Partition: Write error

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Nico87
Posts: 4
Joined: 07 Dec 2016, 20:56

Partition: Write error

#1 Post by Nico87 »

Hello, I am trying to fix a lost partition issue on a Western Digital 4 TB, after an halt during a file copy from an USB external drive and a forced shutdown (as if one of the drive went to "sleep mode"). TestDisk can see the partition and I could save all files before trying to recover the partition (seen as RAW by Windows 7).
I have 2 exact same hard drive model in that computer.
  • UEFI BIOS displays the faulty disk as 3 TB while the sane disk is correctly listed as 4 TB
  • Windows Drive Manager displays the faulty disk as 4 TB as one big RAW partition
  • TestDisk sees the sane disk as 4000 GB / 3726 GiB CHS 486401 255 63 sector size = 512
  • TestDisk sees the faulty disk as 3000 GB / 2964 GiB CHS 364804 255 63 sector size = 512
I tried to changed the Geometry of the faulty disk to adjust it to the correct number of cylinders which is 486401 (not written on the drive itself unfortunately but I also checked the web and it appears that this number should be correct).

Then I went to Analyse, Quick Search, it found the partition fast (it was finding it even before the cylinders tweak) then I tried to "Write" the partition info... and this is were I am getting "Partition: Write error".

Here is the log :

Code: Select all

Wed Dec  7 20:33:59 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000615492608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000615492608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1106847465472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2893697515520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000096137216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=4000647741440
Hard disk list
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364804 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Drive C: - 1106 GB / 1030 GiB - CHS 134566 255 63, sector size=512
Drive D: - 2893 GB / 2694 GiB - CHS 351805 255 63, sector size=512
Drive F: - 1000 GB / 931 GiB - CHS 121588 255 63, sector size=512
Drive I: - 4000 GB / 3725 GiB - CHS 486384 255 63, sector size=512

Partition table type (auto): None
Partition table type (auto): EFI GPT
Disk /dev/sda - 4000 GB / 3726 GiB
Partition table type: EFI GPT
Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364804 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814032064 (expected 5860577133)
hdr_lba_start=34
hdr_lba_end=7814032031
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                   264192 7814029311 7813765120

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364804 255 63
NTFS at 16/113/34
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=4000647741440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
This partition ends after the disk limits. (start=264192, size=7813765120, end=7814029311, disk end=5860577134)
Search for partition aborted
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364804 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
     MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814032064 (expected 5860577133)
hdr_lba_start=34
hdr_lba_end=7814032031
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
 1 P MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS Volume is dirty.


dir_partition inode=5
 1 P MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
Directory /
       5 dr-xr-xr-x     0      0         0  7-Feb-2015 10:14 .
       5 dr-xr-xr-x     0      0         0  7-Feb-2015 10:14 ..
  345790 dr-xr-xr-x     0      0         0  3-Feb-2015 14:50 $RECYCLE.BIN
  343015 dr-xr-xr-x     0      0         0 16-Feb-2014 21:31 ActionMax
  343230 dr-xr-xr-x     0      0         0  9-Jan-2014 22:21 Arcade Music Trivia Challenger
  343342 dr-xr-xr-x     0      0         0 24-Jan-2014 02:04 Controller
  343658 dr-xr-xr-x     0      0         0 23-Jan-2014 15:56 Daphne
  343970 dr-xr-xr-x     0      0         0  5-Jan-2014 02:09 Frets on Fire
      37 dr-xr-xr-x     0      0         0  4-Feb-2015 01:30 Future Pinball
    1568 dr-xr-xr-x     0      0         0  4-Feb-2015 09:55 HyperSpin
   78528 dr-xr-xr-x     0      0         0 23-Mar-2014 18:55 MAME
  108393 dr-xr-xr-x     0      0         0 13-Jan-2014 01:07 ROMs
      35 dr-xr-xr-x     0      0         0  8-Feb-2014 00:49 System Volume Information
  509175 dr-xr-xr-x     0      0         0  8-Feb-2014 22:56 TempSave
  286435 dr-xr-xr-x     0      0         0  5-Jan-2014 08:52 Vids
  316319 dr-xr-xr-x     0      0         0 19-Jan-2014 23:08 XBMC
   78369 dr-xr-xr-x     0      0         0 17-Feb-2014 09:52 Z space
    1582 dr-xr-xr-x     0      0         0  6-Feb-2015 16:36 borne pour dom
  547256 dr-xr-xr-x     0      0         0  7-Feb-2015 10:15 test

