cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

WD My Book Duo 4TB Recovery

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=5876

Page 1 of 1

WD My Book Duo 4TB Recovery

Posted: 17 Feb 2016, 07:05
by technik
Hi,
My 4TB WD My Book Duo started showing up as RAW and it said invalid filesystem or something in Windows 10. I believe it was formatted NTFS with one large partition. I ran the default option on TestDisk 7.0 to deep search the partitions and it says the following after several days of running:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
                                                                                Disk /dev/sdl - 4000 GB / 3725 GiB - CHS 486397 255 63
                                                                                The harddisk (4000 GB / 3725 GiB) seems too small! (< 8001 GB / 7451 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
                                                                                The following partition can't be recovered:
     Partition               Start        End    Size in sectors
>  MS Data               7813973982 15627683772 7813709791
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                [ Continue ]
NTFS, blocksize=4096, 4000 GB / 3725 GiB
I ran the WD drive utilities and it said that RAID was good and Quick Drive Test also passed.

I tried to take one drive out and try with another sata connection and it never mounted, when I put it back in it said the RAID could only be rebuilt by erasing. Now I just have one drive in and RAID 1 says degraded. I think either drive will function the same.

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
                                                                                Disk /dev/sdl - 4000 GB / 3725 GiB - CHS 486397 255 63
     Partition               Start        End    Size in sectors
>D MS Data                   264192 7813973982 7813709791
 D MS Data                  1571400    2069351     497952 [DVMUSB]
 D MS Data                  1784309    1849844      65536
 D MS Data                  1784311    1849846      65536
 D MS Data                  1849861    1915396      65536
 D MS Data                  1849863    1915398      65536
 D Mac HFS                 22750380   23889123    1138744
 D Mac HFS                 23889120   25027863    1138744
 D Mac HFS                 25027860   26166603    1138744
 D Mac HFS                 45010656   59484511   14473856
 D Mac HFS                 59484508   73958363   14473856
 D Mac HFS                 65153520   73964847    8811328
 D Mac HFS                 73958360   88432215   14473856
Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
NTFS, blocksize=4096, 4000 GB / 3725 GiB
When I select the 1st option:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
                                                                                     MS Data                   264192 7813973982 7813709791
                                                                                                                                                                                                                                                Can't open filesystem. Filesystem seems damaged.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                >[  Quit  ]
                               Quit this section
I tried to list files in each partition and they seem to be from disc images that it found.

Where do I go from here?

Is there a way to repair the file system?

Log attached too.

Thanks in advance for your advice!

Re: WD My Book Duo 4TB Recovery

Posted: 17 Feb 2016, 07:42
by cgrenier
Run TestDisk, select the disk, Advanced, select the partition, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.
If it doesn't work, please post the testdisk.log file content.

Re: WD My Book Duo 4TB Recovery

Posted: 17 Feb 2016, 07:54
by technik
Thanks for the quick response.
I did as instructed but could not see the files at the List step. I've attached the testdisk.log
Let me know what to try next.
Thanks

Re: WD My Book Duo 4TB Recovery

Posted: 17 Feb 2016, 07:56
by technik
Sorry I thought log was uploading, here it is in text.

Code: Select all


Tue Feb 16 23:48:25 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdl)=4000754696192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
filewin32_getfilesize(\\.\PhysicalDrive7) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive7) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive7
filewin32_getfilesize(\\.\PhysicalDrive8) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive8) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive8
filewin32_getfilesize(\\.\PhysicalDrive9) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive9) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive9
filewin32_getfilesize(\\.\PhysicalDrive10) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive10) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive10
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive11)=4000754696192
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249218203648
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000162197504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000487641088
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=2048
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=2000396746752
filewin32_getfilesize(\\.\J:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\J:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2199023255040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=0
Warning: can't get size for \\.\L:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=0
Warning: can't get size for \\.\M:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=0
Warning: can't get size for \\.\N:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=0
Warning: can't get size for \\.\O:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=0
Warning: can't get size for \\.\P:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=0
Warning: can't get size for \\.\Q:
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk /dev/sde - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk /dev/sdl - 4000 GB / 3725 GiB - CHS 486397 255 63, sector size=512
Drive C: - 249 GB / 232 GiB - CHS 30299 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121596 255 63, sector size=512
Drive E: - 3000 GB / 2794 GiB - CHS 364788 255 63, sector size=512
Drive F: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive H: - 2048 B - CHS 1 64 32, sector size=2048
Drive K: - 2199 GB / 2047 GiB - CHS 267349 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdl - 4000 GB / 3725 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7813974015 (expected 7813974015)
hdr_lba_start=34
hdr_lba_end=7813973982
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 2 P MS Data                   264192 7813973982 7813709791 [Basic data partition]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

ntfs_boot_sector
 2 P MS Data                   264192 7813973982 7813709791 [Basic data partition]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size           7813709791
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
Failed to open inode $MFTMirr: Input/output error.
Failed to load $MFTMirr: Input/output error.
rebuild_NTFS_BS
mft at 16
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         0
ntfs_find_mft: mft_record_size     1024

mft at 6291456
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         0
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         0
ntfs_find_mft: mft_record_size     1024
ntfs_find_mft: index_block_size    4096
             New / Current boot sector
filesystem size           7813709791 7813709791
sectors_per_cluster       8 8
mft_lcn                   786432 786432
mftmirr_lcn               0 2
clusters_per_mft_record   -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size           7813709791 7813709791
sectors_per_cluster       8 8
mft_lcn                   786432 786432
mftmirr_lcn               0 2
clusters_per_mft_record   -10 -10
clusters_per_index_record 1 1

 2 P MS Data                   264192 7813973982 7813709791 [Basic data partition]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
Can't open filesystem. Filesystem seems damaged.
filesystem size           7813709791 7813709791
sectors_per_cluster       8 8
mft_lcn                   786432 786432
mftmirr_lcn               0 2
clusters_per_mft_record   -10 -10
clusters_per_index_record 1 1

 2 P MS Data                   264192 7813973982 7813709791 [Basic data partition]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
Can't open filesystem. Filesystem seems damaged.
filesystem size           7813709791 7813709791
sectors_per_cluster       8 8
mft_lcn                   786432 786432
mftmirr_lcn               0 2
clusters_per_mft_record   -10 -10
clusters_per_index_record 1 1

ntfs_boot_sector
 2 P MS Data                   264192 7813973982 7813709791 [Basic data partition]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size           7813709791
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

Re: WD My Book Duo 4TB Recovery

Posted: 19 Feb 2016, 07:31
by technik
Is there anything else I can try? The data seems to be there, but the partition and/or filesystem is just not showing up.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited