Lost XFS/SysV partitions on external Western Digital drive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
meowsus
Posts: 3
Joined: 29 Mar 2012, 19:40

Lost XFS/SysV partitions on external Western Digital drive

#1 Post by meowsus »

A friend of mine asked me to take a look at his external hard drive because it suddenly wasn't mounting any longer. He had been running it with a power cord with exposed wires and the "enclosure" the hard drive lived in was a VHS case, filled with foam padding, and wrapped in electrical tape.

Yeah.

Apparently, it shut off randomly and now will no longer mount. He had said it was doing "the click of death" which I didn't hear, said but once each time you power the drive the read arm will smack into the stop, causing a single click. I believe this is because the partition is gone and the read arm has no idea where to start searching for data.

I didn't know what type of partition it was, and neither did he, so I ran an Intel-based analysis, which produced absolutely nothing. I then ran a Non Partitioned Media scan and it started finding XFS information. I've attached my log, but when it finished scanning sectors it told me the partitions could not be recovered.

I'm not sure where to go from here...

EDIT on Apr 2: Here is my dmesg | tail when trying to mount this drive:

[ 1486.877553] sd 5:0:0:0: [sdc] Mode Sense: 00 38 00 00
[ 1486.877565] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.879790] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.880028] sdc: unknown partition table
[ 1486.892570] sd 5:0:0:0: [sdc] Assuming drive cache: write through
[ 1486.892806] sd 5:0:0:0: [sdc] Attached SCSI disk
[ 1538.422662] SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled
[ 1538.427689] SGI XFS Quota Management subsystem
[ 1538.429461] XFS: bad magic number
[ 1538.429471] XFS: SB validate failed

EDIT: Apparently I can't upload log files here... So here's a big dump! You'll also see at the end that I killed the program because it seemed to be trying to make me write an HFS+ partition to the drive, and i didn't know if that would be a bad idea or not.

Wed Mar 28 10:45:44 2012
Command line: TestDisk

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.32-5-amd64 (#1 SMP Thu Mar 22 17:26:33 UTC 2012)
Compiler: GCC 4.4 - Sep 5 2010 16:13:36
ext2fs lib: 1.41.12, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 488397168 sectors
/dev/sda: user_max 488397168 sectors
/dev/sda: native_max 488397168 sectors
/dev/sda: dco 488397168 sectors
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - ATA ST9250315AS
Disk /dev/sdb - 7969 MB / 7600 MiB - CHS 1020 246 62, sector size=512 - Multiple Card Reader
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10 EARS-00Y5B1

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WDC WD10 EARS-00Y5B1
Partition table type: None

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
P Unknown 0 0 1 121601 80 63 1953525168

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Unknown XFS version 0

XFS Marker at 22405/210/41

recover_xfs
XFS 4 22405 210 41 4292826805 248 41 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
This partition ends after the disk limits. (start=359949595, size=9659776198511754, end=9659776558461349, disk end=1953525168)
Unknown XFS version 0

XFS Marker at 34789/164/11

recover_xfs
XFS 4 34789 164 11 4292839189 202 11 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
This partition ends after the disk limits. (start=558895627, size=9659776198511754, end=9659776757407381, disk end=1953525168)
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 65244/36/15

recover_sysv4
SysV 4 65244 36 15 223351 34 5 2539988820 [Å2.]
SysV4, 1300 GB / 1211 GiB
This partition ends after the disk limits. (start=1048147142, size=2539988820, end=3588135961, disk end=1953525168)

HFS+ magic value at 121599/170/24
part_size 9396
HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4945805 TB / 4498184 TiB)
The following partitions can't be recovered:
XFS 4 22405 210 41 4292826805 248 41 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
XFS 4 34789 164 11 4292839189 202 11 9659776198511754 [--ç㦠FNE:Ã]
XFS 6.2+ - bitmap version, 4945805 TB / 4498183 TiB
SysV 4 65244 36 15 223351 34 5 2539988820 [Å2.]
SysV4, 1300 GB / 1211 GiB

Results
P HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
Change partition type:
P HFS+ 121599 170 24 121600 64 32 9396
HFS+, 4810 KB / 4698 KiB
SIGINT detected! TestDisk has been killed.
Last edited by meowsus on 04 Apr 2012, 22:10, edited 1 time in total.

meowsus
Posts: 3
Joined: 29 Mar 2012, 19:40

Re: Lost XFS (?) Partition on external drive

#2 Post by meowsus »

I wonder if I should just stop messing with this thing and run PhotoRec.