ntfs_boot_sector
 1 P MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
file_pread(5,1,buffer,3519062015(486400/211/19)) lseek err Invalid argument
filesystem size           7813765120 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn             786432
ntfs_find_mft: mftmirr_lcn         2
ntfs_find_mft: mft_record_size     1024
ntfs_find_mft: index_block_size    4096
Extrapolated boot sector and current boot sector are identical.
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS Volume is dirty.

Directory /
       5 dr-xr-xr-x     0      0         0  7-Feb-2015 10:14 .
       5 dr-xr-xr-x     0      0         0  7-Feb-2015 10:14 ..
  345790 dr-xr-xr-x     0      0         0  3-Feb-2015 14:50 $RECYCLE.BIN
  343015 dr-xr-xr-x     0      0         0 16-Feb-2014 21:31 ActionMax
  343230 dr-xr-xr-x     0      0         0  9-Jan-2014 22:21 Arcade Music Trivia Challenger
  343342 dr-xr-xr-x     0      0         0 24-Jan-2014 02:04 Controller
  343658 dr-xr-xr-x     0      0         0 23-Jan-2014 15:56 Daphne
  343970 dr-xr-xr-x     0      0         0  5-Jan-2014 02:09 Frets on Fire
      37 dr-xr-xr-x     0      0         0  4-Feb-2015 01:30 Future Pinball
    1568 dr-xr-xr-x     0      0         0  4-Feb-2015 09:55 HyperSpin
   78528 dr-xr-xr-x     0      0         0 23-Mar-2014 18:55 MAME
  108393 dr-xr-xr-x     0      0         0 13-Jan-2014 01:07 ROMs
      35 dr-xr-xr-x     0      0         0  8-Feb-2014 00:49 System Volume Information
  509175 dr-xr-xr-x     0      0         0  8-Feb-2014 22:56 TempSave
  286435 dr-xr-xr-x     0      0         0  5-Jan-2014 08:52 Vids
  316319 dr-xr-xr-x     0      0         0 19-Jan-2014 23:08 XBMC
   78369 dr-xr-xr-x     0      0         0 17-Feb-2014 09:52 Z space
    1582 dr-xr-xr-x     0      0         0  6-Feb-2015 16:36 borne pour dom
  547256 dr-xr-xr-x     0      0         0  7-Feb-2015 10:15 test
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1

ntfs_boot_sector
 1 P MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
file_pread(5,1,buffer,3519062015(486400/211/19)) lseek err Invalid argument
filesystem size           7813765120 1
sectors_per_cluster       8 0
mft_lcn                   786432 0
mftmirr_lcn               2 0
clusters_per_mft_record   -10 0
clusters_per_index_record 1 0
Boot sector
Status: OK

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
New geometry
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63 sector_size=512

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814032064 (expected 7814032064)
hdr_lba_start=34
hdr_lba_end=7814032031
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                   264192 7814029311 7813765120

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=4000647741440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,8,buffer,3519062016(486400/211/20)) lseek err Invalid argument
file_pread(5,1,buffer,3519062016(486400/211/20)) lseek err Invalid argument
file_pread(5,1,buffer,3519062017(486400/211/21)) lseek err Invalid argument
file_pread(5,14,buffer,3519062018(486400/211/22)) lseek err Invalid argument
file_pread(5,3,buffer,3519062032(486400/211/36)) lseek err Invalid argument
file_pread(5,3,buffer,3519062079(486400/212/20)) lseek err Invalid argument
file_pread(5,8,buffer,3519062095(486400/212/36)) lseek err Invalid argument
file_pread(5,11,buffer,3519062142(486400/213/20)) lseek err Invalid argument
file_pread(5,2,buffer,3519064064(486400/243/52)) lseek err Invalid argument

Results
   P MS Data                   264192 7814029311 7813765120
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

interface_write()
 1 P MS Data                   264192 7814029311 7813765120
write!
file_pwrite(5,32,buffer,3519064736(486400/254/31)) seek err Invalid argument

Partition: Write error

TestDisk exited normally.
Does anybody have a clue on this ? Can I recover that partition ? If not, what should I do to make this hard drive usable again, as coming out from the factory or maybe is it damaged and shall I stop trying to fix it ?

