Page 1 of 1

HDD - 1TB now 32MB RAW partition

Posted: 28 Sep 2012, 19:10
by itchy
Hello,

after shifting a lot my HDDs in the system, probably caused by SATA cable not plugged all the way, my disk (WD1001FALS) is unreadable in windows, which now ask me to reformat it.

I ran testdisk (log attached), and what i understand the CHS is not correctly set, disk should have CHS(121601, 255,63). Tried to change the CHS in testdisk, but the changes were never applied.

im no expert, could you help me to identify the steps needed to recover this disk? I hope wont need to restore data to a different disk, as this one is my only big disk.

Thank you, Petr

Code: Select all

[scroll]{

Sat Sep 29 20:32:19 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-22T12:26:25
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=33348608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=33348608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255953207296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=33348608
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63, sector size=512 - WDC WD10 01FALS-00J7B, S/N:W -DMWTA3V393331, FW:05.0
Disk /dev/sdb - 256 GB / 238 GiB - CHS 117508 224 19, sector size=512 - OCZ-VERT EX4, S/N:CO-Z786X5X828EBT4TBV, FW:1.5

Partition table type (auto): Intel
Disk /dev/sda - 33 MB / 31 MiB - WDC WD10 01FALS-00J7B
Partition table type: Intel

Analyse Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS: Can't read MFT
Current partition structure:
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568

Warning: Bad ending cylinder (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63
NTFS at 0/32/33
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=2048, size=1953517568, end=1953519615, disk end=65134)
file_pread(4,2,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,2,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,1,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,2,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,1,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,15,buffer,65537(4/20/18)) lseek err Invalid argument
file_pread(4,3,buffer,65552(4/20/33)) lseek err Invalid argument
file_pread(4,3,buffer,65599(4/21/17)) lseek err Invalid argument
file_pread(4,8,buffer,65615(4/21/33)) lseek err Invalid argument
file_pread(4,11,buffer,65662(4/22/17)) lseek err Invalid argument
file_pread(4,2,buffer,67584(4/52/49)) lseek err Invalid argument
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
Hint: update Windows to support LBA48 (minimum: W2K SP4 or XP SP1)The harddisk (33 MB / 31 MiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
     HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63
NTFS at 0/32/33
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=2048, size=1953517568, end=1953519615, disk end=65134)
file_pread(4,2,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,2,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,1,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,2,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,1,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,2,buffer,65219(4/15/15)) lseek err Invalid argument
file_pread(4,2,buffer,65282(4/16/15)) lseek err Invalid argument
file_pread(4,2,buffer,65345(4/17/15)) lseek err Invalid argument
file_pread(4,1,buffer,65535(4/20/16)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
Hint: update Windows to support LBA48 (minimum: W2K SP4 or XP SP1)The harddisk (33 MB / 31 MiB) seems too small! (< 1000 GB / 931 GiB)
The following partition can't be recovered:
     HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB

Results

interface_write()
 
No partition found or selected for recovery
}[/scroll]

Re: HDD - 1TB now 32MB RAW partition

Posted: 01 Oct 2012, 19:14
by itchy
update:

ran testdisk as admin in win7 and was able to change the CHS values.
test disk dosnt allow me to list files (filesyste corrupted)
displaying MBR shows some data in the boot sector, and no values in backup boot sector. so copying from backkup doesnt make sense, and copying boot sector to backup doesnt work.
after restart the chs values are back to the incorrect values. log bellow.

can tetdisk still help here?

thank you

Code: Select all

scroll]{

Tue Oct  2 20:34:08 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-22T12:26:25
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=33348608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=33348608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255953207296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=33348608
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 33 MB / 31 MiB - CHS 4 255 63, sector size=512 - WDC WD10 01FALS-00J7B, S/N:W -DMWTA3V393331, FW:05.0
Disk /dev/sdb - 256 GB / 238 GiB - CHS 117508 224 19, sector size=512 - OCZ-VERT EX4, S/N:CO-Z786X5X828EBT4TBV, FW:1.5

Partition table type (auto): Intel
Disk /dev/sda - 33 MB / 31 MiB - WDC WD10 01FALS-00J7B
Partition table type: Intel
New geometry
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63 sector_size=512

Analyse Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
NTFS: Can't read MFT
Current partition structure:
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
No partition is bootable
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.
Failed to startup volume: Input/Output error.
Error reading $MFT: Input/Output error.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/Output error.

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(4,8,buffer,1953519616(121600/247/56)) lseek err Invalid argument
file_pread(4,8,buffer,1953519624(121600/248/1)) lseek err Invalid argument
file_pread(4,3,buffer,1953519632(121600/248/9)) lseek err Invalid argument
file_pread(4,3,buffer,1953519679(121600/248/56)) lseek err Invalid argument
file_pread(4,8,buffer,1953519695(121600/249/9)) lseek err Invalid argument
file_pread(4,11,buffer,1953519742(121600/249/56)) lseek err Invalid argument
file_pread(4,2,buffer,1953521664(121601/25/25)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open backup.log file: No such file or directory
interface_load
file_pread(4,1,buffer,6293505(391/191/58)) lseek err Invalid argument
Not an exFAT boot sector.

   * HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0  32 33 121600 247 55 1953517568

search_part()
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
NTFS at 0/32/33
filesystem size           1953517568
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
     HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(4,2,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument
file_pread(4,2,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,1,buffer,66308(4/32/33)) lseek err Invalid argument
file_pread(4,2,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,1,buffer,66371(4/33/33)) lseek err Invalid argument
file_pread(4,2,buffer,65219(4/15/15)) lseek err Invalid argument
file_pread(4,2,buffer,65282(4/16/15)) lseek err Invalid argument
file_pread(4,2,buffer,65345(4/17/15)) lseek err Invalid argument
file_pread(4,1,buffer,65535(4/20/16)) lseek err Invalid argument
file_pread(4,1,buffer,65536(4/20/17)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB

interface_write()
 1 * HPFS - NTFS              0  32 33 121600 247 55 1953517568
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
file_pread(4,1,buffer,1953519615(121600/247/55)) lseek err Invalid argument
filesystem size           1953517568 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
file_pread(4,2,buffer,976760812(60800/139/56)) lseek err Invalid argument
file_pread(4,1,buffer,976760814(60800/139/58)) lseek err Invalid argument
file_pread(4,1,buffer,976760815(60800/139/59)) lseek err Invalid argument
file_pread(4,1,buffer,976760816(60800/139/60)) lseek err Invalid argument
file_pread(4,1,buffer,976760817(60800/139/61)) lseek err Invalid argument
file_pread(4,1,buffer,976760818(60800/139/62)) lseek err Invalid argument
file_pread(4,1,buffer,976760819(60800/139/63)) lseek err Invalid argument
file_pread(4,1,buffer,976760820(60800/140/1)) lseek err Invalid argument
file_pread(4,1,buffer,976760821(60800/140/2)) lseek err Invalid argument
file_pread(4,1,buffer,976760822(60800/140/3)) lseek err Invalid argument
file_pread(4,1,buffer,976760823(60800/140/4)) lseek err Invalid argument
file_pread(4,1,buffer,976760824(60800/140/5)) lseek err Invalid argument
file_pread(4,1,buffer,976760825(60800/140/6)) lseek err Invalid argument
file_pread(4,1,buffer,976760826(60800/140/7)) lseek err Invalid argument
file_pread(4,1,buffer,976760827(60800/140/8)) lseek err Invalid argument
file_pread(4,1,buffer,976760828(60800/140/9)) lseek err Invalid argument
file_pread(4,1,buffer,976760829(60800/140/10)) lseek err Invalid argument
file_pread(4,1,buffer,976760830(60800/140/11)) lseek err Invalid argument
file_pread(4,1,buffer,976760831(60800/140/12)) lseek err Invalid argument
file_pread(4,1,buffer,976760832(60800/140/13)) lseek err Invalid argument
file_pread(4,1,buffer,976760833(60800/140/14)) lseek err Invalid argument
file_pread(4,1,buffer,976760834(60800/140/15)) lseek err Invalid argument
file_pread(4,1,buffer,976760835(60800/140/16)) lseek err Invalid argument
file_pread(4,1,buffer,976760836(60800/140/17)) lseek err Invalid argument
file_pread(4,1,buffer,976760837(60800/140/18)) lseek err Invalid argument
file_pread(4,1,buffer,976760838(60800/140/19)) lseek err Invalid argument
file_pread(4,1,buffer,976760839(60800/140/20)) lseek err Invalid argument
file_pread(4,1,buffer,976760840(60800/140/21)) lseek err Invalid argument
file_pread(4,1,buffer,976760841(60800/140/22)) lseek err Invalid argument
file_pread(4,1,buffer,976760842(60800/140/23)) lseek err Invalid argument
file_pread(4,1,buffer,976760843(60800/140/24)) lseek err Invalid argument
file_pread(4,1,buffer,976760844(60800/140/25)) lseek err Invalid argument
file_pread(4,1,buffer,976760845(60800/140/26)) lseek err Invalid argument
file_pread(4,1,buffer,976760846(60800/140/27)) lseek err Invalid argument
file_pread(4,1,buffer,976760847(60800/140/28)) lseek err Invalid argument
file_pread(4,1,buffer,976760848(60800/140/29)) lseek err Invalid argument
file_pread(4,1,buffer,976760849(60800/140/30)) lseek err Invalid argument
file_pread(4,1,buffer,976760850(60800/140/31)) lseek err Invalid argument
file_pread(4,1,buffer,976760851(60800/140/32)) lseek err Invalid argument
file_pread(4,1,buffer,976760852(60800/140/33)) lseek err Invalid argument
file_pread(4,1,buffer,976760853(60800/140/34)) lseek err Invalid argument
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: mft_record_size     1024
file_pread(4,2,buffer,6293514(391/192/4)) lseek err Invalid argument
file_pread(4,1,buffer,6293514(391/192/4)) lseek err Invalid argument
NTFS Can't read "root directory" in MFT

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
file_pread(4,1,buffer,1953519615(121600/247/55)) lseek err Invalid argument
filesystem size           1953517568 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
file_pread(4,4096,buffer,6293504(391/191/57)) lseek err Invalid argument
file_pread(4,1,buffer,6293504(391/191/57)) lseek err Invalid argument
NTFS: Can't read MFT
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
filesystem size           1953517568 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy original boot sector over backup boot
file_pwrite(4,1,buffer,1953519615(121600/247/55)) seek err Invalid argument
Write error: Can't overwrite NTFS backup boot sector

ntfs_boot_sector
 1 P HPFS - NTFS              0  32 33 121600 247 55 1953517568
     NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
file_pread(4,1,buffer,1953519615(121600/247/55)) lseek err Invalid argument
filesystem size           1953517568 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
}[/scroll]