WD turned RAW
Posted: 04 Oct 2017, 09:17
Hi all,
I couldn't access my 5-year-old WD My Passport 1 TB after my move so I tried chkdsk and TestDisk...
Here's my log file:
Wed Oct 4 12:38:59 2017
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=118113972224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=882086478336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=53694595584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=223349220864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=223061336064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=1000169537536
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA DT01ACA050, S/N:Z3H2XHDKS, FW:MS1OA750
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-60WN4A0, S/N:WD-WCC6Y3ATTZN3, FW:01.01A01
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 0740, S/N:WX71A91X8978, FW:1003
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 0740
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Change partition type:
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953456128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
2 [main] testdisk_win 2640 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump
And dump file:
Exception: STATUS_ACCESS_VIOLATION at rip=0010042188A
rax=0000000000000001 rbx=00000006000CCB30 rcx=0000000600018040
rdx=0000000000000000 rsi=0000000000000050 rdi=0000000000000000
r8 =00000000FFFFA80C r9 =0000000180152440 r10=0000000100000000
r11=0000000100405E13 r12=00000006000CC940 r13=0000000425FA7000
r14=00000000FFFFAB10 r15=0000000000000000
rbp=00000006000CDEB0 rsp=00000000FFFFAAD0
program=G:\testdisk-7.1-WIP\testdisk_win.exe, pid 2640, thread main
cs=0033 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
006000CDEB0 0010042188A (00400000008, 00100485E66, 00100000009, 000FFFFB410)
000FFFFB210 0010043401B (7FF82CEEFD73, 00000000000, 00000000000, 000FFFFB0A0)
000FFFFB210 001004358B3 (00425FA7000, 000004A7F54, 8080808000000000, 000FFFFCB78)
006000CC940 0010043CE8F (01000000018, 00100000017, 00000000000, 000FFFFCB78)
000FFFFCB78 0010041C679 (00100000001, 00000000000, 00000000000, 000FFFFCB78)
00000000001 0010043AA5C (00000000001, 00000000013, 00000000000, 000FFFFCB78)
00000000002 0010043B1B9 (00000000000, 000FFFFC7CC, 00100000000, 00000000000)
00000000001 00100477377 (00000000020, FF0700010302FF00, 00180047B61, 000FFFFD680)
000FFFFCCC0 00180047BD2 (00000000000, 00000000000, 00000000000, 00000000000)
00000000000 0018004591C (00000000000, 00000000000, 00000000000, 00000000000)
000FFFFFFF0 001800459B4 (00000000000, 00000000000, 00000000000, 00000000000)
End of stack trace
Anyone have any idea what am I doinging wrong here? Thx.
I couldn't access my 5-year-old WD My Passport 1 TB after my move so I tried chkdsk and TestDisk...
Here's my log file:
Wed Oct 4 12:38:59 2017
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, May 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=118113972224
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=882086478336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=53694595584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=223349220864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=223061336064
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=1000169537536
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - TOSHIBA DT01ACA050, S/N:Z3H2XHDKS, FW:MS1OA750
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-60WN4A0, S/N:WD-WCC6Y3ATTZN3, FW:01.01A01
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 0740, S/N:WX71A91X8978, FW:1003
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 0740
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Change partition type:
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121597 37 40 1953456128 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953456128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK
Backup boot sector
Status: OK
Sectors are identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
2 [main] testdisk_win 2640 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump
And dump file:
Exception: STATUS_ACCESS_VIOLATION at rip=0010042188A
rax=0000000000000001 rbx=00000006000CCB30 rcx=0000000600018040
rdx=0000000000000000 rsi=0000000000000050 rdi=0000000000000000
r8 =00000000FFFFA80C r9 =0000000180152440 r10=0000000100000000
r11=0000000100405E13 r12=00000006000CC940 r13=0000000425FA7000
r14=00000000FFFFAB10 r15=0000000000000000
rbp=00000006000CDEB0 rsp=00000000FFFFAAD0
program=G:\testdisk-7.1-WIP\testdisk_win.exe, pid 2640, thread main
cs=0033 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
006000CDEB0 0010042188A (00400000008, 00100485E66, 00100000009, 000FFFFB410)
000FFFFB210 0010043401B (7FF82CEEFD73, 00000000000, 00000000000, 000FFFFB0A0)
000FFFFB210 001004358B3 (00425FA7000, 000004A7F54, 8080808000000000, 000FFFFCB78)
006000CC940 0010043CE8F (01000000018, 00100000017, 00000000000, 000FFFFCB78)
000FFFFCB78 0010041C679 (00100000001, 00000000000, 00000000000, 000FFFFCB78)
00000000001 0010043AA5C (00000000001, 00000000013, 00000000000, 000FFFFCB78)
00000000002 0010043B1B9 (00000000000, 000FFFFC7CC, 00100000000, 00000000000)
00000000001 00100477377 (00000000020, FF0700010302FF00, 00180047B61, 000FFFFD680)
000FFFFCCC0 00180047BD2 (00000000000, 00000000000, 00000000000, 00000000000)
00000000000 0018004591C (00000000000, 00000000000, 00000000000, 00000000000)
000FFFFFFF0 001800459B4 (00000000000, 00000000000, 00000000000, 00000000000)
End of stack trace
Anyone have any idea what am I doinging wrong here? Thx.