HDD has RAW format

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
raz77
Posts: 4
Joined: 09 Jul 2020, 22:00

HDD has RAW format

#1 Post by raz77 »

Hello my current problem is an HDD that I can't recover anything from.
Its sitting in RAW format, I've already backed up all the good files with Recuva and PhotoRec. They found a massive amount of the lost data, but I'm still trying my best to recover the whole drive if possible.

Thats what it looks like when mounting it as an NTFS drive:
Image

Testdisk even finds the right partitions!
Image

But unfortunately, when writing these found partitions it says:
Partition: Write error
Running checkdisk on that drive
an unspecified error occurred (726166696c652e63 1b3).
an unspecified error occurred (6e74667363686b2e 1729).
Opening the file browser always shows no files at the main partition, but showing files inside the other two. Is there anything I can do, except trying to accept my situatuon? :D
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HDD has RAW format

#2 Post by recuperation »

There are no unused sectors between your partitions.
If your partition table is correct you will have to use a GPT type partition instead of the Intel one.
Top
raz77
Posts: 4
Joined: 09 Jul 2020, 22:00

Re: HDD has RAW format

#3 Post by raz77 »

Here are the logs, the faulty drive is H: or /dev/sde

Wed Jul 15 19:49:00 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=8589934592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156374016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive2
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=8589934592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479426772992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=748583711744
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=0
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=499441991680
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=557842432
Hard disk list
Disk /dev/sda - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512 - SanDisk SSD PLUS 480GB, S/N:1941B7800923, FW:UG2204RL
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - TOSHIBA MQ01ABD075, S/N:Z3K9C1PRT, FW:AX002K
Disk /dev/sdd - 8589 MB / 8192 MiB - CHS 1044 255 63, sector size=512 - Msft Virtual Disk, FW:1.0
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512, S/N:0000000047AE, FW:0101
Drive D: - 748 GB / 697 GiB - CHS 91010 255 63, sector size=512
Drive G: - 104 MB / 100 MiB - CHS 12 255 63, sector size=512, S/N:0000000047AE, FW:0101
Drive H: - 499 GB / 465 GiB - CHS 60720 255 63, sector size=512, S/N:0000000047AE, FW:0101
Drive I: - 557 MB / 532 MiB - CHS 67 255 63, sector size=512, S/N:0000000047AE, FW:0101

Partition table type (auto): Intel
Disk /dev/sde - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Info: size boot_sector 975472092, partition 975472640
NTFS at 60733/61/1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
2 P HPFS - NTFS 12 223 20 60733 60 63 975472640
3 P HPFS - NTFS 60733 61 1 60801 15 14 1089536

search_part()
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 975472092
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 60733 52 19 975472092
NTFS, blocksize=4096, 499 GB / 465 GiB
NTFS at 60733/61/1
filesystem size 1089536
sectors_per_cluster 8
mft_lcn 45397
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60733 61 1 60801 15 14 1089536
NTFS, blocksize=4096, 557 MB / 532 MiB
file_pread(7,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(7,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(7,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(7,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(7,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(7,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(7,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(7,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(7,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(7,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(7,8,buffer,976773376(60801/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,976773504(60801/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,976773632(60801/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,976773760(60801/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,976773888(60801/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,976774016(60801/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,976774144(60801/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,976774272(60801/98/34)) lseek err Invalid argument
file_pread(7,8,buffer,976774400(60801/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,976774528(60801/102/38)) lseek err Invalid argument
file_pread(7,8,buffer,976774656(60801/104/40)) lseek err Invalid argument
file_pread(7,8,buffer,976774784(60801/106/42)) lseek err Invalid argument
file_pread(7,8,buffer,976774912(60801/108/44)) lseek err Invalid argument
file_pread(7,8,buffer,976775040(60801/110/46)) lseek err Invalid argument
file_pread(7,8,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(7,8,buffer,976775176(60801/112/56)) lseek err Invalid argument
file_pread(7,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(7,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(7,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(7,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(7,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 60733 60 63 975472640
NTFS, blocksize=4096, 499 GB / 465 GiB
P HPFS - NTFS 60733 61 1 60801 15 14 1089536
NTFS, blocksize=4096, 557 MB / 532 MiB

interface_write()
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
2 P HPFS - NTFS 12 223 20 60733 60 63 975472640
3 P HPFS - NTFS 60733 61 1 60801 15 14 1089536
write!

write_mbr_i386: starting...
file_pwrite(7,1,buffer,0(0/0/1)) write err File truncated
write_all_log_i386: starting...
No extended partition

