Page 1 of 1

3TB usb 3.0 went crazy

Posted: 28 Dec 2016, 14:43
by Raflesia
Greetings.
i have the following problem.
a 3TB external USB 3.0 HD went crazy; none of my pc couldn't recognize it.
So i remove it from its case and i connected it to an USB/SATA adapter to see if the problems were in the USB 3.0 formware of its case.
Well, no luck, in addiction W7 reported HD was size mismatched.
So i connected it to a spare pc using a SATA bus, then booted using a parted magic live cd and the i ran into TESTDISK.
so this is what's happened.

first of all i selected the DRIVE, the one in red.

Sun Mar 17 04:37:23 2002
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.8.2-pmagic64 (#1 SMP Sun Oct 16 18:22:46 CDT 2016) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.43.3, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: 20140608, curses lib: ncurses 5.9
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 5860533168 sectors
/dev/sda: user_max 5860533168 sectors
/dev/sda: native_max 5860533168 sectors
/dev/sda: dco 5860533168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - ST3000DM003-1F216N, S/N:W300W18V, FW:CC54
Disk /dev/sdb - 62 GB / 57 GiB - CHS 59232 64 32, sector size=512 - SanDisk Ultra USB 3.0, FW:1.00
Disk /dev/sr1 - 563 MB / 537 MiB - 274944 sectors (RO), sector size=2048 - SONY DVD RW AW-G170A, FW:1.71
then i choose INTEL/PC partition
Partition table type (auto): Intel
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM003-1F216N
Partition table type: Intel
and then Analyze
Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 2 45600 1 1 732564000
1 * HPFS - NTFS 0 1 2 45600 1 1 732564000
so we can see in the log, the 2 entries about partition, but both are wrong.
Originally, this HD had a single NTFS partition of 3TB. Logically was a GPT one.

so i started a QUICK SEARCH
search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
i aborted since previous scan led to no result.

the i did as follow,
go back to DISK selection
Disk /dev/sda - 3000 GB / 2794 GiB - ST3000DM003-1F216N
Partition table type: None
but i specified NONE as partition table type.
then Advanced..
Interface Advanced
P Unknown 0 0 1 364801 80 63 5860533168
Change partition type:
P NTFS 0 0 1 364801 80 63 5860533168
where i changed manually partition type from NONE to NTFS
then QUIT, ANALYSE and ... magically....
Analyse Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
Current partition structure:
P Unknown 0 0 1 364801 80 63 5860533168

search_part()
Disk /dev/sda - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 0/8/9
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732564000
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS part_offset=262144, part_size=3000582144000, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/8/9
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732564000
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS 0 8 9 364800 8 8 5860512000 [_V_]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Search for partition aborted
now, please look carefully the line in red.
Testdisk retrieved the original label of the disk that was _V_
and the entire line was in a nicely green background color.
So maybe i was at the end;
P command, listed MY FILES !!!!!! HURRAH !!!! but i wanted to fix this mess then i hit ENTER...
but.....
damn...
Results
P NTFS 0 8 9 364800 8 8 5860512000 [_V_]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 5860512000 linear /dev/sda 512" | dmsetup create test0

interface_write()
P NTFS 0 8 9 364800 8 8 5860512000 [_V_]

Write isn't available because the partition table type "None" has been selected.

TestDisk exited normally.
and i'm stucked here...
how can i fix my hard disk ???
really don't know what else i could do.

Please, any advice will be appreciated..

Bye,
Reflesia

Re: 3TB usb 3.0 went crazy

Posted: 29 Dec 2016, 07:14
by cgrenier
It looks like your disk was using 4096 bytes sector and is now using 512 bytes sector.

Try TestDisk, sda, EFI GPT, Analyse, Quick Search.
Is your partition found ?

Re: 3TB usb 3.0 went crazy

Posted: 29 Dec 2016, 15:41
by Raflesia
Thanks for your kind and fast reply.
Well i did as u suggested and... voila !!! partition and DATA back again.
Thanks so much... how can i repay you ?

Best.
Raf.
p.s.
Happy New Year 2017

p.p.s
Do you have any ideas about how this mess has happened ?
crappy HW, bad USB 3.0, SW bugs ??
i have always used this external disk in a religious manner..but without any symptoms..it went crazy

Re: 3TB usb 3.0 went crazy

Posted: 29 Dec 2016, 18:24
by cgrenier
I don't really know why this problem occur but you can check if your computer applied updates prior to the problem...

How to repay me ? There is no obligation but if English is your native language, you can help by copy editing https://www.cgsecurity.org/testdisk.pdf (source: https://www.cgsecurity.org/testdisk_doc.zip )
Donations are otherwise welcome: https://www.cgsecurity.org/wiki/Donation

Re: 3TB usb 3.0 went crazy

Posted: 12 Jan 2017, 13:49
by Raflesia
Hi Cristophe, and Happy New Year.
well, i have completely backed-up all my data, even if the hard disk is fully usable under the parted disk->testdisk.
I have a new USB 3.0 external BOX, so i connected the HD in it and tried to see it under windows.
Well, absolutely no luck; the device is detected, but disk management reports it as a RAW partition.
So i am here wondering if there is a way to revert back the RAW partition to the NTFS it was once without any loss of data.
Testdisk reports my HD, a Seagate Barracuda 3.00TB, has an EFI GPT partition type; shouln't it be an Intel/PC partition ?
Any chances or better to repartion/reformat under WIN ?
Thanks in advance.
Raf.

Re: 3TB usb 3.0 went crazy

Posted: 13 Jan 2017, 12:41
by Raflesia
***UPDATE***
Really i don't know what's happened, but gparted reported and advised me to perform chkdsk /f
so i connected the HD inside its new BOX to my win/pc..
then i issued a chkdsk x: /f/v command...and keeping fingers crossed.....after a few minutes all went ok :) :o
HD is fully recovered and all its content seems to be ok; there are several large RAR archives, circa 80Gb each and testing them was succesful.
So i think my problem is solved; but anyway, without backup made possible by TESTDISK, i never tried a chkdsk !!!!!
So Christophe, thanks again.
All the best
Raf.

Re: 3TB usb 3.0 went crazy

Posted: 17 Jan 2017, 21:03
by cgrenier
Perfect! Happy ending ;-)