Page 1 of 3

Problem recovering partition/filesystem

Posted: 31 Mar 2012, 22:09
by mwitt
Hi,
First of all, thanks for making this utility available for free.

I have a major problem at the moment and hope you can help me. To make a very long story short I have a failing RAID5 array (HW-based Megaraid 8708ELP). I think that the controler may be failing and my 6-disk array is currently running as a 5-disk degraded array. The array have also encountered additional problems and dripped an additional disk, but I managed to get it up and running after reboots and adding the failed disk back to the array. I have tried re-build with new disk, but something seems to be very wrong and re-build is no longer an option, I need to get my data off the array (aprox. 4,5 TB of data).
My WHS 2011 (Windows 2008 R2) does not recognize the raid5 partition any longer and wants med to "initialize" the disk, but I guess this would totally f**k things up, so I have not done that.

I have tried a multitude of tools and managed to get the mbr (GPL partition) up and running by analyzing and restoring with PartitionGuru Pro. This made it possible to get some of the data of the drive, but during the transfer a disk dropped out of the array, I had to reboot, attach the disk to the array again and it was lost to the operating system again. PartitionGuru can now only find an partition with the following atributes:
partition guru.GIF
partition guru.GIF (173.26 KiB) Viewed 16958 times
But it does not contain ant files...?

Running your utility gives me the following result:
Testdisk listing.GIF
Testdisk listing.GIF (22.11 KiB) Viewed 16958 times
But "list files" give me the following result:
testdisk list files.GIF
testdisk list files.GIF (20.7 KiB) Viewed 16958 times
I guess that the partition is found, but he file system is corrupt? I have not been brave enough to save the partition data yet, as I have no clear understanding how this would relate to the file system. I noticed one thing of interest, PartitionGuru list the volume label as "Unformatted", but TestDisk lists it as "Data1", the name I gave to the RAID5 virtual drive...? It finds the MBR (GPL) at the same cylinder (16) using both programs. I will run a deep search adn try to update the post, but as you can imagine, this will take some time and I´m really worried my array will fail again soon.

Any ideas on how to fix this or how to get the files of the drive?

Best regards
/Micke

Re: Problem recovering partition/filesystem

Posted: 31 Mar 2012, 22:22
by Fiona
Can you have another try to upload your pictures? :)

Re: Problem recovering partition/filesystem

Posted: 31 Mar 2012, 22:41
by mwitt
Updated my post with correct pictures.
/Micke

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 09:00
by Fiona
You can try to diagnose your boot sector and list your data.
In TestDisk select your affected RAID.
Choose partition table type EFI GPT and press enter.
Don't confirm at Analyse but Advanced.
If your partition MS Data is listed as Unknown, please confirm at Type (your partition MS Data only appears if it's available in your GUID partition table, but I've no screen from Analyse about your current partition structur).
Add your previous file system NTFS to your MS Data partition.
Confirm at Boot.
Check Rebuild BS and press enter.
It should take some time but not as long.
If Rebuild BS found your file system and it was able to rebuild your boot sector, you should see the menu List.
Please check do you see your data or an error message.
Please let me know.

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 09:16
by mwitt
Hi and thanks for your fast reply. If I remember correctly, choosing advanced only came back with a message along the line of "no file system detected" och the option "quit". I can check again, but I´m doing the deep check since last night (been running for 11 hours and are 11% done:-)) and don´t want to abort it.

I have pasted in the log from TestDisk below if that can give you some idears? Could not append a document to the post, so its quite long, sorry!

Best regards
/Micke

"Sat Mar 31 22:09:02 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, March 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows Server 2008 R2 (7601) SP1
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-03-25T21:26:26
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=9999220736000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=9999220736000
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Felaktig funktion.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Felaktig funktion.

Warning: can't get size for \\.\PhysicalDrive4
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=0
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202043392
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSA2M120G2GC, S/N:56434f503031363433303954323151304e472020, FW:2CV102M3
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EARS-00Z5B1, S/N:2020202057202d444d5756413355353336353631, FW:80.00A80
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EARS-00Z5B1, S/N:2020202057202d444d5756413355353334353335, FW:80.00A80
Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63, sector size=512 - LSI MegaRAID 8708ELP, S/N:001a49ef47417bf616d06a1d01b00506, FW:1.40

Partition table type default to EFI GPT
Disk /dev/sdd - 9999 GB / 9312 GiB - LSI MegaRAID 8708ELP
Partition table type: EFI GPT

Interface Advanced
New options :
Dump : No
Align partition: Yes
Expert mode : No

Analyse Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
Current partition structure:
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
NTFS at 16/113/34
filesystem size 19529459712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Search for partition aborted

Results
P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB

interface_write()
1 P MS Data 264192 19529723903 19529459712 [Data1]
simulate write!

