cgsecurity.org

i plugged my 2tb western digital my passport (fat32, one partition) into a friend's windows xp computer tonight. the computer could not read the drive, and my mac can't either now. here's the log from testdisk & a screenshot.

Hard disk list
Disk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906963456 sectors, sector size=512
Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO), sector size=512
Disk /dev/rdisk1 - 120 GB / 111 GiB - 234586112 sectors, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors, sector size=512

Partition table type default to EFI GPT
Disk /dev/rdisk2 - 2000 GB / 1862 GiB
Partition table type: Intel

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors
Current partition structure:

Partition: Read error

search_part()
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors
file_pread(8,1,buffer,2(2/0/1)) read err: Input/output error
file_pread(8,14,buffer,3(3/0/1)) read err: Input/output error
BAD_RS LBA=1704142259 48
check_part_i386 failed for partition type 04
FAT16 <32M 1704142259 5270235814 3566093556
This partition ends after the disk limits. (start=1704142259, size=3566093556, end=5270235814, disk end=3906963456)
BAD_RS LBA=1156248864 529
check_part_i386 failed for partition type 01
FAT12 1156248864 4117496161 2961247298
This partition ends after the disk limits. (start=1156248864, size=2961247298, end=4117496161, disk end=3906963456)
BAD_RS LBA=288611812 509
check_part_i386 failed for partition type 04
FAT16 <32M 288611812 322170883 33559072
BAD_RS LBA=232772076 941
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 4527739372 5763562066 1235822695
This partition ends after the disk limits. (start=4527739372, size=1235822695, end=5763562066, disk end=3906963456)
BAD_RS LBA=1388164889 735
check_part_i386 failed for partition type 04
FAT16 <32M 1388164889 1963113401 574948513
BAD_RS LBA=4264926395 791
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 4264926395 6591988671 2327062277
This partition ends after the disk limits. (start=4264926395, size=2327062277, end=6591988671, disk end=3906963456)

LVM magic value at 1965212966/0/1
BAD_RS LBA=1785191550 1023
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 6080158846 9803438978 3723280133
This partition ends after the disk limits. (start=6080158846, size=3723280133, end=9803438978, disk end=3906963456)
BAD_RS LBA=2783760853 741
check_part_i386 failed for partition type 07
HPFS - NTFS 2783760853 4959583375 2175822523
This partition ends after the disk limits. (start=2783760853, size=2175822523, end=4959583375, disk end=3906963456)
BAD_RS LBA=361503739 450
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 4656471035 8691422172 4034951138
This partition ends after the disk limits. (start=4656471035, size=4034951138, end=8691422172, disk end=3906963456)
BAD_RS LBA=2207820807 1059
check_part_i386 failed for partition type 0B
FAT32 2207820807 5084514826 2876694020
This partition ends after the disk limits. (start=2207820807, size=2876694020, end=5084514826, disk end=3906963456)
BAD_RS LBA=3080549473 261
check_part_i386 failed for partition type 01
FAT12 3080549473 3939143393 858593921
This partition ends after the disk limits. (start=3080549473, size=858593921, end=3939143393, disk end=3906963456)
BAD_RS LBA=1455599429 523
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
FAT16 LBA 5750566725 9599441123 3848874399
This partition ends after the disk limits. (start=5750566725, size=3848874399, end=9599441123, disk end=3906963456)
BAD_RS LBA=1817977161 952
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 6112944457 8607319536 2494375080
This partition ends after the disk limits. (start=6112944457, size=2494375080, end=8607319536, disk end=3906963456)
BAD_RS LBA=4002672842 724
check_part_i386 failed for partition type 07
HPFS - NTFS 4002672842 4258220994 255548153
This partition ends after the disk limits. (start=4002672842, size=255548153, end=4258220994, disk end=3906963456)
BAD_RS LBA=2786390733 92
check_part_i386 failed for partition type 01
FAT12 2786390733 4171589004 1385198272
This partition ends after the disk limits. (start=2786390733, size=1385198272, end=4171589004, disk end=3906963456)
BAD_RS LBA=2819854001 573
check_part_i386 failed for partition type 06
FAT16 >32M 2819854001 3412790946 592936946
BAD_RS LBA=243289043 0
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
FAT16 LBA 4538256339 7587794328 3049537990
This partition ends after the disk limits. (start=4538256339, size=3049537990, end=7587794328, disk end=3906963456)
BAD_RS LBA=499863817 485
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 4794831113 8778998197 3984167085
This partition ends after the disk limits. (start=4794831113, size=3984167085, end=8778998197, disk end=3906963456)
BAD_RS LBA=839495292 921
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 5134462588 5785639467 651176880
This partition ends after the disk limits. (start=5134462588, size=651176880, end=5785639467, disk end=3906963456)
BAD_RS LBA=1075659904 1238
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 5370627200 6629199492 1258572293
This partition ends after the disk limits. (start=5370627200, size=1258572293, end=6629199492, disk end=3906963456)
BAD_RS LBA=998852486 886
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 5293819782 9547194467 4253374686
This partition ends after the disk limits. (start=5293819782, size=4253374686, end=9547194467, disk end=3906963456)
BAD_RS LBA=386330455 554
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 4681297751 7965048623 3283750873
This partition ends after the disk limits. (start=4681297751, size=3283750873, end=7965048623, disk end=3906963456)
BAD_RS LBA=1741926366 739
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 6036893662 7656375797 1619482136
This partition ends after the disk limits. (start=6036893662, size=1619482136, end=7656375797, disk end=3906963456)
BAD_RS LBA=1116027695 743
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 5410994991 7047105467 1636110477
This partition ends after the disk limits. (start=5410994991, size=1636110477, end=7047105467, disk end=3906963456)
BAD_RS LBA=1848293323 1191
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 6143260619 9195741380 3052480762
This partition ends after the disk limits. (start=6143260619, size=3052480762, end=9195741380, disk end=3906963456)
BAD_RS LBA=3477861825 742
check_part_i386 failed for partition type 0E
FAT16 LBA 3477861825 7650316831 4172455007
This partition ends after the disk limits. (start=3477861825, size=4172455007, end=7650316831, disk end=3906963456)
BAD_RS LBA=236386906 833
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 4531354202 7250012915 2718658714
This partition ends after the disk limits. (start=4531354202, size=2718658714, end=7250012915, disk end=3906963456)
BAD_RS LBA=3643932462 1140
check_part_i386 failed for partition type 04
FAT16 <32M 3643932462 3680054396 36121935
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1862 GiB) seems too small! (< 5019 GB / 4674 GiB)
The following partitions can't be recovered:
FAT12 1156248864 4117496161 2961247298
FAT16 <32M 1704142259 5270235814 3566093556
FAT32 2207820807 5084514826 2876694020
HPFS - NTFS 2783760853 4959583375 2175822523
FAT12 2786390733 4171589004 1385198272
FAT12 3080549473 3939143393 858593921
FAT16 LBA 3477861825 7650316831 4172455007
HPFS - NTFS 4002672842 4258220994 255548153
FAT16 >32M 4264926395 6591988671 2327062277
FAT32 LBA 4527739372 5763562066 1235822695
FAT12 4531354202 7250012915 2718658714
FAT1

There are I/O errors. You disk probably contains bad sectors. It's a physical problem so it shouldn't be caused by using the disk on an XP, probably a mechanical or electric shock.
You can try to clone the disk to a new empty disk using gnu ddrescue, if rdisk3 is the destination:

thanks. i kind of figured the i/o errors were bad news but i thought i'd post a log just in case. i guess the boot sector-related errors got my hopes up

ok i ran ddrescue. i did not try and wipe the new drive beforehand and just overwrote, i hope that is not a problem. here is the log from running testdisk on the new drive.

Hard disk list
Disk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO), sector size=512
Disk /dev/disk2 - 2000 GB / 1862 GiB - 3906963456 sectors, sector size=512
Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO), sector size=512
Disk /dev/rdisk1 - 120 GB / 111 GiB - 234586112 sectors, sector size=512
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/rdisk2 - 2000 GB / 1862 GiB
Partition table type: Intel

Analyse Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 1 type EE: no test
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
1 P EFI GPT 1 3906963448 3906963448

Warning: Bad starting sector (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors
FAT32 at 8/0/1
FAT1 : 32-476839
FAT2 : 476840-953647
start_rootdir : 953648 root cluster : 2
Data : 953648-3906963439
sectors : 3906963454
cluster_size : 64
no_of_cluster : 61031403 (2 - 61031404)
fat_length 476808 calculated 476808
FAT differs, FAT sectors=0-16/476808
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 8/0/1
FAT32 LBA 8 3906963461 3906963454 [UNTITLED]
FAT32, blocksize=32768, 2000 GB / 1862 GiB
This partition ends after the disk limits. (start=8, size=3906963454, end=3906963461, disk end=3906963456)

HFS+ magic value at 409640/0/1
part_size 3906291632
HFS 409640 3906701271 3906291632
HFS+ blocksize=4096, 2000 GB / 1862 GiB
Disk /dev/rdisk2 - 2000 GB / 1862 GiB - 3906963456 sectors
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1862 GiB) seems too small! (< 2000 GB / 1862 GiB)
The following partition can't be recovered:
FAT32 LBA 8 3906963461 3906963454 [UNTITLED]
FAT32, blocksize=32768, 2000 GB / 1862 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 8.

Results
* HFS 409640 3906701271 3906291632
HFS+ blocksize=4096, 2000 GB / 1862 GiB

* HFS 409640 3906701271 3906291632
HFS+ blocksize=4096, 2000 GB / 1862 GiB
Support for this filesystem hasn't been enable during compilation.

interface_write()
1 * HFS 409640 3906701271 3906291632

ddrescue could not save 4096 bytes of the drive. i did retry passes with no luck.

that's the size of an advanced format sector, isn't it? i don't know, maybe that will help.

if in any case testdisk can't do anything and you know of other routes to try, please let me know. at this point i'm concerned about the data but have accepted that i may have lost it- on the other hand i'm enjoying learning about this process, so if there's something else i can i do to continue i'd like to know.

Use knoppix live dvd to save data.
http://forum.cgsecurity.org/phpBB3/back ... t4690.html
and dont do things before getting advice.

did i do anything i should not have or is that advice for the future?

ok, seeing as you recommend knoppix to everyone regardless of their problem im going to assume you didnt even read my logfile..