MFT.dd
MFT.dd.zip

First 5 KB of MFT mirror (despite it's just 4K in size :D ) Sorry, GitHub didn't allow me to post that much text, so I give you a file instead. As a bonus it's 8K instead of 5K ;)

dd if=/dev/sdc6 bs=4K skip=4 count=2 of=MFT_mirror.dd
MFT_mirror.dd.zip

Adding those savefiles just in case you want to take a look:
PHD_Data3_recuperabit.savefile.zip
PHD_recuperabit.savefile.zip
@Lazza
Copy link
Owner

Lazza commented Jan 7, 2024

This is probably related to #99. Can you confirm the drive is using a 4096 sector size?

@TishSerg
Copy link
Author

TishSerg commented Jan 7, 2024 •
edited
Loading

Can you confirm the drive is using a 4096 sector size?

Well, yes, physically it does. Just like any other modern drive. But logically it is accessed like a legacy 512-bytes/sector drive...
It has 1953525168 LBA (1 TB)

@TishSerg
Copy link
Author

TishSerg commented Jan 7, 2024

Can you confirm the drive is using a 4096 sector size?

BTW, you can see fdisk output I provided.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Lazza @TishSerg