External HDD - Seagate backup plus, no partition info. Topic is solved

[Jayce]

Hi all, I've tried quite a few Testdisk guides/other forum posts, but at this point I'm out of ideas, I suspect the disk is probably too far gone, but I thought I'd ask in case anyone has any further advice/steps to try.

Background: A friend has a 1TB Seagate backup plus that had stopped working and just made a beeping noise on powerup. I worked out it was likely a stuck head on the platter and with some careful encouragement got it off the platter and the disk spinning again. I didn't expect it to be recoverable, but at this point I was slightly shocked it was spinning so I just plugged the SATA cable from an external caddy straight into the powered up disk. I was actually able to read the entire structure, and very slowly copy off a lot of the files.
This was with disk connected via USB, attached to an external caddy.

At some point windows reported a cyclic redundancy check and the drive stopped reading. At this point I turned to TestDisk; the drive no longer shows up in Windows (although occasionally it will), although it can be seen by TestDisk/Photorec. I can't currenly attach/scan the disk with CrystalDisk.
With the disk in the caddy, the USB connection will be lost from time to time while attempting to run chkdsk/TestDisk, so I've now connected it straight to the motherboard with a SATA cable.

Partition search fails to find any partion, as does the deeper search; it creates a very large (~2GB) log file, with most of the lines reading "Readfile The specified network resource or device is no longer available):

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM 024 HN-M101M, S/N:2SPT9JCD465410, FW:2AR1

Partition table type defaults to Intel
Disk /dev/sdd - 1000 GB / 931 GiB - ST1000LM 024 HN-M101M
Partition table type: Intel

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
file_pread(7,16,buffer,32(0/0/33)) ReadFile The specified network resource or device is no longer available.
file_pread(7,3,buffer,48(0/0/49)) ReadFile The specified network resource or device is no longer available.
etc...

Is the disk too far damaged to be read at this point? I was initially surprised to have recovered/be able to read so much data, so I assume it's still roughly in tact on the disk, although connectivity seems to be the current issue.

Any advice greatly appreciated.

[cgrenier]

Try to clone the disk using ddrescue from a Linux LiveUSB. How to create a the LivsUSB and how to use ddrescue are described in https://www.cgsecurity.org/testdisk.pdf
The disk cloning will only work if the head is not stuck on the platter (again).

[Jayce]

Many thanks for the advice, I'll be sure to try that as soon as I can. Also thanks for taking time to reply, greatly appreciated.

By attaching via the USB caddy again, I did manage to get windows to see the disk; although CrystalDisk was unable to report any information.

Running qPhotoRec on the drive created a log file ~360MB, which was mainly "file_win32_pread(276,897,buffer,4612(0/73/14)) read err: read after end of file":
It would be "PhysicalDrive3" in the below output:

Sun May 07 13:55:43 2017
PhotoRec 7.1-WIP, Data Recovery Utility, April 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
ext2fs lib: none, ntfs lib: 10:0:0, ewf lib: 20140608, libjpeg: libjpeg-turbo-1.3.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=80026361856
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=640140967936
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=79919316992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=640137822208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=426704371712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=73400320000
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=104857600
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 80 GB / 74 GiB (RO) - INTEL SS DSA2M080G2GC
Geometry from i386 MBR: head=255 sector=63
No partition 0 0 1 9729 80 63 156301488 [Whole disk]
1 * HPFS - NTFS 0 32 33 12 223 19 204800 [System Reserved]
NTFS, blocksize=4096, 104 MB / 100 MiB
2 P HPFS - NTFS 12 223 20 9729 45 44 156092416
NTFS, blocksize=4096, 79 GB / 74 GiB
Partition table type defaults to None
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB (RO) - ST1000LM 024 HN-M101MBB
P Unknown 0 0 1 121601 80 63 1953525168
P Unknown 0 0 1 121601 80 63 1953525168
706 first-level signatures enabled
file_win32_pread(276,897,buffer,4612(0/73/14)) read err: read after end of file
file_win32_pread(276,1,buffer,4612(0/73/14)) read err: read after end of file
file_win32_pread(276,1024,buffer,5382(0/85/28)) read err: read after end of file
file_win32_pread(276,897,buffer,6406(0/101/44)) read err: read after end of file
file_win32_pread(276,897,buffer,7303(0/115/59)) read err: read after end of file
etc.

I'll try the advice you suggested.
Many thanks again.

[Jayce]

Hi, just as a followup rather than leave a a thread with no resolution, the I believe the disk suffered further mechanical issues (likely similar to the first), it makes a few read sounds then spins down. I'm reasonably sure it's a professional recovery job at this point.

Many thanks for the time/help.