Unknown partition table

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
GeneralFailure
Posts: 2
Joined: 12 Jul 2013, 08:05

Unknown partition table

#1 Post by GeneralFailure »

A colleague has come to me for help, holding a a USB enclosure containing a 1TB Western Digital SATA drive. The drive holds a lot of valuable files for her but unfortunately it has sustained a hard fall onto a tile floor while it was in use. Plugging the enclosure into a USB port of her computer, Windows asked if it should format the disk which fortunately she didn't do.

In the hope only the enclosure was damaged, I took the drive and connected it directly to my PC's SATA controller. The BIOS recognizes the drive correctly, displaying the serial number and the disk even reports as being "SMART capable and Status OK" at system start. I have also verified the disk spins up normally, without clicking or grinding noises. However, that is the end of the good news.

The operating system (openSUSE 12.3) is not very fond of the disk at all. It spews a lot of errors in /var/log/messages:

Code: Select all

2013-07-10T22:30:02.951246+02:00 barad-dur kernel: [79167.768114] ata4.00: configured for UDMA/133
2013-07-10T22:30:02.951258+02:00 barad-dur kernel: [79167.768124] ata4: EH complete
2013-07-10T22:30:02.951260+02:00 barad-dur kernel: [79167.768917] ata4.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
2013-07-10T22:30:02.951262+02:00 barad-dur kernel: [79167.768920] ata4.00: BMDMA stat 0x25
2013-07-10T22:30:02.951264+02:00 barad-dur kernel: [79167.768922] ata4.00: failed command: READ DMA
2013-07-10T22:30:02.951267+02:00 barad-dur kernel: [79167.768928] ata4.00: cmd c8/00:08:00:98:91/00:00:00:00:00/ea tag 0 dma 4096 in
2013-07-10T22:30:02.951269+02:00 barad-dur kernel: [79167.768928]          res 51/04:08:00:98:91/04:00:74:00:00/ea Emask 0x1 (device error)
2013-07-10T22:30:02.951270+02:00 barad-dur kernel: [79167.768931] ata4.00: status: { DRDY ERR }
2013-07-10T22:30:02.951272+02:00 barad-dur kernel: [79167.768933] ata4.00: error: { ABRT }
2013-07-10T22:30:02.961236+02:00 barad-dur kernel: [79167.778113] ata4.00: configured for UDMA/133
2013-07-10T22:30:02.961240+02:00 barad-dur kernel: [79167.778129] ata4: EH complete
2013-07-10T22:30:02.961241+02:00 barad-dur kernel: [79167.778920] ata4.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
2013-07-10T22:30:02.961243+02:00 barad-dur kernel: [79167.778922] ata4.00: BMDMA stat 0x25
2013-07-10T22:30:02.961245+02:00 barad-dur kernel: [79167.778925] ata4.00: failed command: READ DMA
2013-07-10T22:30:02.961246+02:00 barad-dur kernel: [79167.778930] ata4.00: cmd c8/00:08:00:98:91/00:00:00:00:00/ea tag 0 dma 4096 in
2013-07-10T22:30:02.961248+02:00 barad-dur kernel: [79167.778930]          res 51/04:08:00:98:91/04:00:74:00:00/ea Emask 0x1 (device error)
2013-07-10T22:30:02.961250+02:00 barad-dur kernel: [79167.778933] ata4.00: status: { DRDY ERR }
2013-07-10T22:30:02.961251+02:00 barad-dur kernel: [79167.778935] ata4.00: error: { ABRT }
2013-07-10T22:30:02.971237+02:00 barad-dur kernel: [79167.788111] ata4.00: configured for UDMA/133
2013-07-10T22:30:02.971246+02:00 barad-dur kernel: [79167.788126] ata4: EH complete
2013-07-10T22:30:02.971252+02:00 barad-dur kernel: [79167.788936] ata4.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
2013-07-10T22:30:02.971254+02:00 barad-dur kernel: [79167.788939] ata4.00: BMDMA stat 0x25
2013-07-10T22:30:02.971256+02:00 barad-dur kernel: [79167.788942] ata4.00: failed command: READ DMA
2013-07-10T22:30:02.971257+02:00 barad-dur kernel: [79167.788947] ata4.00: cmd c8/00:08:00:98:91/00:00:00:00:00/ea tag 0 dma 4096 in
2013-07-10T22:30:02.971259+02:00 barad-dur kernel: [79167.788947]          res 51/04:08:00:98:91/04:00:74:00:00/ea Emask 0x1 (device error)
2013-07-10T22:30:02.971261+02:00 barad-dur kernel: [79167.788950] ata4.00: status: { DRDY ERR }
2013-07-10T22:30:02.971262+02:00 barad-dur kernel: [79167.788952] ata4.00: error: { ABRT }
In addition, fdisk manages to see the device (/dev/sdb) but fails to recognize any partition on it, just like parted and others.

I examined the disk with testdisk 6.14 and it also claims that it can not read the partition table. A search for any trace of partitions on the disk only yields read errors, as far as I can tell, one error per sector.

Similarly, an attempt to clone the disk with dd also yields read errors. It took a very long time (+3 hours) to read 2MB of the disk which created an image file of just 35Kb on disk.

I would like to help out my colleague and recover her files but I am currently stumped. I don't know how to proceed at this point and I feel it is better to ask advice rather than continue to experiment and possibly cause more damage.
My question is, is there something more that I could try? Is there hope to recover anything from this disk or it is a lost cause? I hope someone here could give me a clue or a tip to try something I haven't tried yet.

GeneralFailure
Posts: 2
Joined: 12 Jul 2013, 08:05

Re: Unknown partition table

#2 Post by GeneralFailure »

Please, does anyone have an idea on how to proceed? I have exhausted the options as I see them. But perhaps someone has a few pointers for me? For instance, would it possible to create a new partition table? According to my colleague, the disk contained just one, large partition, most likely FAT32.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Unknown partition table

#3 Post by cgrenier »

The disk is physically damaged. The SMART status isn't probably updated, have you launch a test since the disk fall ?
You should contact a data recovery company if you need to recover your data.

Locked