Thank you

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Partition: Write error

#2 Post by cgrenier »

Check if the 3TB disk has jumpers that may be used to limit its capacity.
Please post the new log file using testdisk 7.1-WIP. This way, the disk model will be visible.
If it's really a 4TB disk detected as 3TB, you may have to remove a DCO and/or HPA zone using the manufacturer tools (or hdparm under Linux)
If you need a Linux LiveUSB, see https://www.cgsecurity.org/testdisk.pdf

Nico87
Posts: 4
Joined: 07 Dec 2016, 20:56

Re: Partition: Write error

#3 Post by Nico87 »

The disk does not have a jumper to set a limit to the capacity.
Both disks are strictly identical, same manufacturer, model, size and the other does not have such jumper.
The disk was normally seen as 4TB before the USB file transfer issue and forced power shutdown.

Here is the TestDisk 7.1 Beta log :

Code: Select all

Thu Dec  8 09:45:17 2016
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000615492608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000615492608
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1106847465472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2893697515520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4000647741440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000096137216
Hard disk list
Disk /dev/sda - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:2020202057202d44435734433045313535313031, FW:80.00A80
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364804 255 63, sector size=512 - WDC WD40EZRX-00SPEB0, S/N:2020202057202d44435734433045373239323938, FW:80.00A80
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EARS-00MVWB0, S/N:2020202057202d4443575a413641343231383233, FW:51.0AB51

Partition table type (auto): EFI GPT
Disk /dev/sdb - 3000 GB / 2794 GiB - WDC WD40EZRX-00SPEB0
Partition table type: EFI GPT
New geometry
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63 sector_size=512

Analyse Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860577133 (expected 7814032064)
hdr_lba_start=34
hdr_lba_end=5860577100
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P MS Data                   264192 7814029311 7813765120 [NicoSave]

search_part()
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 16/113/34
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=4000647741440, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           7813765120
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 7814029311 7813765120 [NicoSave]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB
file_pread(5,8,buffer,3519062016(486400/211/20)) lseek err Invalid argument
file_pread(5,1,buffer,3519062016(486400/211/20)) lseek err Invalid argument
file_pread(5,1,buffer,3519062017(486400/211/21)) lseek err Invalid argument
file_pread(5,14,buffer,3519062018(486400/211/22)) lseek err Invalid argument
file_pread(5,3,buffer,3519062032(486400/211/36)) lseek err Invalid argument
file_pread(5,3,buffer,3519062079(486400/212/20)) lseek err Invalid argument
file_pread(5,8,buffer,3519062095(486400/212/36)) lseek err Invalid argument
file_pread(5,11,buffer,3519062142(486400/213/20)) lseek err Invalid argument
file_pread(5,2,buffer,3519064064(486400/243/52)) lseek err Invalid argument

Results
   P MS Data                   264192 7814029311 7813765120 [NicoSave]
     NTFS, blocksize=4096, 4000 GB / 3725 GiB

interface_write()
 1 P MS Data                   264192 7814029311 7813765120 [NicoSave]
write!
file_pwrite(5,32,buffer,3519064736(486400/254/31)) seek err Invalid argument

Partition: Write error

TestDisk exited normally.

Nico87
Posts: 4
Joined: 07 Dec 2016, 20:56

Re: Partition: Write error

#4 Post by Nico87 »

I tried to rebuild the BS, but it fails, it throws me a Write Error again. My opinion on this is that TestDisk tries to write on sectors out of bounds that don't exist, due to the size issue. But even if I correct it with Geometry, it still doesn't work.

Some would say I have physical damage but I disagree, then why TestDisk would be able to list, read and copy all my files and Windows could not ? That is the maximum I can think on the topic, it's beyond my knowledge to repair it and I hope I will get some help here.

Thanks

Nico87
Posts: 4
Joined: 07 Dec 2016, 20:56

Re: Partition: Write error

#5 Post by Nico87 »

up

Locked