Data Recovery from an External HDD

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Xplozv123
Posts: 2
Joined: 20 Jun 2021, 22:15

Data Recovery from an External HDD

#1 Post by Xplozv123 »

Hello,
Hope you are doing great.
I am having a problem recovering data from my external HDD. When I connect it to my laptop, its shows " Need to format in order to use it". It has 2 partitions and both of them contain very very important data. It shows as a RAW disk in disk partition in " Disk Management" utility of windows.
Tried following the steps shared in the .pdf as well as from the Wiki page of TestDisk.
I am confused as to how should I proceed or Am i doing something wrong in here.
Below is the Log -

Please help me.
Eagerly waiting for an early reply.
Thank you in advance.

Mon Jun 21 02:12:05 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204884992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248752314880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=53687091200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=429496729600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=87505764352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=251832303616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=734003200000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=429496729600
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - CT250MX500SSD4, S/N:1918E1FF0B43, FW:M3CR023
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 860 QVO 1TB, S/N:S4PGNF0M433233H, FW:RVQ02B6Q
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Mass Storage Device, S/N:116AC2101219

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - Mass Storage Device
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525165 (expected 1953525165)
hdr_lba_start=34
hdr_lba_end=1953525132
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 1026048 1288191 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
3 P MS Data 1288192 493148159 491859968 [Basic data partition]
check_part_gpt failed for partition
5 P MS Data 494886912 1928486911 1433600000 [Basic data partition]
Current partition structure:
1 P EFI System 2048 1026047 1024000 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 1026048 1288191 262144 [Microsoft reserved partition]
2 P MS Reserved 1026048 1288191 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 1288192 493148159 491859968 [Basic data partition]
3 P MS Data 1288192 493148159 491859968 [Basic data partition]
4 P Windows Recovery Env 493150208 494886911 1736704
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 494886912 1928486911 1433600000 [Basic data partition]
5 P MS Data 494886912 1928486911 1433600000 [Basic data partition]
6 P Windows Recovery Env 1928488960 1929410559 921600
7 P Windows Recovery Env 1929410560 1953523711 24113152

search_part()
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
FAT32 at 0/32/33
FAT1 : 6206-7198
FAT2 : 7199-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-1023999
sectors : 1024000
cluster_size : 8
no_of_cluster : 126976 (2 - 126977)
fat_length 993 calculated 993

FAT32 at 0/32/33
FAT: cluster=2(0x2), pos=10240
EFI System 2048 1026047 1024000 [EFI System Partition] [ESP]
FAT32, blocksize=4096, 524 MB / 500 MiB

LVM magic value at 71/16/25
NTFS at 80/47/33
filesystem size 491859968
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=659554816, part_size=251832303616, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 80/47/33
filesystem size 491859968
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1288193 493148160 491859968 [New Volume]
NTFS, blocksize=4096, 251 GB / 234 GiB
NTFS at 30697/36/47
filesystem size 491861428
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1288192 493149619 491861428
NTFS found using backup sector, blocksize=4096, 251 GB / 234 GiB
NTFS at 30697/36/47
filesystem size 491861428
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 493149619 985011046 491861428
NTFS, blocksize=4096, 251 GB / 234 GiB
NTFS at 120042/225/56
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1927567361 1928488960 921600
NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
NTFS at 120042/225/56
filesystem size 921600
sectors_per_cluster 8
mft_lcn 38400
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1928488960 1929410559 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
Search for partition aborted

Results
P EFI System 2048 1026047 1024000 [EFI System Partition] [ESP]
FAT32, blocksize=4096, 524 MB / 500 MiB
MS Data 1288192 493149619 491861428
NTFS found using backup sector, blocksize=4096, 251 GB / 234 GiB
MS Data 1288193 493148160 491859968 [New Volume]
NTFS, blocksize=4096, 251 GB / 234 GiB
MS Data 493149619 985011046 491861428
NTFS, blocksize=4096, 251 GB / 234 GiB
MS Data 1927567361 1928488960 921600
NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
MS Data 1928488960 1929410559 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

MS Data 1927567361 1928488960 921600
NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
Can't open filesystem. Filesystem seems damaged.
NTFS Volume is dirty.


dir_partition inode=5
MS Data 1928488960 1929410559 921600
NTFS, blocksize=4096, 471 MB / 450 MiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
5 dr-xr-xr-x 0 0 0 10-Mar-2019 20:28 .
5 dr-xr-xr-x 0 0 0 10-Mar-2019 20:28 ..

MS Data 1288192 493149619 491861428
NTFS found using backup sector, blocksize=4096, 251 GB / 234 GiB
Can't open filesystem. Filesystem seems damaged.
NTFS filesystem needs to be repaired.


dir_partition inode=5
MS Data 1288193 493148160 491859968 [New Volume]
NTFS, blocksize=4096, 251 GB / 234 GiB
ntfs_dir: ntfs_inode_open failed
Directory /
Invalid partition structure.

TestDisk exited normally.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Data Recovery from an External HDD

#2 Post by recuperation »

Xplozv123 wrote: 20 Jun 2021, 22:29 I am confused as to how should I proceed or Am i doing something wrong in here.
I can't see where you are.

Apart from that I see a lot of read/write errors in the log file.
You might need to duplicate the drive using ddrescue as described in the manual.

To get health information about your drive quickly, use
viewtopic.php?f=5&t=10910
and post the log file here.

Xplozv123
Posts: 2
Joined: 20 Jun 2021, 22:15

Re: Data Recovery from an External HDD

#3 Post by Xplozv123 »

Hi, recuperation
I did the procedure again. Now, according to LogFile and Photorec, I am able to confirm that the partitions holding my data are 3 and 5.
Could you please share how to recover data from these 2 partitions as they are denoted as MS Data ( Basic Data Partition)?

Image
https://mega.nz/file/n9QWSB5B#dNdAyQnB7 ... SD5Oc4cVdk

Log

Mon Jun 21 13:22:03 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204884992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=248752314880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=53687091200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=429496729600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=87505764352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=251832303616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=734003200000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=429496729600
Hard disk list
Disk \\.\PhysicalDrive0 - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - CT250MX500SSD4, S/N:1918E1FF0B43, FW:M3CR023
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 860 QVO 1TB, S/N:S4PGNF0M433233H, FW:RVQ02B6Q
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Mass Storage Device, S/N:116AC2101219

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - Mass Storage Device
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525165 (expected 1953525165)
hdr_lba_start=34
hdr_lba_end=1953525132
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Reserved 1026048 1288191 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
3 P MS Data 1288192 493148159 491859968 [Basic data partition]
check_part_gpt failed for partition
5 P MS Data 494886912 1928486911 1433600000 [Basic data partition]
Current partition structure:
1 P EFI System 2048 1026047 1024000 [EFI system partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Reserved 1026048 1288191 262144 [Microsoft reserved partition]
2 P MS Reserved 1026048 1288191 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
3 P MS Data 1288192 493148159 491859968 [Basic data partition]
3 P MS Data 1288192 493148159 491859968 [Basic data partition]
4 P Windows Recovery Env 493150208 494886911 1736704
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
5 P MS Data 494886912 1928486911 1433600000 [Basic data partition]
5 P MS Data 494886912 1928486911 1433600000 [Basic data partition]
6 P Windows Recovery Env 1928488960 1929410559 921600
7 P Windows Recovery Env 1929410560 1953523711 24113152

Locked