GPT Partition Lost Raw Disk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Eltharion
Posts: 1
Joined: 24 Jun 2021, 09:01

GPT Partition Lost Raw Disk

#1 Post by Eltharion »

Goodmorning everyone,
I would need your help to recover a disk partition that is no longer visible.
I was running a simple robocopy on Windows 10 (copying files from a source to an empty target disk 3Tb-> 4Tb)
from a disk whose smart reported me problems (3Tb), through a dual slot usb docking.

I start the copy, everything seems to be fine until it finds a possibly corrupt file. At that point an endless series of
copying attempts begins. At that point I read that by default Robocopy tries an unlikely number of times before
moving on.

I try to stop copying, but nothing can stop it.
At that point, I very naively turn off the docking.
I figured that at the worst, only the disc I was writing on could have problems. I was wrong, both drives now
no longer have a visible partition.

If you can help me recover my files, I would appreciate it.

I tried Disk Drill, it recovers something, but it renames the files and doesn't give the original directory structure.
In this way I would have to open file by file to understand what it contains (assuming that what is recovered is readable).

I am enclosing the TestFile log file.

Thank you.


************************************************************************************************************************************************
Thu Jun 24 09:46:24 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, May 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255401918464
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=4000785104896
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - KBG40ZNV256G KIOXIA, S/N:0100_0000_0000_0000_8CE3_8E04_0156_CF0E., FW:HP00AE00
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WDC WD40 EFZX-68AWUN0, S/N:00A123456884, FW:0107

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - WDC WD40 EFZX-68AWUN0
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037167 (expected 7814037167)
hdr_lba_start=34
hdr_lba_end=7814037134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 2048 7814035455 7814033408 [Basic data partition]

search_part()
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 0/32/33
filesystem size 7814033401
sectors_per_cluster 8
mft_lcn 30575
mftmirr_lcn 4
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=4000785101312, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 7814033401
sectors_per_cluster 8
mft_lcn 30575
mftmirr_lcn 4
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 7814035448 7814033401
NTFS, blocksize=4096, 4000 GB / 3726 GiB
NTFS at 486401/53/52
filesystem size 7814033401
sectors_per_cluster 8
mft_lcn 30575
mftmirr_lcn 4
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2055 7814035455 7814033401
NTFS found using backup sector, blocksize=4096, 4000 GB / 3726 GiB
NTFS at 486401/53/52
filesystem size 7814033401
sectors_per_cluster 8
mft_lcn 30575
mftmirr_lcn 4
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
MS Data 7814035455 15628068855 7814033401
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=7814035455, size=7814033401, end=15628068855, disk end=7814037168)
file_win32_pread(600,11,buffer,3519069867(486401/80/59)) read err: read after end of file
file_win32_pread(600,8,buffer,3519069866(486401/80/58)) read err: read after end of file
file_win32_pread(600,8,buffer,3519069870(486401/80/62)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069859(486401/80/51)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069860(486401/80/52)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069861(486401/80/53)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069862(486401/80/54)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069863(486401/80/55)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069864(486401/80/56)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069866(486401/80/58)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069868(486401/80/60)) read err: read after end of file
file_win32_pread(600,14,buffer,3519069870(486401/80/62)) read err: read after end of file
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (4000 GB / 3726 GiB) seems too small! (< 8001 GB / 7452 GiB)
The following partition can't be recovered:
MS Data 7814035455 15628068855 7814033401
NTFS, blocksize=4096, 4000 GB / 3726 GiB

Results
MS Data 2048 7814035448 7814033401
NTFS, blocksize=4096, 4000 GB / 3726 GiB
MS Data 2055 7814035455 7814033401
NTFS found using backup sector, blocksize=4096, 4000 GB / 3726 GiB
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

MS Data 2048 7814035448 7814033401
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Can't open filesystem. Filesystem seems damaged.

MS Data 2055 7814035455 7814033401
NTFS found using backup sector, blocksize=4096, 4000 GB / 3726 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Incomplete multi sector transfer detected in $MFT.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
************************************************************************************************************************************************

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: GPT Partition Lost Raw Disk

#2 Post by recuperation »

Use ddrescue to duplicate your faulty drive.

Locked