Please help "following partition can't be recovered" message

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
andrewmcm2012
Posts: 2
Joined: 07 Jun 2015, 16:01

Please help "following partition can't be recovered" message

#1 Post by andrewmcm2012 »

Hi, I have an external Seagate 4TB HDD (Model: 1F2168) that recently encountered a message from Windows telling me the drives needs to be formatted when attempting to access the drive.

I've provided (below) screenshots of the Seagate drive status using: Disk Management (F:Drive), TeskDisk (after running the analyses) and attached the TestDisk.log.

The goal is to be able to recover the content (containing years of family videos, docs, etc.) with the drive that is now not accessible when I try accessing it from "Computer" (as Window's telling me to format the drive).

I would appreciate any feedback or suggestions on the next steps on how to recover (as I'm not sure what options to select in DiskManagement or TestDisk based on the results).

Please let me know if you have any questions. Thank you in advance.
Screenshots
Screenshots
Screenshots DiskMgt_TestDisk1.jpg (155.89 KiB) Viewed 2126 times
Test Disk Results:

Sat Jun 6 19:51:19 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=127928369152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=128033226752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500096303104
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdb - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 127 GB / 119 GiB - CHS 15553 255 63, sector size=512
Drive E: - 128 GB / 119 GiB - CHS 15565 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63, sector size=512

Partition table type default to None
Drive F: - 500 GB / 465 GiB
Partition table type: Intel

Interface Advanced

Interface Advanced

Interface Advanced

Analyse Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
NTFS at 0/227/36
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=14336, size=7814004736, end=7814019071, disk end=976750592)
file_win32_pread(528,16,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,1,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,16,buffer,135231(8/106/34)) read err: read after end of file
file_win32_pread(528,16,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,1,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,16,buffer,141391(8/204/20)) read err: read after end of file
file_win32_pread(528,16,buffer,160666(10/0/17)) read err: read after end of file
file_win32_pread(528,16,buffer,163840(10/50/41)) read err: read after end of file
file_win32_pread(528,1,buffer,163840(10/50/41)) read err: read after end of file
file_win32_pread(528,15,buffer,163841(10/50/42)) read err: read after end of file
file_win32_pread(528,3,buffer,5234704(325/215/35)) read err: read after end of file
file_win32_pread(528,3,buffer,5234751(325/216/19)) read err: read after end of file
.
.
.
file_win32_pread(528,1,buffer,976211969(60766/98/6)) read err: read after end of file
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB

Results

interface_write()

No partition found or selected for recovery

search_part()
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
NTFS at 0/227/36
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976750592
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
This partition ends after the disk limits. (start=14336, size=7814004736, end=7814019071, disk end=976750592)
file_win32_pread(528,16,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,1,buffer,128583(8/1/1)) read err: read after end of file
file_win32_pread(528,16,buffer,135231(8/106/34)) read err: read after end of file
file_win32_pread(528,16,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,1,buffer,135247(8/106/50)) read err: read after end of file
file_win32_pread(528,16,buffer,141391(8/204/20)) read err: read after end of file
file_win32_pread(528,16,buffer,160665(10/0/16)) read err: read after end of file
file_win32_pread(528,16,buffer,160666(10/0/17)) read err: read after end of file
file_win32_pread(528,16,buffer,163840(10/50/41)) read err: read after end of file
.
.
.
file_win32_pread(528,1,buffer,5911919(367/254/63)) read err: read after end of file
file_win32_pread(528,1,buffer,5911920(368/0/1)) read err: read after end of file
file_win32_pread(528,15,buffer,5911921(368/0/2)) read err: read after end of file
file_win32_pread(528,3,buffer,5911936(368/0/17)) read err: read after end of file
file_win32_pread(528,3,buffer,5911983(368/1/1)) read err: read after end of file
file_win32_pread(528,8,buffer,5911999(368/1/17)) read err: read after end of file
file_win32_pread(528,11,buffer,5912046(368/2/1)) read err: read after end of file
file_win32_pread(528,2,buffer,5913968(368/32/33)) read err: read after end of file
Search for partition aborted
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB

Results

interface_write()

No partition found or selected for recovery

Thank you,
Andrew

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Please help "following partition can't be recovered" mes

#2 Post by Fiona »

How many partitions did you have on your disk.
There is 1 partition (RAW-unformatted) and 2 areas as unallocated?
It's strange to have 2 unallocated areas in a row.
The size if your first partition should be 4 TB but is 500 GB?
HPFS - NTFS 0 227 36 486400 48 48 7814004736 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
Can you run another diagnose and select your Disk instead of your drive?
Example:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdb - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 127 GB / 119 GiB - CHS 15553 255 63, sector size=512
Drive E: - 128 GB / 119 GiB - CHS 15565 255 63, sector size=512
Drive F: - 500 GB / 465 GiB - CHS 60799 255 63, sector size=512
Did you remove your disk out of your enclosure?
Because the sector size of your partition is 4k and your disk is currently recognized with 512 bytes per sector.
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Intel-MBR only supports disks up to 2.2 TB.
A better solution for disks larger than 2.2 TB are GPT disks.
Info will follow.
Until yet, you shouldn't change nor modify anything on your disk.
It can increase damage.
Please repeat your diagnose running Analyse and Quick Search and copy and paste the content of your testdisk.log again.
If your partition would be found, please press p to have a try to list your files.
Don't use the menu "Write" to avoid any changes.

Fiona

andrewmcm2012
Posts: 2
Joined: 07 Jun 2015, 16:01

Re: Please help "following partition can't be recovered" mes

#3 Post by andrewmcm2012 »

Hi Fiona,
Thank you for the quick feedback. I was able to list the directory of files after selecting the Disk instead of the drive (as you suggested) and I was recover all of my files successfully.

Answers to your questions:
- There is 1 partition (RAW-unformatted) and 2 areas as unallocated? Yes, for some reason the HDD turned into this scenario.
- The size if your first partition should be 4 TB but is 500 GB? Correct, it should be one single partition; however, I'm not sure why it's showing up as 500GB.
- Did you remove your disk out of your enclosure? No, this is a Seagate External USB drive (w/the proprietary adapter on the drive for USB; which, connects via sata data/ power). This is the model I have: http://www.amazon.com/Seagate-Backup-De ... B00829THLE
I had connected this drive via the Sata connection instead of the adapter the drive came with.

I appreciate all of the help and feedback! Take care!

Thanks,
Andrew

Locked