Interface Advanced

Analyse Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
Current partition structure:
Bad GPT partition, invalid signature.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.

search_part()
Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
NTFS at 16/113/34
filesystem size 19529459712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Search for partition aborted

Results
P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB

P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 P MS Data 264192 19529723903 19529459712 [Data1]
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.

search_part()
Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
NTFS at 16/113/34
filesystem size 19529459712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=9999083372544, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size 19529459712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Search for partition aborted

Results
P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB

P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Can't open filesystem. Filesystem seems damaged.

P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
1 P MS Data 264192 19529723903 19529459712 [Data1]
simulate write!

Analyse Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
Current partition structure:
Bad GPT partition, invalid signature.

search_part()
Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
NTFS at 16/113/34
filesystem size 19529459712
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Search for partition aborted

Results
P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB

interface_write()
1 P MS Data 264192 19529723903 19529459712 [Data1]"

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 10:13
by 4and20chars
I apologize for butting in on this forum, but can anyone tell me how to post a question without using Post Reply like I am doing here? The instructions in FAQ say:
To post a new topic in a forum, click the relevant button on either the forum or topic screens.
Where is the button?
thanks so much for your help anyone.
Rob M.

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 11:32
by mwitt
4and20chars wrote:I apologize for butting in on this forum, but can anyone tell me how to post a question without using Post Reply like I am doing here? The instructions in FAQ say:
To post a new topic in a forum, click the relevant button on either the forum or topic screens.
Where is the button?
thanks so much for your help anyone.
Rob M.
You can post a new question using the "new topic" button at the top of the posting lists.
/Micke

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 13:47
by mwitt
Just wanted to update the status, this is the current result from the ongoing deep scan of the drive:
deep scan so far.GIF
deep scan so far.GIF (28.5 KiB) Viewed 16940 times
My guess is that the MAC HFS-stuff is from a sparce bundle created by iBackup in one of the folders of the partition for a mac book backup I made?

If the NTFS filesystem is corrupt, is there any hope of re-creating it at all? I have very limited experience and no deep knowledge of file systems, but does NTFS create a backup of the "map" in another location of the disk?

Best regards
/Micke

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 14:47
by Fiona
My guess is that the MAC HFS-stuff is from a sparce bundle created by iBackup in one of the folders of the partition for a mac book backup I made?
Yes, it's possible.
Using EFI GPT can find some remnants which are recognized as HFS+.
To find a right partition can take pretty long.
Also your GUID partition table has a wrong signature.
Analyse Disk /dev/sdd - 9999 GB / 9312 GiB - CHS 1215669 255 63
Current partition structure:
Bad GPT partition, invalid signature.
So it might be possible that you don't get the right results using the menu Advanced.
Your GUID partition table must be OK.
Results
P MS Data 264192 19529723903 19529459712 [Data1]
NTFS, 9999 GB / 9312 GiB
Your partition is displayed with label.
I assume it's the right one.
You could have a try to Write it.
Then it would be possible to have a boot sector diagnose.
When you confirm at Analyse, you're able to backup your current situation.
Just check Backup and press enter.
If you press L at the Quick Search screen you can restore it.

Can you upload a screen from your disk management console and your RAID, first?
Might be appropriate to collect all information before you're going to change anything.

Fiona

Re: Problem recovering partition/filesystem

Posted: 01 Apr 2012, 16:15
by mwitt
The partition seems to be the correct one, the label at least are correct (Data1). I´m not sure if writing it is a good idear, could there be a secondary GTP-header on the disk that is ok and that can be found during the deep check?

Could you explain a bit on what you mean with doing a boot sector analysis after the GPT is writen? This partition is not bootable, its a data partition.

see new screen below:

Disk manager just initiated, get question on initiation:
disk manager 1.GIF
disk manager 1.GIF (143.37 KiB) Viewed 16937 times
Answer cancel, disk listed as unpartitioned:
disk manager 1.GIF
disk manager 1.GIF (143.37 KiB) Viewed 16937 times
MegaRaid storage array from Storage Manager:
megaraid.GIF
megaraid.GIF (216.1 KiB) Viewed 16937 times