cgsecurity.org

Hello everyone,

I'm new to this, but hopeful testdisk can save my files. I have a 3TB WD HD from a NAS (D-Link 323 running Alt-F) that I had formatted as ext4 (complete disk). The NAS stopped working a few days ago and using the drive in a USB enclosure connected to my ubuntu desktop PC, it only sees an empty drive with no partitions.

Can I use testdisk to rebuild the partition? I'm pasting the testdisk.log from a quick analyse, and will try a deep analyse next. I don't think it's reporting a correct FAT32 partition (but this might be an old one). Either way, it's not the one I'm looking for.

As I say, this is all completely new to me so any help would be greatly appreciated! Many thanks in advance!

------------------------------------------------------------------------------

Sat May 27 07:48:28 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.8.0-36-generic (#36~16.04.1-Ubuntu SMP Sun Feb 5 09:39:57 UTC 2017) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.7
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 625142448 sectors
/dev/sda: user_max 625142448 sectors
/dev/sda: native_max 625142448 sectors
/dev/sda: dco 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop1 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop2 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop3 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop4 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop5 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop6 - 0 B - 0 sectors, sector size=512
Warning: can't get size for Disk /dev/loop7 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST9320325ASG, S/N:5VD74QAH, FW:0008APM2
Disk /dev/sdb - 7803 MB / 7441 MiB - CHS 1019 241 62, sector size=512 - Kingston DataTraveler SE9, FW:PMAP
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Mass Storage Device
Disk /dev/loop0 - 1497 MB / 1428 MiB - 2925336 sectors (RO), sector size=512

Partition table type (auto): Intel
Disk /dev/sdc - 3000 GB / 2794 GiB - Mass Storage Device
Partition table type: Intel

Analyse Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 45600 255 63
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
check_FAT: number of bytes per sector mismatches 512 (FAT) != 4096 (HD)
FAT32 at 3/51/49
FAT1 : 32-89428
FAT2 : 89429-178825
start_rootdir : 178826 root cluster : 2
Data : 178826-732515065
sectors : 732515072
cluster_size : 8
no_of_cluster : 91542030 (2 - 91542031)
fat_length 89397 calculated 89397
FAT differs, FAT sectors=0-16/89397
sect/track 32 (FAT) != 63 (HD)

FAT32 at 3/51/49
FAT: cluster=2(0x2), pos=230282
FAT32 LBA 3 51 49 45600 40 8 732515072 [WDTHREE]
FAT32, blocksize=32768, 3000 GB / 2794 GiB

Results
* FAT32 LBA 3 51 49 45600 40 8 732515072 [WDTHREE]
FAT32, blocksize=32768, 3000 GB / 2794 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 5860120576 linear /dev/sdc 411648" | dmsetup create test0

interface_write()
1 * FAT32 LBA 3 51 49 45600 40 8 732515072 [WDTHREE]

When testdisk lists the partition, press 'p'. Can you see your files ?
After selecting the disk, try EGI GPT instead of PC Intel. It may give better results.