cgsecurity.org

Hello Team,

I have a help request for the following issue: I have a 8T USB3 attached SeaGate HDD which was accidentally formatted to ext4 from NTFS.
(The format to ext4 was canceled partway through, when I realized the error.)

I hope that the folder/file structure can recovered.

I have not any success up to this point.

I've attached the text for your information:

Sat Jan 28 09:52:04 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=8001563221504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=8001563221504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=256052934144
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=13630439424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=287437750272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=199034404864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=163213198848
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=322307596800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=14583421440
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 61281 253 63, sector size=512 - Hitachi HDS721050CLA362, S/N:202020202020504a35353037464839324e4b505a, FW:JP2OA3MA
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31253 254 63, sector size=512 - OCZ-AGILITY4, S/N:434f2d5a4f5732523555483134564d3034303837, FW:1.5.2
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HDP725050GLA360, S/N:20202020202045473541343346523233594c4148, FW:GM4OA57A
Disk /dev/sde - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - Seagate Backup+ Hub BK, S/N:NA8TFQN1, FW:D781

Partition table type (auto): EFI GPT
Disk /dev/sde - 8001 GB / 7452 GiB - Seagate Backup+ Hub BK
Partition table type: EFI GPT

Analyse Disk /dev/sde - 8001 GB / 7452 GiB - CHS 972801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15628053166 (expected 15628053166)
hdr_lba_start=34
hdr_lba_end=15628053133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]

search_part()
Disk /dev/sde - 8001 GB / 7452 GiB - CHS 972801 255 63

recover_EXT2: s_block_group_nr=0/59616, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=32768
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1953505536
recover_EXT2: part_size 15628044288
MS Data 2048 15628046335 15628044288 [Disk 3]
ext4 blocksize=4096 Large_file Sparse_SB, 8001 GB / 7452 GiB
file_pread(7,1,buffer,15628053168(972801/81/1)) lseek err Invalid argument
file_pread(7,1,buffer,15628053169(972801/81/2)) lseek err Invalid argument
file_pread(7,1,buffer,15628053170(972801/81/3)) lseek err Invalid argument
file_pread(7,1,buffer,15628053171(972801/81/4)) lseek err Invalid argument
file_pread(7,1,buffer,15628053172(972801/81/5)) lseek err Invalid argument
file_pread(7,1,buffer,15628053173(972801/81/6)) lseek err Invalid argument
file_pread(7,1,buffer,15628053174(972801/81/7)) lseek err Invalid argument
............+40 more pages of the previous errs

Thank you for your consideration,
Daniel

Try Advanced, Type, force the partition type to MS Data and next to NTFS, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer

Yes Hi,

Thank you for your response cgrenier,
I have taken the recommended steps and have achieved the following result: (I believe I did the steps twice)
Also I believe the Seagate drive was in a GPT structure not MBR. Not sure if this will have an effect on the approach to take.

(My over-all goal is to recover my flac / mp3 / aac files. Preferably with a visual of the folder/file structure.)


Tue Jan 31 18:47:02 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=8001563221504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=8001563221504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=256052934144
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=13630439424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=287437750272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=199034404864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=163213198848
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=322307596800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=14583421440
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 61281 253 63, sector size=512 - Hitachi HDS721050CLA362, S/N:202020202020504a35353037464839324e4b505a, FW:JP2OA3MA
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31253 254 63, sector size=512 - OCZ-AGILITY4, S/N:434f2d5a4f5732523555483134564d3034303837, FW:1.5.2
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Hitachi HDP725050GLA360, S/N:20202020202045473541343346523233594c4148, FW:GM4OA57A
Disk /dev/sde - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - Seagate Backup+ Hub BK, S/N:NA8TFQN1, FW:D781

Partition table type (auto): EFI GPT
Disk /dev/sde - 8001 GB / 7452 GiB - Seagate Backup+ Hub BK
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15628053166 (expected 15628053166)
hdr_lba_start=34
hdr_lba_end=15628053133
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
gpt_change_part_type
Change partition type:
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
Change partition type:
1 P NTFS 2048 2743144447 2743142400 [Basic data partition]

ntfs_boot_sector
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
filesystem size 1 17715039833180749029
sectors_per_cluster 0 5
mft_lcn 0 17213375074490341514
mftmirr_lcn 0 5504432664171664874
clusters_per_mft_record 0 77
clusters_per_index_record 0 27
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 1358076047
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 4
ntfs_find_mft: mftmirr_lcn 31256461
ntfs_find_mft: mft_record_size 1024

mft at 1361894068
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1361897173
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1361900262
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1361903367
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1361906455
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1361909560
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1364239937
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1364243042
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1447672387
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 4
ntfs_find_mft: mftmirr_lcn 31256461
ntfs_find_mft: mft_record_size 1024

Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P MS Data 2048 2743144447 2743142400 [Basic data partition]
filesystem size 1 17715039833180749029
sectors_per_cluster 0 5
mft_lcn 0 17213375074490341514
mftmirr_lcn 0 5504432664171664874
clusters_per_mft_record 0 77
clusters_per_index_record 0 27
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

DanielD