XFS partition recovery problem - WDBL1D5000ABK USB

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
philipp
Posts: 1
Joined: 24 Mar 2014, 10:57

XFS partition recovery problem - WDBL1D5000ABK USB

#1 Post by philipp »

Hey all,

first of all I would like to thank the authors of testdisk/photorec and the community for these great tools and the nice documentations / support offered on forum etc!

I've used testdisk and photorec several times and as far as I can remember were always successful to recover partitions and/or the important files...

This time it seems a little bit more complicated and I would be very happy if you can guide me a little bit... I tried several options in testdisk but nothing help...

The HDD I am trying to analyse is an external USB hard disk of Western Digital (WD Passport for MAC - 0746):

Code: Select all

[276842.056109] usb 3-2: New USB device found, idVendor=1058, idProduct=0746
[276842.056116] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=5
[276842.056122] usb 3-2: Product: My Passport 0746
[276842.056126] usb 3-2: Manufacturer: Western Digital


Already when I attach it, I get some strange messages in dmesg:

Code: Select all

[276843.053504] scsi 11:0:0:0: Direct-Access     WD       My Passport 0746 1015 PQ: 0 ANSI: 6
[276843.054057] scsi 11:0:0:1: Enclosure         WD       SES Device       1015 PQ: 0 ANSI: 6
[276843.055250] sd 11:0:0:0: Attached scsi generic sg2 type 0
[276843.055475] ses 11:0:0:1: Attached Enclosure device
[276843.055643] ses 11:0:0:1: Attached scsi generic sg3 type 13
[276848.710016] sd 11:0:0:0: [sdc] 976707584 512-byte logical blocks: (500 GB/465 GiB)
[276848.712055] sd 11:0:0:0: [sdc] Write Protect is off
[276848.712064] sd 11:0:0:0: [sdc] Mode Sense: 47 00 10 08
[276848.713430] sd 11:0:0:0: [sdc] No Caching mode page present
[276848.713438] sd 11:0:0:0: [sdc] Assuming drive cache: write through
But also (later on) while running testdisk:

Code: Select all

[59784.630839] sd 6:0:0:0: [sdc] Unhandled sense code
[59784.630847] sd 6:0:0:0: [sdc]  
[59784.630851] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[59784.630855] sd 6:0:0:0: [sdc]  
[59784.630857] Sense Key : Medium Error [current] 
[59784.630863] sd 6:0:0:0: [sdc]  
[59784.630867] Add. Sense: Unrecovered read error
[59784.630871] sd 6:0:0:0: [sdc] CDB: 
[59784.630873] Read(10): 28 00 0e 8d d8 40 00 00 08 00
[59784.630887] end_request: critical target error, dev sdc, sector 244176960
[59784.630894] Buffer I/O error on device sdc, logical block 30522120
This USB HDD was connected on a good friend's Samsung Smart TV (model Ue46d6500) to record movies etc.
The file system seems to be - also if you look at the documentation on web - XFS .

I would like to recover the XFS partition s.t. I can understand the file structure and recover the ts files... (side note: I already did a dd dump of the whole disk + ran photorec to recover all ts files, since those files were encryted, I also started to search for the corresponding AES keys .... and fortunately already decrypted some of the .ts files w/ the corresponding keys, Yes, this is no joke, the AES keys were held together w/ the video files (.srf), which were findable w/ file type ts setting w/ photorec!)

Anyway it would be much better if the partition can be recovered somehow s.t. I don't need to mess around w/ the strange file names and - kind of - try every ts key on every srf file.... and I'm not sure if I even found all of those files (.srf for video and .mdb for keys - drmdecrypt for the key check and decryption).

I ran testdisk several times (beta and not beta version) w/ various options (I also tried to change geometry, I think I tried w/ 16 and 240 heads)... but to no avail...
I also tried to use xfs_check and xfs_repair and some other tools like "Raise Data Recovery for SGI XFS file systems", but again nothing found. Indeed, testdisk did find out that XFS magics are on the disk and other tools didn't even came to that conclusion (they found nothing!).

