first of all I would like to thank the authors of testdisk/photorec and the community for these great tools and the nice documentations / support offered on forum etc!
I've used testdisk and photorec several times and as far as I can remember were always successful to recover partitions and/or the important files...
This time it seems a little bit more complicated and I would be very happy if you can guide me a little bit... I tried several options in testdisk but nothing help...
The HDD I am trying to analyse is an external USB hard disk of Western Digital (WD Passport for MAC - 0746):
Code: Select all
[276842.056109] usb 3-2: New USB device found, idVendor=1058, idProduct=0746
[276842.056116] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=5
[276842.056122] usb 3-2: Product: My Passport 0746
[276842.056126] usb 3-2: Manufacturer: Western Digital
Already when I attach it, I get some strange messages in dmesg:
Code: Select all
[276843.053504] scsi 11:0:0:0: Direct-Access WD My Passport 0746 1015 PQ: 0 ANSI: 6
[276843.054057] scsi 11:0:0:1: Enclosure WD SES Device 1015 PQ: 0 ANSI: 6
[276843.055250] sd 11:0:0:0: Attached scsi generic sg2 type 0
[276843.055475] ses 11:0:0:1: Attached Enclosure device
[276843.055643] ses 11:0:0:1: Attached scsi generic sg3 type 13
[276848.710016] sd 11:0:0:0: [sdc] 976707584 512-byte logical blocks: (500 GB/465 GiB)
[276848.712055] sd 11:0:0:0: [sdc] Write Protect is off
[276848.712064] sd 11:0:0:0: [sdc] Mode Sense: 47 00 10 08
[276848.713430] sd 11:0:0:0: [sdc] No Caching mode page present
[276848.713438] sd 11:0:0:0: [sdc] Assuming drive cache: write through
Code: Select all
[59784.630839] sd 6:0:0:0: [sdc] Unhandled sense code
[59784.630847] sd 6:0:0:0: [sdc]
[59784.630851] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[59784.630855] sd 6:0:0:0: [sdc]
[59784.630857] Sense Key : Medium Error [current]
[59784.630863] sd 6:0:0:0: [sdc]
[59784.630867] Add. Sense: Unrecovered read error
[59784.630871] sd 6:0:0:0: [sdc] CDB:
[59784.630873] Read(10): 28 00 0e 8d d8 40 00 00 08 00
[59784.630887] end_request: critical target error, dev sdc, sector 244176960
[59784.630894] Buffer I/O error on device sdc, logical block 30522120
The file system seems to be - also if you look at the documentation on web - XFS .
I would like to recover the XFS partition s.t. I can understand the file structure and recover the ts files... (side note: I already did a dd dump of the whole disk + ran photorec to recover all ts files, since those files were encryted, I also started to search for the corresponding AES keys .... and fortunately already decrypted some of the .ts files w/ the corresponding keys, Yes, this is no joke, the AES keys were held together w/ the video files (.srf), which were findable w/ file type ts setting w/ photorec!)
Anyway it would be much better if the partition can be recovered somehow s.t. I don't need to mess around w/ the strange file names and - kind of - try every ts key on every srf file.... and I'm not sure if I even found all of those files (.srf for video and .mdb for keys - drmdecrypt for the key check and decryption).
I ran testdisk several times (beta and not beta version) w/ various options (I also tried to change geometry, I think I tried w/ 16 and 240 heads)... but to no avail...
I also tried to use xfs_check and xfs_repair and some other tools like "Raise Data Recovery for SGI XFS file systems", but again nothing found. Indeed, testdisk did find out that XFS magics are on the disk and other tools didn't even came to that conclusion (they found nothing!).
