2TB external: partition found, MFT match, can't list files.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Maxell
Posts: 2
Joined: 18 Nov 2015, 13:28

2TB external: partition found, MFT match, can't list files.

#1 Post by Maxell »

Hello,

I have a 2TB external HDD, use it to store various content on a single partition. Yesterday while starting a torrent I got a popup saying "The file or directory L:\$Mft is corrupt and unreadable. Please run the Chkdsk utility." I tried accessing a random file on the disk but couldn't. Torrents were still seeding from this drive. I stopped the torrent client, unmounted the disk and shut it off. Then I turned it back on and once Windows mounted it, I had a notification saying I should format if I want to use the drive.

I ran TestDisk, checked the MFT and got "MFT and MFT mirror matches perfectly". Then I ran it again to find the partition. It analyzed and recognized my partition, with the right label and all. However, when I tried to list the files on the partition, all I got was a "Can't open filesystem. Filesystem seems damaged."

Then, just to test whether the files were still there, I ran PhotoRec, which started recovering files straight away. But this is a last resort, as it doesn't recover file structure, names and dates.

Now, I know I should probably make a sector-by-sector image copy of the entire disc, but unfortunately I don't have another such big (or bigger disk) to play around with, I would have to go and literally buy one, which I don't find too tempting right now.

What should I do now? Help would be much appreciated.

P.S. Attaching a log, hope it's of any help :)

Code: Select all



Wed Nov 18 14:19:36 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7600)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=640130801152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000394706432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=640130801152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000394706432
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=32210164224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=607920572928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000392552448
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=8537767936
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=7553908736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=2000398901760
Hard disk list
Disk /dev/sda - 640 GB / 596 GiB - CHS 77824 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 258400 240 63, sector size=512
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 32 GB / 29 GiB - CHS 3915 255 63, sector size=512
Drive D: - 607 GB / 566 GiB - CHS 73908 255 63, sector size=512
Drive E: - 2000 GB / 1863 GiB - CHS 258400 240 63, sector size=512
Drive F: - 8537 MB / 8142 MiB - CHS 2035 64 32, sector size=2048
Drive G: - 7553 MB / 7203 MiB - CHS 1800 64 32, sector size=2048
Drive L: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
Warning: number of sectors per track mismatches 32 (NTFS) != 63 (HD)
 1 P HPFS - NTFS              0   1  1 243201  80 63 3907029105 [EXTERNAL]
No partition is bootable
Failed to load the complete runlist for $MFT/$DATA. Bug or corrupt $MFT. Run chkdsk.
 highest_vcn = 0xec7ff, last_vcn - 1 = 0xec1ff
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Failed to load the complete runlist for $MFT/$DATA. Bug or corrupt $MFT. Run chkdsk.
 highest_vcn = 0xec7ff, last_vcn - 1 = 0xec1ff
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to load the complete runlist for $MFT/$DATA. Bug or corrupt $MFT. Run chkdsk.
 highest_vcn = 0xec7ff, last_vcn - 1 = 0xec1ff
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
Failed to load the complete runlist for $MFT/$DATA. Bug or corrupt $MFT. Run chkdsk.
 highest_vcn = 0xec7ff, last_vcn - 1 = 0xec1ff
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
filesystem size           3907029105
sectors_per_cluster       1
mft_lcn                   679391488
mftmirr_lcn               679522593
clusters_per_mft_record   2
clusters_per_index_record 8
     HPFS - NTFS              0   1  1 243201  80 63 3907029105 [EXTERNAL]
     NTFS, blocksize=512, 2000 GB / 1863 GiB
file_pread(6,16,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,3907029168(243201/81/1)) ReadFile Data error (cyclic redundancy check).

file_pread(6,8,buffer,3907029176(243201/81/9)) lseek err Invalid argument
file_pread(6,3,buffer,3907029184(243201/81/17)) lseek err Invalid argument
file_pread(6,3,buffer,3907029231(243201/82/1)) lseek err Invalid argument
file_pread(6,8,buffer,3907029247(243201/82/17)) lseek err Invalid argument
file_pread(6,11,buffer,3907029294(243201/83/1)) lseek err Invalid argument
file_pread(6,2,buffer,3907031216(243201/113/33)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 16.

Results
   * HPFS - NTFS              0   1  1 243201 254 63 3907040067 [EXTERNAL]
     NTFS, blocksize=512, 2000 GB / 1863 GiB
Not an exFAT boot sector.

   * HPFS - NTFS              0   1  1 243201 254 63 3907040067 [EXTERNAL]
     NTFS, blocksize=512, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * HPFS - NTFS              0   1  1 243201 254 63 3907040067 [EXTERNAL]
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
 1 P HPFS - NTFS              0   1  1 243201  80 63 3907029105 [EXTERNAL]
     NTFS, blocksize=512, 2000 GB / 1863 GiB

ntfs_boot_sector
 1 P HPFS - NTFS              0   1  1 243201  80 63 3907029105 [EXTERNAL]
     NTFS, blocksize=512, 2000 GB / 1863 GiB
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
filesystem size           3907029105
sectors_per_cluster       1
mft_lcn                   679391488
mftmirr_lcn               679522593
clusters_per_mft_record   2
clusters_per_index_record 8
Boot sector
Warning: number of sectors per track mismatches 32 (NTFS) != 63 (HD)
Status: OK

Backup boot sector
Warning: number of sectors per track mismatches 32 (NTFS) != 63 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
MFT and MFT mirror matches perfectly.
MFT and MFT mirror matches perfectly.

ntfs_boot_sector
 1 P HPFS - NTFS              0   1  1 243201  80 63 3907029105 [EXTERNAL]
     NTFS, blocksize=512, 2000 GB / 1863 GiB
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
NTFS at 0/1/1
sect/track 32 (NTFS) != 63 (HD)
filesystem size           3907029105
sectors_per_cluster       1
mft_lcn                   679391488
mftmirr_lcn               679522593
clusters_per_mft_record   2
clusters_per_index_record 8
Boot sector
Warning: number of sectors per track mismatches 32 (NTFS) != 63 (HD)
Status: OK

Backup boot sector
Warning: number of sectors per track mismatches 32 (NTFS) != 63 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.


User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: 2TB external: partition found, MFT match, can't list fil

#2 Post by cgrenier »

I confirm, you should do a sector by sector copy of your disk due to the bad sectors.

Maxell
Posts: 2
Joined: 18 Nov 2015, 13:28

Re: 2TB external: partition found, MFT match, can't list fil

#3 Post by Maxell »

Naturally, but do you think I can restore the original file system, the structure, names, dates, etc. relatively easy and fast?

Locked