Trying to recover Seagate 4tb
Posted: 05 Oct 2016, 01:06
My Windows image was stored on my 4tb external hard drive. When I reinstalled the image, my external hard drive was also re-formatted. I think I had a spare hard drive connected when I created the image. It just had several bad Linux partitions, so that is what my 4tb hard drive has now.
I followed the Testdisk step by step, and I found my files. I did Analyse and found my partition and files, so I set it to P and did a write. I left the lba partition the way it was, because I thought it might contain the partition tables? I don't know, but this did not change the problem. I could still see my files in testdisk, but I couldn't access anything on the hard drive (it was still listed as raw). I'll paste portions of the log. If you want the whole thing I will post it, but I did a lot of back and forth (checking my files over and over and re-running quick search etc), which made the log pages long.
Fri Sep 30 09:05:44 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=610753576960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=371124600832
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4700372992
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 610 GB / 568 GiB - CHS 74253 255 63, sector size=512
Drive D: - 371 GB / 345 GiB - CHS 45119 255 63, sector size=512
Drive E: - 4700 MB / 4482 MiB - CHS 1120 64 32, sector size=2048
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
FAT32 at 0/32/39
FAT32 LBA 0 32 33 4177 117 36 67108864 [NO NAME]
FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
block_group_nr 81
recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/240, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
dir_partition inode=5
HPFS - NTFS 16 113 34 486401 53 52 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
Directory /
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 .
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 ..
55 dr-xr-xr-x 0 0 0 16-Sep-2016 14:54 $RECYCLE.BIN
12331 dr-xr-xr-x 0 0 0 26-Sep-2016 08:11 Backup of Simple Drive videos pics
62 dr-xr-xr-x 0 0 0 13-Sep-2016 18:00 Documents
58 dr-xr-xr-x 0 0 0 28-Sep-2016 08:26 GANDALF
9571 dr-xr-xr-x 0 0 0 28-Sep-2016 12:15 Manual Backup
35 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Seagate
37 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Start_Here_Mac.app
53 dr-xr-xr-x 0 0 0 16-Sep-2016 13:56 System Volume Information
9560 dr-xr-xr-x 0 0 0 14-Sep-2016 17:05 WindowsImageBackup
742749 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 ...._files
48 -r--r--r-- 0 0 32 16-Jul-2012 17:33 Autorun.inf
49 -r--r--r-- 0 0 194586 4-Jun-2015 16:49 BackupPlus.ico
122985 -r--r--r-- 0 0 400 19-Sep-2016 09:34 GoFlex (F) - Shortcut.lnk
61 -r--r--r-- 0 0 528 13-Sep-2016 18:00 MediaID.bin
50 -r--r--r-- 0 0 18010688 9-May-2016 19:29 Start_Here_Win.exe
51 -r--r--r-- 0 0 1146400 8-Jan-2015 16:13 Warranty.pdf
742748 -r--r--r-- 0 0 130690 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 .....htm
13354 -r--r--r-- 0 0 297154 15-Sep-2016 11:26 kaspersky license.png
68781 -r--r--r-- 0 0 369960 15-Sep-2016 14:08 prog files.jpg
69032 -r--r--r-- 0 0 312434 15-Sep-2016 14:08 prog files2.jpg
13195 -r--r--r-- 0 0 152090 15-Sep-2016 11:25 windows license.png
interface_load
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63 Fri Sep 30 09:04:29 2016
1 * FAT16 >32M 0 32 33 4177 117 36 67108864
interface_write()
1 P HPFS - NTFS 16 113 34 486401 53 52 7813771264
This did not fix the problem, so after finding other similar problems, and after I made sure I could still see my files I did a TestDisk, Advanced, Boot, RebuildBS, write.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Directory /
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 .
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 ..
