External Hard Drive Wiped Itself?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
shuagood
Posts: 1
Joined: 06 Nov 2013, 15:46

External Hard Drive Wiped Itself?

#1 Post by shuagood »

Hello, I am new to the board, love what you guys do!

K so heres the deal...

I have an external usb hard drive that I stored most of my data on. One day I was loading files on it, and after I was done I got a bit excited and unplugged it before the computer was done shutting down. :roll: So I let the gf use it at her place, she plugs it in, the entire drive is empty, apart from a $RECYCLE.BIN and a system volume information folder. Either way, 500gb vanished somehow. I have been using testdisk to try and diagnose whats been going on, but alas, i'm not really too advanced with dealing with data recovery, or hard drives in general. I would play around if i didn't want the data, but photos of kids are kind of irreplaceable lol. Anyhow, ran testdisk, got a log file, maybe someone more advanced with this kinda stuff could possibly please help me out? Would be greatly appreciated! Thank you in advance!



Wed Nov 6 07:56:23 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.8.0-29-generic (#42~precise1-Ubuntu SMP Wed Aug 14 15:31:16 UTC 2013) i686
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:16:54
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 312500000 sectors
/dev/sda: user_max 312500000 sectors
/dev/sda: native_max 312500000 sectors
/dev/sda: dco 312500000 sectors
/dev/sdb: LBA, LBA48, DCO support
/dev/sdb: size 781422768 sectors
/dev/sdb: user_max 781422768 sectors
/dev/sdb: dco 781422768 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size 976773168 sectors
/dev/sdc: user_max 976773168 sectors
/dev/sdc: native_max 976773168 sectors
/dev/sdc: dco 976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19452 255 63, sector size=512 - WDC WD1600JS-75MHB0, S/N:WD-WMANM1016040, FW:03.01C03
Disk /dev/sdb - 400 GB / 372 GiB - CHS 48641 255 63, sector size=512 - ST3400820AS, S/N:9QG5XVNF, FW:3.CHL
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500418AS, S/N:5VM0N9K6, FW:CC34

Partition table type (auto): Intel
Disk /dev/sdc - 500 GB / 465 GiB - ST3500418AS
Partition table type: Intel

Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=1 sector=63
NTFS at 0/1/1
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 * HPFS - NTFS 0 1 1 60801 0 63 976768065 [Expansion Drive]
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdc - 500 GB / 465 GiB - CHS 60802 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60802 255 63
NTFS at 0/1/1
filesystem size 976768065
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60801 0 63 976768065 [Expansion Drive]
NTFS, 500 GB / 465 GiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
* HPFS - NTFS 0 1 1 60801 254 63 976784067 [Expansion Drive]
NTFS, 500 GB / 465 GiB

interface_write()
1 * HPFS - NTFS 0 1 1 60801 254 63 976784067 [Expansion Drive]

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60802 255 63
NTFS at 0/1/1
filesystem size 976768065
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 60801 0 63 976768065 [Expansion Drive]
NTFS, 500 GB / 465 GiB
BAD_RS LBA=3998587624 10892290
check_part_i386 failed for partition type 07
HPFS - NTFS 248900 144 53 298025 115 50 789191296
This partition ends after the disk limits. (start=3998587624, size=789191296, end=492811623, disk end=976784130)
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60802 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 2451 GB / 2282 GiB)
The following partition can't be recovered:
HPFS - NTFS 248900 144 53 298025 115 50 789191296
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 128.

Results
* HPFS - NTFS 0 1 1 60801 254 63 976784067 [Expansion Drive]
NTFS, 500 GB / 465 GiB
ntfs_device_testdisk_io_ioctl() unimplemented


dir_partition inode=5
* HPFS - NTFS 0 1 1 60801 254 63 976784067 [Expansion Drive]
NTFS, 500 GB / 465 GiB
Directory /
5 dr-xr-xr-x 0 0 0 18-Oct-2013 02:36 .
5 dr-xr-xr-x 0 0 0 18-Oct-2013 02:36 ..
36 dr-xr-xr-x 0 0 0 17-Oct-2013 18:25 $RECYCLE.BIN
39 dr-xr-xr-x 0 0 0 18-Oct-2013 02:36 System Volume Information

interface_write()
1 * HPFS - NTFS 0 1 1 60801 254 63 976784067 [Expansion Drive]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Locked