The main problem I've had with PhotoRec is the issues recovering fragmented videos. I'd rather save the partition info on this drive, so I can access everything directly, minimizing the chances of a bunch of <1sec clips being recovered. The drive contains mostly video files, the guy who owned it is something of a videographer.

Each time I run a "None" analysis, it will find XFS 4 info along with SysV info. When it tries to repair the partitions, the program want's to write HFS+ partition info to the drive, and without direction from you data recovery masterminds, I'm gonna be up the creek pretty soon.

As far as I can tell, this drive is still healthy... it just has no idea where the data is on itself. :roll:

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost XFS/SysV partitions on external Western Digital dri

#3 Post by Fiona »

Normally, Testdisk doesn't write anything to a harddrive itself?
Although, I've got that message;
HFS+, 4810 KB / 4698 KiB
SIGINT detected! TestDisk has been killed.
Despite that, I assume it wasn't a XFS-partition.
That recognized partition would be more than 4 million TB.
TestDisk can find partitions based on any remnants and can be ignored.
Especially if partition table type None is used.

Would it be possible to get some infos about the previous situation?

Might be an idea to ask that user, what OS he used.
This helps to determine the partition type and file system.
Also to ask, how many partitions he used on this disk?
If he used 1 partition over the whole space it would be possible to create one and diagnose it using TestDisk and Rebuild BS ( boot sector) to have a try to access files.
A partition will only be written in the partition table and MBR.
The MBR is just as big as 512 Bytes.
So you'll never touch any data underlying on that disk.
You'll still have the ability to use data recovery software.
If you don't get any infos about that incdident, you can use commercial datarecovery software as a testversion to determine that previous file system.
Datarecovery software like Restorer Ultimate supports FAT, NTFS, Ext/2/3/4, HFS+ and UFS.

meowsus
Posts: 3
Joined: 29 Mar 2012, 19:40

Re: Lost XFS/SysV partitions on external Western Digital dri

#4 Post by meowsus »

Fiona,

Thank you so much for your reply. This clarifies what's been going on a bit for me, and I'm very appreciative of your help!
That recognized partition would be more than 4 million TB.
TestDisk can find partitions based on any remnants and can be ignored.
Especially if partition table type None is used.
I saw this and was trying to figure out exactly what it meant. I was surprised by the results too. It's a 1TB drive, not certainly a 4,000,000TB drive :lol: The only TestDisk scan that has returned any partition information thusfar is the "None" scan. The only reason I tried that type of scan was because, well, when I fired up this drive for the first time there was no partition info on it :| but more on that in a second...
Would it be possible to get some infos about the previous situation?
Here is the story as best as I can piece it together. I'm filling in the gaps with what I believe the situation was, based on talking to the owner of the drive:

He's an amateur videographer who is not extremely computer savvy. I've been repairing various laptops and desktops for him for a while now. His typical backup routine is to capture video to his Windows laptop or desktop, edit it, render it, then store it on his external hard drive.

The external drive was obviously one of these, judging from what I saw when he gave me the drive in the first place. Apparently, the external enclosure had broken, so what I had received was the hard drive (a Western Digital 1.0TB WD10EARS / SATA / 64MB Cache HDD - link to Spec Sheet PDF), the external SATA controller board still attached to SATA port, and the new "enclosure" he had built from an old VHS movie case and some foam bedding. Oh, and a hefty amount of electrical tape.

He had told me that the drive was dead and he wanted me to try to see what I could do with it, since his entire life's work is contained within the drive. I inspected his power supply, which was severely frayed and had many, many exposed wires. He said sometimes you'd have to keep jiggling the wires to get the drive to turn on :o and he wondered if that had anything to do with drive's failure :|

Since he's not very computer savvy and was using a Windows machine to access the drive, I assumed the drive was partitioned as NTFS or at least FAT32, or even exFAT, but a Quick Search and Deeper Search of the type "Intel" in TestDisk resulted in no results. That's when I moved onto the "None" scans. I also assume that he never divvied the drive into separate partitions. I bet the drive either (a) had the original partition from the factory, or (b) possibly was partitioned once by Windows... either XP, Vista or 7... before he started using the drive to back up his media.

I've removed it's SATA controller, and have been running it in my external enclosure, via USB from my netbook, which is running Debian Squeeze. The drive turns on and spins up. All sectors are readable, just no partition information.
If he used 1 partition over the whole space it would be possible to create one and diagnose it using TestDisk and Rebuild BS ( boot sector) to have a try to access files.
I very much believe this to be the case.

What should my next steps be?

Thanks again for your help!

Locked