Ok, some updates on my futile struggle
First testdisk scan didn't turn up anything.
Second scan after rebuilding the bootsector allowed me to view some information but it's still a mess and no access to partitions. MFT+backup is corrupt also. This is what I get - I couldn't find the full testdisk log in partedmagic
Code: Select all
Disk rescue2.dd - 3000 GB / 2794 GiB - CHS 364785 255 63
Partition Start End Size in sectors
P NTFS 0 0 1 364784 207 31 5860268032
filesystem size 5860268032 18341069176930398147
sectors_per_cluster 8 167
mft_lcn 786432 319895051
mftmirr_lcn 366266751 1646484757
clusters_per_mft_record -10 48
clusters_per_index_record 1 -111
Extrapolated boot sector and current boot sector are different.
The harddisk (3000 GB / 2794 GiB) seems too small! (< 10085235 TB / 9172468 TiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
SysV 4 40644 7 63 23550024 184 43 2139335816118272 [M-6M-9M-h~I
WBFS 70378 2 17 2061066511 132 45 19697725041803264
SysV 4 166653 233 53 944645961 244 51 15173060083712 [~^%>-u~A]
SysV 4 255023 159 26 3155978142 189 8 1706664282554368 [^O JM-=8]
> SysV 4 261672 211 12 87559327 98 35 1402436820480 [y~Km^L~D
Disk rescue2.dd - 3000 GB / 2794 GiB - CHS 364785 255 63
Partition Start End Size in sectors
>P NTFS 0 0 1 364784 207 31 5860268032
P CramFS 252305 133 57 252502 218 15 3170119 [~@O/M-\^YbKM- M-~>M-0~KPM- )]
P CramFS 252305 133 58 252502 218 16 3170119 [~@O/M-\^YbKM- M-~>M-0~KPM- )]
Write isn't available because the partition table type "None" has been selected.
gdisk
Code: Select all
Command (? for help): p
Disk rescue2.dd: 5860268032 sectors, 2.7 TiB
Logical sector size: 512 bytes
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 5860267998
Partitions will be aligned on 8-sector boundaries
Total free space is 1294838339 sectors (617.4 GiB)
Number Start (sector) End (sector) Size Code Name
1 1294838373 1940375238 307.8 GiB 8300 Linux filesystem
2 1676881773 2934119958 599.5 GiB 8300 Linux filesystem
3 4257924028 6695841663 1.1 TiB 8300 Linux filesystem
4 1959818223 5544689613 1.7 TiB 8300 Linux filesystem
But then I tried chkdsk /f. It worked! It rebuilt the partition to a mountable state. But only managed to rebuild <10% of the file tree/directories.
R-studios recognizes 80% of the data, but again it could only retrieve <10% of the directory structure, so without all the necessary metadata the files are as good as useless.
- hddscan1 - Copy.png (25.54 KiB) Viewed 2957 times
Finally I was able to identify some missing root directory names under the 2nd MFT in the hex editor which doesn't show up anywhere else. If this is suppose to be the MFTmirr or the backup (correct me if I'm wrong, my understanding of ntfs data structure is very basic) is it possible to use it to rebuild by merging with or replacing the original MFT?