So here is the log file, hopefully somebody can guide me a little bit:
Code: Select all
Mon Mar 24 10:53:14 2014
Command line: TestDisk
TestDisk 7.0-WIP, Data Recovery Utility, March 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.8.0-19-generic (#30-Ubuntu SMP Wed May 1 16:35:23 UTC 2013) x86_64
Compiler: GCC 4.4
Compilation date: 2014-03-12T13:38:12
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 5860533168 sectors
/dev/sdb: user_max 5860533168 sectors
/dev/sdb: native_max 5860533168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-1CH162, S/N:Z1D56SR7, FW:CC47
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00MMMB0, S/N:WD-WCAWZ2979215, FW:80.00A80
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63, sector size=512 - WD My Passport 0746, FW:1015
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TrekStor DSpocket light30, FW:01.0
Disk /dev/mapper/cryptswap1 - 17 GB / 15 GiB - 33462272 sectors, sector size=512
Disk /dev/dm-0 - 17 GB / 15 GiB - 33462272 sectors, sector size=512
Partition table type (auto): EFI GPT
Disk /dev/sdc - 500 GB / 465 GiB - WD My Passport 0746
Partition table type: EFI GPT
Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976707583 (expected 976707583)
hdr_lba_start=34
hdr_lba_end=976707550
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
SYSV4 Marker at 5252/252/34
recover_sysv4
Unknown 84389289 1781773010344 1781688621056 [�׀`@d]
SysV4, 912 TB / 829 TiB
Partition not added.
file_pread(6,16,buffer,244176946(15199/79/35)) read err: Partial read
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176946(15199/79/35)) read err: Partial read
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176952(15199/79/41)) read err: Partial read
XFS Marker at 15199/78/48
recover_xfs
MS Data 244176896 1220884479 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=244176896, size=976707584, end=1220884479, disk end=976707584)
file_pread(6,16,buffer,244176951(15199/79/40)) read err: Partial read
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
XFS Marker at 30398/157/32
recover_xfs
MS Data 488353792 1465061375 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=488353792, size=976707584, end=1465061375, disk end=976707584)
XFS Marker at 45597/236/16
recover_xfs
MS Data 732530688 1709238271 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=732530688, size=976707584, end=1709238271, disk end=976707584)
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 875 GB / 815 GiB)
The following partitions can't be recovered:
MS Data 244176896 1220884479 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
MS Data 488353792 1465061375 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
MS Data 732530688 1709238271 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
SYSV4 Marker at 5252/252/34
recover_sysv4
Unknown 84389289 1781773010344 1781688621056 [�׀`@d]
SysV4, 912 TB / 829 TiB
Partition not added.
file_pread(6,16,buffer,244176946(15199/79/35)) read err: Partial read
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176954(15199/79/43)) read err: Partial read
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176958(15199/79/47)) read err: Partial read
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176949(15199/79/38)) read err: Partial read
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176949(15199/79/38)) read err: Partial read
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
XFS Marker at 15199/78/48
recover_xfs
MS Data 244176896 1220884479 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=244176896, size=976707584, end=1220884479, disk end=976707584)
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,3,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176947(15199/79/36)) read err: Partial read
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,3,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176954(15199/79/43)) read err: Partial read
XFS Marker at 30398/157/32
recover_xfs
MS Data 488353792 1465061375 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=488353792, size=976707584, end=1465061375, disk end=976707584)
XFS Marker at 45597/236/16
recover_xfs
MS Data 732530688 1709238271 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=732530688, size=976707584, end=1709238271, disk end=976707584)
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 875 GB / 815 GiB)
The following partitions can't be recovered:
MS Data 244176896 1220884479 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
MS Data 488353792 1465061375 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
MS Data 732530688 1709238271 976707584
XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
Results
interface_write()
No partition found or selected for recovery
simulate write!
TestDisk exited normally.
Therefore I think that beta was the better version... I also tried w/ None and other configurations... but to no avail...
As said, the disk seems to work, I can "grep" for keys and ts files, and play them (after decryption)...
If I grep for the XFS magic I find it several times on the disk.
So I am pretty sure XFS is the correct file system type (that the TV set has used)...
What else can I try to get the partition back? It would be great to see the different files and folders... s.t. it gets less messy to recover the movies etc.