Please help me to understand the log and to solve the proble

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
nhutb
Posts: 3
Joined: 02 Nov 2013, 15:52

Please help me to understand the log and to solve the proble

#1 Post by nhutb »

First thank you in advance for your help. Here is my problem :

I was trying to consolidate data between external hard drives, so I copied data from external drive A to external drive B (My Book - 3 TB) ... then I realized that the copy process was not moving at the fast pace, I decided to pull the plug of the USB drives ... After that the drive B (3 TB Western Digital drive) can no longer read. It has the common error message as "You want to format the drive"

Normally, I would be able to use chkdsk e: /r /f to correct those issue, however this time it said that the master file table is corrupt, it tried to recover from disk however it does not help.

Now I use the testdisk-win and it show the output ...

----
Partition table type (auto): None
Drive E: - 3000 GB / 2794 GiB - WD My Book 1140
Partition table type: Intel

Analyse Drive E: - 3000 GB / 2794 GiB - CHS 45599 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434
Current partition structure:
1 * Sys=72 13577 238 11 119521 238 60 1701990410

Bad relative sector.
2 * Sys=74 45381 70 3 79242 34 29 543974724

Bad relative sector.
3 * NetWare 3.11+ 10498 56 41 10498 56 40 0

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724

----
It took almost 1 day to scan through and at the end it shows :

recover_EXT2: s_block_group_nr=0/152, s_mnt_count=25/28, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5012992
recover_EXT2: part_size 5012992
Linux 18548 99 48 18860 111 3 5012992
ext4 blocksize=4096 Large file Sparse superblock Recover, 20 GB / 19 GiB
BAD_RS LBA=3362726860 13726584
check_part_i386 failed for partition type 07
HPFS - NTFS 209320 16 53 266483 38 8 918324937
This partition ends after the disk limits. (start=3362726860, size=918324937, end=4281051796, disk end=732558080)
Drive E: - 3000 GB / 2794 GiB - CHS 45599 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 17 TB / 15 TiB)
The following partition can't be recovered:
HPFS - NTFS 209320 16 53 266483 38 8 918324937

Results
* Linux 18548 99 48 18860 111 3 5012992
ext4 blocksize=4096 Large file Sparse superblock Recover, 20 GB / 19 GiB

interface_write()
1 * Linux 18548 99 48 18860 111 3 5012992
simulate write!

----
Note that the hard drive contains mostly media file, and it is for Windows 7 ... I have no idea why it show some Linux partition here ...

Could you please help me to understand what is going on and to provide the solution how I can recover this partition nicely ... It seems that I can recover files, however with 3 TB of data, it is a total mess ..

Thank you

ps : How do I attach the testdisk.log file here ???

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Please help me to understand the log and to solve the pr

#2 Post by cgrenier »

Do not scan E: but run TestDisk on the PhysicalDisk. In the Advanced menu, select the partition, Boot, RepairMFT.
Does it work ?

nhutb
Posts: 3
Joined: 02 Nov 2013, 15:52

Re: Please help me to understand the log and to solve the pr

#3 Post by nhutb »

Thank you

If I do that selection : Advanced ->Boot-> Repair MFT : It comes back with message "Can't read NTFS MFT"

If I do : Advanced -> Boot -> Rebuild BS : It try to search for MFT with a very slow rate : 65536 sectors for 1 day... out of 732558080 sectors .... so I ended up to stop this rebuild boot sector process ...

Could you please advise what I should do next ...

I think the master file system is corrupted and somehow the master file system is lost ...
I am ok with the option to recover data and then to format the drive ... however the problem is how do I recover the data and to preserve the whole directory and filename structures ... I have tried out many data recovery software however they do not preserve the directory and filenames structures ... with 2 TB of data ... it is a mess

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Please help me to understand the log and to solve the pr

#4 Post by cgrenier »

There is probably a physical damage. Scanning a disk can take hours but should not take days.
Try to clone the disk to a new empty one using ddrescue
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

nhutb
Posts: 3
Joined: 02 Nov 2013, 15:52

Re: Please help me to understand the log and to solve the pr

#5 Post by nhutb »

Thank you, I have 2 questions :

a) It is the good suggestion to use the ddrescue to duplicate the hard drive. My current external drive is 3 TB (with roughly 2 TB of data), do I need to have the 2nd drive at the same physical size (i.e. 3TB) or I only need a 2TB that match with the amount of data that could be duplicated?

b) If I am using Partition Recovery software, I can see the directory structure ... does it mean the data has not yet lost ?

c) Let say I would like upload a screenshot of the drive (sometime picture worth thousand words) ... how do I upload the screenshot into this forum

thanks

Locked