55 dr-xr-xr-x 0 0 0 16-Sep-2016 14:54 $RECYCLE.BIN
12331 dr-xr-xr-x 0 0 0 26-Sep-2016 08:11 Backup of Simple Drive videos pics
62 dr-xr-xr-x 0 0 0 13-Sep-2016 18:00 Documents
58 dr-xr-xr-x 0 0 0 28-Sep-2016 08:26 GANDALF
9571 dr-xr-xr-x 0 0 0 28-Sep-2016 12:15 Manual Backup
35 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Seagate
37 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Start_Here_Mac.app
53 dr-xr-xr-x 0 0 0 16-Sep-2016 13:56 System Volume Information
9560 dr-xr-xr-x 0 0 0 14-Sep-2016 17:05 WindowsImageBackup
742749 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 ...._files
48 -r--r--r-- 0 0 32 16-Jul-2012 17:33 Autorun.inf
49 -r--r--r-- 0 0 194586 4-Jun-2015 16:49 BackupPlus.ico
122985 -r--r--r-- 0 0 400 19-Sep-2016 09:34 GoFlex (F) - Shortcut.lnk
61 -r--r--r-- 0 0 528 13-Sep-2016 18:00 MediaID.bin
50 -r--r--r-- 0 0 18010688 9-May-2016 19:29 Start_Here_Win.exe
51 -r--r--r-- 0 0 1146400 8-Jan-2015 16:13 Warranty.pdf
742748 -r--r--r-- 0 0 130690 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 .....htm
13354 -r--r--r-- 0 0 297154 15-Sep-2016 11:26 kaspersky license.png
68781 -r--r--r-- 0 0 369960 15-Sep-2016 14:08 prog files.jpg
69032 -r--r--r-- 0 0 312434 15-Sep-2016 14:08 prog files2.jpg
13195 -r--r--r-- 0 0 152090 15-Sep-2016 11:25 windows license.png
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
ntfs_boot_sector
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
NTFS at 16/113/34
Error: size boot_sector 3518803968 > partition 4294967295
filesystem size 7813771264 16584902953138304162
sectors_per_cluster 8 105
mft_lcn 786432 727126866
mftmirr_lcn 2 3928812524
clusters_per_mft_record -10 -90
clusters_per_index_record 1 93
Boot sector
Error: size boot_sector 3518803968 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Write new boot!
I rebooted, and now my files are not visible in testdisk and my drive just shows as an empty drive.
I saw that Mssr. Grenier suggested to one person that they manually input the partition information. Am I still able to do that, or have I ruined something along the way? Any help would be greatly appreciated. Please let me know if you'd like my full log file.
I followed the Testdisk step by step, and I found my files. I did Analyse and found my partition and files, so I set it to P and did a write. I left the lba partition the way it was, because I thought it might contain the partition tables? I don't know, but this did not change the problem. I could still see my files in testdisk, but I couldn't access anything on the hard drive (it was still listed as raw). I'll paste portions of the log. If you want the whole thing I will post it, but I did a lot of back and forth (checking my files over and over and re-running quick search etc), which made the log pages long.
Fri Sep 30 09:05:44 2016
Command line: TestDisk
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=610753576960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=371124600832
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4700372992
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 610 GB / 568 GiB - CHS 74253 255 63, sector size=512
Drive D: - 371 GB / 345 GiB - CHS 45119 255 63, sector size=512
Drive E: - 4700 MB / 4482 MiB - CHS 1120 64 32, sector size=2048
Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
FAT32 at 0/32/39
FAT32 LBA 0 32 33 4177 117 36 67108864 [NO NAME]
FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
block_group_nr 81
recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/240, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
dir_partition inode=5
HPFS - NTFS 16 113 34 486401 53 52 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
Directory /
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 .
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 ..
