cgsecurity.org

A friend has asked me for help with a Seagate USB drive (Model SRD00F2) which failed after water damage.

I've extracted the internal 3½ inch (5TB) disk, and Hard Disk Sentinel gives it 100% perfect SMART scores when mounted via its SATA connectors. But Windows 10 reports:

The partition(s) on this hard disk created with 4 K physical sector size, but the current physical sector Size is 512 bytes:
Disk: STSDDODMDDO- 1 FKI 78 tW4JODGKZ)
It IS recommended to re-connect the hard disk as previously connected (probably
with different USB adapter, enclosure, docking station or so) to access
the partition with all stored data - otherwise data loss may occur.

It's the USB adaptor circuitry which seems to have failed. I understand that these models of disk translate the standard 512 sector size "on the fly" to 4096 to allow XP to access large disks, but without the adapter I can't "see" the filesystem. I tried Seagate's own recovery utility, but while it detects files and can determine their type, it doesn't provide names or folder structure.

This links seems to describe the issue:

• https://www.klennet.com/notes/2018-04-1 ... -size.aspx

I'd like to try Testdisk, which I've used some time ago successfully, but I'm wary of doing anything which will write to the disk in case it makes later recovery attempts more difficult. I note there is an option to set sector size within Testdisk. Is it safe to do this? (Perhaps the change is made within the running executable rather than being written to the disk?) I'm at the limit of my (very patchy) knowledge, so any help anyone can offer will be gratefully appreciated.

Philip Herlihy, London.

You should be able to use TestDisk to rewrite the partition table.
Record the actual partition tables (ie. screenshot of TestDisk Analyze screen).
After QUick Search, verify that you have the correct number of partitions. Use 'p' to list the content of each partition.
If everything is OK, on next screen, choose Write, confirm, Quit and restart your computer.

Thank you so much for this, and for everything you do. I'll need to get the go-ahead from my hesitant friend, but I'm greatly reassured. Much appreciated - and I will certainly post the outcome.

Testdisk works perfectly in this situation!

Disk: Seagate Expansion Desktop Drive (Model SRD00F2)
Task: Extract disk from USB adapter card, and mount using intrinsic SATA ports.
Problem: Windows 10 reports:

Warning
The partition(s) on this hard disk created with 4 K physical sector size, but the current physical sector Size is 512 bytes:
Disk: STSDDODMDDO- 1 FKI 78 tW4JODGKZ)
It IS recommended to re-connect the hard disk as previously connected (probably
with different USB adapter, enclosure, docking station or so) to access
the partition with all stored data - otherwise data loss may occur.

Cause: To provide compatibility (size of disk) with XP the USB adapter converts to a 4096 sector size from the standard 512.

Solution:
Do NOT initialise or format disk if prompted!
Use Testdisk: testdisk_win.exe in a command window.
• Create new logfile
• Select the appropriate disk (match disk sizes with output from DISKPART list disk command, or details in Disk Management) & [Proceed]
• Select partition table type. (Testdisk may correctly detect [Intel/PC])
• Select [Geometry]
• Select [Sector Size]
• Enter, instead of 512, 4096
• Enter [Ok]
• Enter [Analyse]
• Enter [Quick Search] - Testdisk should show the partition selected if only one, otherwise use Up/Down arrow keys to select the correct one.
• Tap P to list files/folders - top-level folders and files should be listed.
• You can drill down into the folders by selecting a folder and tapping Enter, as many levels as needed, with other navigation options shown at the bottom of the command window.
• To recover files, use the : or a options to select folders or files, then C to copy. In the next screen, navigate to the destination folder, and C to confirm copying

This entire process (quick and easy) does not appear to make any changes to the disk, only to how Testdisk reads the incoming data. While Testdisk is running the disk appears unchanged (unreadable) in file manager. After recovering data, it was found to be still readable normally when reconnected to the original USB adapter.

In this case the USB adapter appeared to have failed a few weeks after a water spill, and there was concern over recovering large quantities of data. In the event, after extracting the disk (and leaving the adapter exposed to the air) a "just in case" trial of the original configuration found it to be working. This exercise (above) was to demonstrate that Testdisk is perfectly able to recover data from a disk of this type.