cgsecurity.org

Hi All,
I have a WD My Passport 1 TB which is now around 4 years old with lots of valuable data in it personal and work related docs, images, videos, executables,etc. These are very valuable to me. Couple of days back I was accessing some files on the disk when the laptop seemed to get slow, I tried ejecting the hdd by safely remove option. But when it did not seem to work I forcefully pulled it out. But when I plugged it back to access the folders its now not getting detected in the file explorer. I see it as Local Disk K while it used to be displayed with its actual name My Passport. Disk Management does not seem to respond when I access it with hdd connected while the Device Manager rightly shows it as WD My Passport. Tried accessing it using Ubuntu Live USB and its the same not accessible.<br/>

Tried TestDisk as well but it seems to take ages so I had to cancel it. The quick search ran for almost 3 hours but still at 0%. And was from away ever from reaching to even 1%.

Please help. Would be grateful for your responses. Have attached the logs that may help.

TestDisk Log file :


Sat Sep 30 20:28:02 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, July 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=111044198400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=179240435712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=209715200000
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=1000169537536
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500325AS, S/N:S2W7YA4Q, FW:D005DEM1
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 0748, S/N:WXQ1E13NHSY5, FW:1022

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 0748
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
BAD_RS LBA=2048 4294967295
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 P HPFS - NTFS 0 32 33 121597 37 40 1953456128
1 P HPFS - NTFS 0 32 33 121597 37 40 1953456128

Warning: Bad starting sector (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
file_pread(5,16,buffer,2048(0/32/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2048(0/32/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,1953458175(121597/37/40)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

There are bad sectors (see the CRC error messages).
You should clone your disk to a new empty one using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Read the chapters "DDRescue: data recovery from damaged disk" and "Creating a live USB".
Once it's done, remove the original disk, run TestDisk, select the new disk, Advanced, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.

Hi cgrenier,

Does that mean my existing harddisk is damaged and is of no use anymore (cannot be repaired by any means) ?

Can anyone give an answer please ?

The disk can not be repaired and should not be used anymore.

Hi.. I bought a new WD 1TB and went on with ddrescue copy process, please see the below attached result :
Is it safe to continue the restore process on the new disk with this result.

The destination is smaller than the source, it's not ideal.
Remove the original disk and try TestDisk on the clone, Advanced, List and/or "cmd" (right click run as administrator) and "chkdsk /f k:".
What are the results ?

Now my new harddisk (the one bought couple of days back) is behaving exactly the same way as my old one i.e cannot see it in the file explorer. Also attached below the testdisk/chkdsk logs on it :



Thu Oct 12 22:36:22 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, July 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin32 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.

*******************************************************************************************************************************


D:\>chkdsk G:
The type of the file system is NTFS.
Volume label is My Passport.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
354560 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
Error detected in index $SDH for file 9.
Error detected in index $SDH for file 9.
Error detected in index $SII for file 9.
Error detected in index $SII for file 9.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
An index entry from index $O of file 25 is incorrect.
Error detected in index $I30 for file 147.
Error detected in index $I30 for file 147.
Error detected in index $I30 for file 152.
Error detected in index $I30 for file 152.
Error detected in index $I30 for file 190.
Error detected in index $I30 for file 190.
Error detected in index $I30 for file 215.
Error detected in index $I30 for file 215.
Error detected in index $I30 for file 244.
Error detected in index $I30 for file 244.
Error detected in index $I30 for file 316.
Error detected in index $I30 for file 316.
Error detected in index $I30 for file 361.
Error detected in index $I30 for file 361.
Index entry Birthday nd Misc in index $I30 of file 39108 is incorrect.
Index entry BIRTHD~1 in index $I30 of file 39108 is incorrect.
Index entry DSC02203.JPG in index $I30 of file 56474 is incorrect.
Index entry DSC02204.JPG in index $I30 of file 56474 is incorrect.
Index entry DSC02205.JPG in index $I30 of file 56474 is incorrect.
Index entry Jackie Chan - Who Am I in index $I30 of file 163727 is incorrect.
Index entry JACKIE~1 in index $I30 of file 163727 is incorrect.
Index entry Malgudi days in index $I30 of file 163727 is incorrect.
Index entry MALGUD~1 in index $I30 of file 163727 is incorrect.
Index entry Roadrash in index $I30 of file 164423 is incorrect.
Index entry PATCH in index $I30 of file 164755 is incorrect.
Index entry TmpTrk in index $I30 of file 165014 is incorrect.
Index entry Tracks in index $I30 of file 165014 is incorrect.
Index entry TR08B.QPS in index $I30 of file 165687 is incorrect.
Index entry CARS in index $I30 of file 165937 is incorrect.
Index entry COURSES in index $I30 of file 165937 is incorrect.
402538 index entries processed.
Index verification completed.

Errors found. CHKDSK cannot continue in read-only mode.

Should I try the cloning on a 2TB hdd or these errors are not due to that incomplete issue ( 99.99 % copy ).

Run "chkdsk /f G:" and not "chkdsk G:"