Partition: Write error
Partition table type (auto): Intel
Disk /dev/sde - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS at 12/223/20
Info: size boot_sector 975472092, partition 975472640
NTFS at 60733/61/1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
2 P HPFS - NTFS 12 223 20 60733 60 63 975472640
3 P HPFS - NTFS 60733 61 1 60801 15 14 1089536
Backup partition structure
partition_save

search_part()
Disk /dev/sde - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
NTFS, blocksize=4096, 104 MB / 100 MiB
NTFS at 12/223/20
filesystem size 975472092
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 12 223 20 60733 52 19 975472092
NTFS, blocksize=4096, 499 GB / 465 GiB
NTFS at 60733/61/1
filesystem size 1089536
sectors_per_cluster 8
mft_lcn 45397
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60733 61 1 60801 15 14 1089536
NTFS, blocksize=4096, 557 MB / 532 MiB
file_pread(7,3,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(7,1,buffer,976773182(60801/81/15)) lseek err Invalid argument
file_pread(7,8,buffer,976773198(60801/81/31)) lseek err Invalid argument
file_pread(7,11,buffer,976773245(60801/82/15)) lseek err Invalid argument
file_pread(7,2,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(7,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(7,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(7,1,buffer,976773206(60801/81/39)) lseek err Invalid argument
file_pread(7,1,buffer,976773256(60801/82/26)) lseek err Invalid argument
file_pread(7,1,buffer,976775169(60801/112/49)) lseek err Invalid argument
file_pread(7,8,buffer,976773376(60801/84/20)) lseek err Invalid argument
file_pread(7,8,buffer,976773504(60801/86/22)) lseek err Invalid argument
file_pread(7,8,buffer,976773632(60801/88/24)) lseek err Invalid argument
file_pread(7,8,buffer,976773760(60801/90/26)) lseek err Invalid argument
file_pread(7,8,buffer,976773888(60801/92/28)) lseek err Invalid argument
file_pread(7,8,buffer,976774016(60801/94/30)) lseek err Invalid argument
file_pread(7,8,buffer,976774144(60801/96/32)) lseek err Invalid argument
file_pread(7,8,buffer,976774272(60801/98/34)) lseek err Invalid argument
file_pread(7,8,buffer,976774400(60801/100/36)) lseek err Invalid argument
file_pread(7,8,buffer,976774528(60801/102/38)) lseek err Invalid argument
file_pread(7,8,buffer,976774656(60801/104/40)) lseek err Invalid argument
file_pread(7,8,buffer,976774784(60801/106/42)) lseek err Invalid argument
file_pread(7,8,buffer,976774912(60801/108/44)) lseek err Invalid argument
file_pread(7,8,buffer,976775040(60801/110/46)) lseek err Invalid argument
file_pread(7,8,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(7,8,buffer,976775176(60801/112/56)) lseek err Invalid argument
file_pread(7,3,buffer,976775184(60801/113/1)) lseek err Invalid argument
file_pread(7,3,buffer,976775231(60801/113/48)) lseek err Invalid argument
file_pread(7,8,buffer,976775247(60801/114/1)) lseek err Invalid argument
file_pread(7,11,buffer,976775294(60801/114/48)) lseek err Invalid argument
file_pread(7,2,buffer,976777216(60801/145/17)) lseek err Invalid argument
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
* HPFS - NTFS 0 32 33 12 223 19 204800 [System-reserviert]
NTFS, blocksize=4096, 104 MB / 100 MiB
P HPFS - NTFS 12 223 20 60733 60 63 975472640
NTFS, blocksize=4096, 499 GB / 465 GiB
P HPFS - NTFS 60733 61 1 60801 15 14 1089536
NTFS, blocksize=4096, 557 MB / 532 MiB
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HDD has RAW format

#4 Post by recuperation »

Die Logdatei bringt mir keine neuen Erkenntnisse.
Der letzte Ratschlag von mir wurde offensichtlich nicht umgesetzt.
Top
raz77
Posts: 4
Joined: 09 Jul 2020, 22:00

Re: HDD has RAW format

#5 Post by raz77 »

Fired up that hard drive and ran the tool with GPT, the following pictures are the results of a quick search:
Image

Image
Thanks for your effort.
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: HDD has RAW format

#6 Post by recuperation »

Use the "p" key to look into each partition to see if you can find valid content within.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: HDD has RAW format

#7 Post by cgrenier »

The current partition table looks OK. Try TestDisk, Advanced, select the partition, Boot, List and try to copy the files you want.
Top
raz77
Posts: 4
Joined: 09 Jul 2020, 22:00

Re: HDD has RAW format

#8 Post by raz77 »

It didn't work, I have tried everything you guys told me. TestDisk couldn't read the data.
In the end I've managed to recover enough files with Recuva and a combination of some other tools and bought a new SSD and transferred the files. Thanks for your help anyway.
Top
Locked

Return to “Partition Recovery”