55 dr-xr-xr-x 0 0 0 16-Sep-2016 14:54 $RECYCLE.BIN
12331 dr-xr-xr-x 0 0 0 26-Sep-2016 08:11 Backup of Simple Drive videos pics
62 dr-xr-xr-x 0 0 0 13-Sep-2016 18:00 Documents
58 dr-xr-xr-x 0 0 0 28-Sep-2016 08:26 GANDALF
9571 dr-xr-xr-x 0 0 0 28-Sep-2016 12:15 Manual Backup
35 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Seagate
37 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Start_Here_Mac.app
53 dr-xr-xr-x 0 0 0 16-Sep-2016 13:56 System Volume Information
9560 dr-xr-xr-x 0 0 0 14-Sep-2016 17:05 WindowsImageBackup
742749 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 ...._files
48 -r--r--r-- 0 0 32 16-Jul-2012 17:33 Autorun.inf
49 -r--r--r-- 0 0 194586 4-Jun-2015 16:49 BackupPlus.ico
122985 -r--r--r-- 0 0 400 19-Sep-2016 09:34 GoFlex (F) - Shortcut.lnk
61 -r--r--r-- 0 0 528 13-Sep-2016 18:00 MediaID.bin
50 -r--r--r-- 0 0 18010688 9-May-2016 19:29 Start_Here_Win.exe
51 -r--r--r-- 0 0 1146400 8-Jan-2015 16:13 Warranty.pdf
742748 -r--r--r-- 0 0 130690 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 .....htm
13354 -r--r--r-- 0 0 297154 15-Sep-2016 11:26 kaspersky license.png
68781 -r--r--r-- 0 0 369960 15-Sep-2016 14:08 prog files.jpg
69032 -r--r--r-- 0 0 312434 15-Sep-2016 14:08 prog files2.jpg
13195 -r--r--r-- 0 0 152090 15-Sep-2016 11:25 windows license.png
interface_load
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63 Fri Sep 30 09:04:29 2016
1 * FAT16 >32M 0 32 33 4177 117 36 67108864
interface_write()
1 P HPFS - NTFS 16 113 34 486401 53 52 7813771264
This did not fix the problem, so after finding other similar problems, and after I made sure I could still see my files I did a TestDisk, Advanced, Boot, RebuildBS, write.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Directory /
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 .
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 ..
55 dr-xr-xr-x 0 0 0 16-Sep-2016 14:54 $RECYCLE.BIN
12331 dr-xr-xr-x 0 0 0 26-Sep-2016 08:11 Backup of Simple Drive videos pics
62 dr-xr-xr-x 0 0 0 13-Sep-2016 18:00 Documents
58 dr-xr-xr-x 0 0 0 28-Sep-2016 08:26 GANDALF
9571 dr-xr-xr-x 0 0 0 28-Sep-2016 12:15 Manual Backup
35 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Seagate
37 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Start_Here_Mac.app
53 dr-xr-xr-x 0 0 0 16-Sep-2016 13:56 System Volume Information
9560 dr-xr-xr-x 0 0 0 14-Sep-2016 17:05 WindowsImageBackup
742749 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 ...._files
48 -r--r--r-- 0 0 32 16-Jul-2012 17:33 Autorun.inf
49 -r--r--r-- 0 0 194586 4-Jun-2015 16:49 BackupPlus.ico
122985 -r--r--r-- 0 0 400 19-Sep-2016 09:34 GoFlex (F) - Shortcut.lnk
61 -r--r--r-- 0 0 528 13-Sep-2016 18:00 MediaID.bin
50 -r--r--r-- 0 0 18010688 9-May-2016 19:29 Start_Here_Win.exe
51 -r--r--r-- 0 0 1146400 8-Jan-2015 16:13 Warranty.pdf
742748 -r--r--r-- 0 0 130690 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 .....htm
13354 -r--r--r-- 0 0 297154 15-Sep-2016 11:26 kaspersky license.png
68781 -r--r--r-- 0 0 369960 15-Sep-2016 14:08 prog files.jpg
69032 -r--r--r-- 0 0 312434 15-Sep-2016 14:08 prog files2.jpg
13195 -r--r--r-- 0 0 152090 15-Sep-2016 11:25 windows license.png
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
ntfs_boot_sector
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
NTFS at 16/113/34
Error: size boot_sector 3518803968 > partition 4294967295
filesystem size 7813771264 16584902953138304162
sectors_per_cluster 8 105
mft_lcn 786432 727126866
mftmirr_lcn 2 3928812524
clusters_per_mft_record -10 -90
clusters_per_index_record 1 93
Boot sector
Error: size boot_sector 3518803968 > partition 4294967295
Status: Bad
Backup boot sector
Status: Bad
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Write new boot!
I rebooted, and now my files are not visible in testdisk and my drive just shows as an empty drive.
I saw that Mssr. Grenier suggested to one person that they manually input the partition information. Am I still able to do that, or have I ruined something along the way? Any help would be greatly appreciated. Please let me know if you'd like my full log file.