Please help "following partition can't be recovered" message
Posted: 07 Jun 2015, 16:55
Hi, I have an external Seagate 4TB HDD (Model: 1F2168) that recently encountered a message from Windows telling me the drives needs to be formatted when attempting to access the drive.
I've provided (below) screenshots of the Seagate drive status using: Disk Management (F:Drive), TeskDisk (after running the analyses) and attached the TestDisk.log.
The goal is to be able to recover the content (containing years of family videos, docs, etc.) with the drive that is now not accessible when I try accessing it from "Computer" (as Window's telling me to format the drive).
I would appreciate any feedback or suggestions on the next steps on how to recover (as I'm not sure what options to select in DiskManagement or TestDisk based on the results).
Please let me know if you have any questions. Thank you in advance.
Test Disk Results:
Sat Jun 6 19:51:19 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=127928369152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=128033226752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500096303104
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdb - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 127 GB / 119 GiB - CHS 15553 255 63, sector size=512
Drive E: - 128 GB / 119 GiB - CHS 15565 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63, sector size=512
Partition table type default to None
Drive F: - 500 GB / 465 GiB
Partition table type: Intel
Interface Advanced
Interface Advanced
Interface Advanced
Analyse Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
NTFS at 0/227/36
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=14336, size=7814004736, end=7814019071, disk end=976750592)
file_win32_pread(528,16,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,1,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,16,buffer,135231(8/106/34)) read err: read after end of file
file_win32_pread(528,16,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,1,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,16,buffer,141391(8/204/20)) read err: read after end of file
file_win32_pread(528,16,buffer,160666(10/0/17)) read err: read after end of file
file_win32_pread(528,16,buffer,163840(10/50/41)) read err: read after end of file
file_win32_pread(528,1,buffer,163840(10/50/41)) read err: read after end of file
file_win32_pread(528,15,buffer,163841(10/50/42)) read err: read after end of file
file_win32_pread(528,3,buffer,5234704(325/215/35)) read err: read after end of file
file_win32_pread(528,3,buffer,5234751(325/216/19)) read err: read after end of file
.
.
.
file_win32_pread(528,1,buffer,976211969(60766/98/6)) read err: read after end of file
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Results
interface_write()
No partition found or selected for recovery
search_part()
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
NTFS at 0/227/36
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=14336, size=7814004736, end=7814019071, disk end=976750592)
file_win32_pread(528,16,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,1,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,16,buffer,135231(8/106/34)) read err: read after end of file
file_win32_pread(528,16,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,1,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,16,buffer,141391(8/204/20)) read err: read after end of file
file_win32_pread(528,16,buffer,160665(10/0/16)) read err: read after end of file
file_win32_pread(528,16,buffer,160666(10/0/17)) read err: read after end of file
file_win32_pread(528,16,buffer,163840(10/50/41)) read err: read after end of file
.
.
.
file_win32_pread(528,1,buffer,5911919(367/254/63)) read err: read after end of file
file_win32_pread(528,1,buffer,5911920(368/0/1)) read err: read after end of file
file_win32_pread(528,15,buffer,5911921(368/0/2)) read err: read after end of file
file_win32_pread(528,3,buffer,5911936(368/0/17)) read err: read after end of file
file_win32_pread(528,3,buffer,5911983(368/1/1)) read err: read after end of file
file_win32_pread(528,8,buffer,5911999(368/1/17)) read err: read after end of file
file_win32_pread(528,11,buffer,5912046(368/2/1)) read err: read after end of file
file_win32_pread(528,2,buffer,5913968(368/32/33)) read err: read after end of file
Search for partition aborted
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Results
interface_write()
No partition found or selected for recovery
Thank you,
Andrew
I've provided (below) screenshots of the Seagate drive status using: Disk Management (F:Drive), TeskDisk (after running the analyses) and attached the TestDisk.log.
The goal is to be able to recover the content (containing years of family videos, docs, etc.) with the drive that is now not accessible when I try accessing it from "Computer" (as Window's telling me to format the drive).
I would appreciate any feedback or suggestions on the next steps on how to recover (as I'm not sure what options to select in DiskManagement or TestDisk based on the results).
Please let me know if you have any questions. Thank you in advance.
Test Disk Results:
Sat Jun 6 19:51:19 2015
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=127928369152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=128033226752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500096303104
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdb - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 127 GB / 119 GiB - CHS 15553 255 63, sector size=512
Drive E: - 128 GB / 119 GiB - CHS 15565 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63, sector size=512
Partition table type default to None
Drive F: - 500 GB / 465 GiB
Partition table type: Intel
Interface Advanced
Interface Advanced
Interface Advanced
Analyse Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
NTFS at 0/227/36
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=14336, size=7814004736, end=7814019071, disk end=976750592)
file_win32_pread(528,16,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,1,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,16,buffer,135231(8/106/34)) read err: read after end of file
file_win32_pread(528,16,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,1,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,16,buffer,141391(8/204/20)) read err: read after end of file
file_win32_pread(528,16,buffer,160666(10/0/17)) read err: read after end of file
file_win32_pread(528,16,buffer,163840(10/50/41)) read err: read after end of file
file_win32_pread(528,1,buffer,163840(10/50/41)) read err: read after end of file
file_win32_pread(528,15,buffer,163841(10/50/42)) read err: read after end of file
file_win32_pread(528,3,buffer,5234704(325/215/35)) read err: read after end of file
file_win32_pread(528,3,buffer,5234751(325/216/19)) read err: read after end of file
.
.
.
file_win32_pread(528,1,buffer,976211969(60766/98/6)) read err: read after end of file
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Results
interface_write()
No partition found or selected for recovery
search_part()
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
NTFS at 0/227/36
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=14336, size=7814004736, end=7814019071, disk end=976750592)
file_win32_pread(528,16,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,1,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,16,buffer,135231(8/106/34)) read err: read after end of file
file_win32_pread(528,16,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,1,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,16,buffer,141391(8/204/20)) read err: read after end of file
file_win32_pread(528,16,buffer,160665(10/0/16)) read err: read after end of file
file_win32_pread(528,16,buffer,160666(10/0/17)) read err: read after end of file
file_win32_pread(528,16,buffer,163840(10/50/41)) read err: read after end of file
.
.
.
file_win32_pread(528,1,buffer,5911919(367/254/63)) read err: read after end of file
file_win32_pread(528,1,buffer,5911920(368/0/1)) read err: read after end of file
file_win32_pread(528,15,buffer,5911921(368/0/2)) read err: read after end of file
file_win32_pread(528,3,buffer,5911936(368/0/17)) read err: read after end of file
file_win32_pread(528,3,buffer,5911983(368/1/1)) read err: read after end of file
file_win32_pread(528,8,buffer,5911999(368/1/17)) read err: read after end of file
file_win32_pread(528,11,buffer,5912046(368/2/1)) read err: read after end of file
file_win32_pread(528,2,buffer,5913968(368/32/33)) read err: read after end of file
Search for partition aborted
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Results
interface_write()
No partition found or selected for recovery
Thank you,
Andrew