cgsecurity.org

Posted: **28 Mar 2012, 07:50**

Trying to salvage whatever I can from my friend's 3TB Western Digital hard drive. It doesn't make any terrible sounds that might indicate serious physical damage, for whatever it's worth. Doesn't mount and has an unknown partition table. Attempted a partition table recovery with TestDisk, but it's detecting it as 500GB. How can I get it to see the correct capacity and find lost partitions/data?

Posted: **28 Mar 2012, 08:40**

I'd need infos about the previous filesystem and your OS.
Current size of the disk might be important too.
Can you upload a screenshot from Testdisk Analyse (current partition structur).

Posted: **09 Apr 2012, 05:42**

I'm running Arch Linux x86-64 on the data recovery machine, and I believe my friend had a single NTFS partition filling the drive. TestDisk is unable to find any partitions, which I assume is because it doesn't see the right capacity. Maybe I need to manually adjust the geometry? The analysis screen shows it as 539 GB / 502 GiB. Here is the output of my dmesg if it's any help:

Code: Select all

[  518.713321] usb 4-3: new high-speed USB device number 3 using 
ehci_hcd
[  518.838691] scsi11 : usb-storage 4-3:1.0
[  519.840507] scsi 11:0:0:0: Direct-Access                                    
PQ: 0 ANSI: 2 CCS
[  519.841259] sd 11:0:0:0: [sdg] Very big device. Trying to use READ 
CAPACITY(16).
[  519.841644] sd 11:0:0:0: [sdg] 72057594037927936 512-byte logical 
blocks: (0 B/0 B)
[  519.842386] sd 11:0:0:0: [sdg] Write Protect is off
[  519.842391] sd 11:0:0:0: [sdg] Mode Sense: 28 00 00 00
[  519.843142] sd 11:0:0:0: [sdg] No Caching mode page present
[  519.843145] sd 11:0:0:0: [sdg] Assuming drive cache: write through
[  519.843881] sd 11:0:0:0: [sdg] Very big device. Trying to use READ 
CAPACITY(16).
[  519.845754] sd 11:0:0:0: [sdg] No Caching mode page present
[  519.845757] sd 11:0:0:0: [sdg] Assuming drive cache: write through
[  519.845779]  sdg: unknown partition table
[  519.846761] sd 11:0:0:0: [sdg] Very big device. Trying to use READ 
CAPACITY(16).
[  519.850130] sd 11:0:0:0: [sdg] No Caching mode page present
[  519.850133] sd 11:0:0:0: [sdg] Assuming drive cache: write through
[  519.850135] sd 11:0:0:0: [sdg] Attached SCSI disk

Posted: **09 Apr 2012, 09:41**

some motherboards have problem with 3TB recognition. Your WD hard disk was in external enclosure ? If yes, you have to let it in, because of "on the fly" encryption. You won't find correct info with testdisk until your HD isn't recognized :

sd 11:0:0:0: [sdg] Very big device. Trying to use READ CAPACITY(16).

You'll perhaps also (not sure, i've to verify) have a block allocation of 4096 instead of 512.

Posted: **16 May 2012, 08:43**

remy wrote:some motherboards have problem with 3TB recognition. Your WD hard disk was in external enclosure ? If yes, you have to let it in, because of "on the fly" encryption.

I would be surprised since it's a brand new ASUS Sabertooth 990FX motherboard. I don't believe he encrypted his hard drive, since he used it for movie storage and plugged it into many computers without problems.

Posted: **16 May 2012, 18:26**

Hi kahlil88

Your WD hard disk was in external enclosure ? If yes, you have to let it in, because of "on the fly" encryption.

remy meant that you shouldn't remove it from its enclosure.
It's only a recommendation.
We already have had some cases with encrypted external WD MY PASSPORT disks.
Even the users didn't notice it.
Example;
http://forum.cgsecurity.org/phpBB3/post ... ption#p915

Fiona

cgsecurity.org

Unknown partition table, wrong capacity

Unknown partition table, wrong capacity

Re: Unknown partition table, wrong capacity

Re: Unknown partition table, wrong capacity

Re: Unknown partition table, wrong capacity

Re: Unknown partition table, wrong capacity

Re: Unknown partition table, wrong capacity