So here is the log file, hopefully somebody can guide me a little bit:

Code: Select all

Mon Mar 24 10:53:14 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, March 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.8.0-19-generic (#30-Ubuntu SMP Wed May 1 16:35:23 UTC 2013) x86_64
Compiler: GCC 4.4
Compilation date: 2014-03-12T13:38:12
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       1953525168 sectors
/dev/sda: user_max   1953525168 sectors
/dev/sda: native_max 1953525168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size       5860533168 sectors
/dev/sdb: user_max   5860533168 sectors
/dev/sdb: native_max 5860533168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM003-1CH162, S/N:Z1D56SR7, FW:CC47
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00MMMB0, S/N:WD-WCAWZ2979215, FW:80.00A80
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63, sector size=512 - WD My Passport 0746, FW:1015
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TrekStor DSpocket light30, FW:01.0
Disk /dev/mapper/cryptswap1 - 17 GB / 15 GiB - 33462272 sectors, sector size=512
Disk /dev/dm-0 - 17 GB / 15 GiB - 33462272 sectors, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdc - 500 GB / 465 GiB - WD My Passport 0746
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=976707583 (expected 976707583)
hdr_lba_start=34
hdr_lba_end=976707550
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63

SYSV4 Marker at 5252/252/34

recover_sysv4
     Unknown                 84389289 1781773010344 1781688621056 [�׀`@d]
     SysV4, 912 TB / 829 TiB
Partition not added.
file_pread(6,16,buffer,244176946(15199/79/35)) read err: Partial read
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176946(15199/79/35)) read err: Partial read
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176952(15199/79/41)) read err: Partial read

XFS Marker at 15199/78/48

recover_xfs
     MS Data                244176896 1220884479  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=244176896, size=976707584, end=1220884479, disk end=976707584)
file_pread(6,16,buffer,244176951(15199/79/40)) read err: Partial read
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error

XFS Marker at 30398/157/32

recover_xfs
     MS Data                488353792 1465061375  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=488353792, size=976707584, end=1465061375, disk end=976707584)

XFS Marker at 45597/236/16

recover_xfs
     MS Data                732530688 1709238271  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=732530688, size=976707584, end=1709238271, disk end=976707584)
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 875 GB / 815 GiB)
The following partitions can't be recovered:
     MS Data                244176896 1220884479  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
     MS Data                488353792 1465061375  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
     MS Data                732530688 1709238271  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63

SYSV4 Marker at 5252/252/34

recover_sysv4
     Unknown                 84389289 1781773010344 1781688621056 [�׀`@d]
     SysV4, 912 TB / 829 TiB
Partition not added.
file_pread(6,16,buffer,244176946(15199/79/35)) read err: Partial read
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176954(15199/79/43)) read err: Partial read
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176958(15199/79/47)) read err: Partial read
file_pread(6,1,buffer,244176960(15199/79/49)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176949(15199/79/38)) read err: Partial read
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,1,buffer,244176961(15199/79/50)) read err: Input/output error
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,1,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176949(15199/79/38)) read err: Partial read
file_pread(6,16,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,1,buffer,244176965(15199/79/54)) read err: Input/output error
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,16,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error

XFS Marker at 15199/78/48

recover_xfs
     MS Data                244176896 1220884479  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=244176896, size=976707584, end=1220884479, disk end=976707584)
file_pread(6,16,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,1,buffer,244176962(15199/79/51)) read err: Input/output error
file_pread(6,3,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,16,buffer,244176947(15199/79/36)) read err: Partial read
file_pread(6,16,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176966(15199/79/55)) read err: Input/output error
file_pread(6,1,buffer,244176967(15199/79/56)) read err: Input/output error
file_pread(6,16,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,1,buffer,244176963(15199/79/52)) read err: Input/output error
file_pread(6,3,buffer,244176964(15199/79/53)) read err: Input/output error
file_pread(6,16,buffer,244176954(15199/79/43)) read err: Partial read

XFS Marker at 30398/157/32

recover_xfs
     MS Data                488353792 1465061375  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=488353792, size=976707584, end=1465061375, disk end=976707584)

XFS Marker at 45597/236/16

recover_xfs
     MS Data                732530688 1709238271  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
This partition ends after the disk limits. (start=732530688, size=976707584, end=1709238271, disk end=976707584)
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60797 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 875 GB / 815 GiB)
The following partitions can't be recovered:
     MS Data                244176896 1220884479  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
     MS Data                488353792 1465061375  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB
     MS Data                732530688 1709238271  976707584
     XFS 6.2+ - bitmap version blocksize=4096, 500 GB / 465 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

TestDisk exited normally.
The beta version did detect that " EFI GPT partition table type has been detected.", the release version didn't...
Therefore I think that beta was the better version... I also tried w/ None and other configurations... but to no avail...

As said, the disk seems to work, I can "grep" for keys and ts files, and play them (after decryption)...
If I grep for the XFS magic I find it several times on the disk.

So I am pretty sure XFS is the correct file system type (that the TV set has used)...

What else can I try to get the partition back? It would be great to see the different files and folders... s.t. it gets less messy to recover the movies etc.
Top
Locked

Return to “Partition Recovery”