From Bad to Worse!

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
201pilot
Posts: 7
Joined: 04 Nov 2017, 20:51

From Bad to Worse!

#1 Post by 201pilot »

Hello,
I have really stuffed up somehow big time. I really need help.

To start with I have an external 2 TB Seagate HD that started to fail. In an attempt to see files on this drive I did a number of things such as MS checkdisk /f. Then I ran Teskdisk and spent some time writing a log for boot recovery...however I didn't complete this and aborted at ca 50% after reading that it would be better to first attempt to clone this drive. I loaded Ubantu and Ubantu was able to see a regular file structure from which I could copy to another NTFS 6 TB USB drive. After copying some files successfully I exited Ubantu and restarted Win10. None of the files written to the Win10 drive were visible. I've since read about the inability of NTSF to read Linux files. In any case I repeated this exercise and was going to test some suggestions to view Linux written files in Win10. This is where things have really gone terribly wrong.

I now cannot access the NTFS 6TB drive at all in Win10 or in Ubantu. The drive shows up but without any size and Win10 reports it as corrupted. I ran Testdisk have the following preliminary log. This drive is relatively new and has been functioning perfectly. I have no reason to believe it is failing and I believe all of the 3+ TB of data on the drive are intact. Please advise of the best way that I might rescue this data. I tried EASEUS Data recovery. It certainly can see the data but not with original file names. Such a recovery would be useless to me. Is there any way I might reasonable clone this drive but by not using Ubantu/DDRescue? For some reason I cannot get DDRescue to load properly in Ubantu. I'm completely new to Ubantu and even simple things are strange. Thank you very much for your assistance!



Sat Nov 4 19:45:15 2017
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, October 2017
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 5.4, Cygwin 2005.2
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001174511616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001174511616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249465667584
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000395698176
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 850 EVO mSATA 250GB, S/N:S33GNX0J207013J, FW:EMT41B6Q
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - WD My Book 25DB, S/N:WXL1H16FL2DN, FW:3002

Partition table type (auto): EFI GPT
Disk /dev/sdb - 6001 GB / 5589 GiB - WD My Book 25DB
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63
hdr_size=92
hdr_lba_self=11721043967
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=11721043934
hdr_lba_table=11721043935
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
2 P MS Data 411648 11721023998 11720612351 [Basic data partition]
Bad GPT partition, invalid signature.
Trying alternate GPT
1 P EFI System 40 409639 409600 [EFI System Partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 411648 11721023998 11720612351 [Basic data partition]
2 P MS Data 411648 11721023998 11720612351 [Basic data partition]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
1 P EFI System 40 409639 409600 [EFI System Partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 411648 11721023998 11720612351 [Basic data partition]
2 P MS Data 411648 11721023998 11720612351 [Basic data partition]

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: From Bad to Worse!

#2 Post by cgrenier »

Can you try TestDisk, Advanced, select the big partition, Boot, RebuildBS, List ?
If you can see your files, choose Write, confirm, Quit and restart your computer.
Next step should be to fix the partition table itself: TestDisk, Quick Search and only if the correct partitions are listed, choose Write, confirm, Quit.

201pilot
Posts: 7
Joined: 04 Nov 2017, 20:51

Re: From Bad to Worse!

#3 Post by 201pilot »

Thank you for your help!

I am in the process of trying to rebuild BS. I had to abort when the log file became extremely large. I take it this is expected? The drive is 6 TB with about 3-4TB data. I will need to buy another drive just to store the log file. Will I need a 6 TB drive?

Many thanks.

Locked