TestDisk wrote backuped Partition Tables wrong to disk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Sevion
Posts: 2
Joined: 19 Dec 2017, 19:04

TestDisk wrote backuped Partition Tables wrong to disk

#1 Post by Sevion »

Hello,

4TB-Disk (GPT, 3 partitions, each NTFS) went corrupt, started TestDisk, said first GPT signature corrupt, read alternate GPT signature, was fine.
I backuped the working GPT signature and wrote it to disk.

System Restart.
Checked Computer Management, showed me this nonsense:
Clipboard02.jpg
Clipboard02.jpg (31.64 KiB) Viewed 1525 times
The empty 128 MB are correct, the starting position of (D:) is correct too, the rest is nonsense. I'm saying what TestDisk wrote to the Disk is not correct at all.
(D:) should be around or exactly double the shown size, (I:)'s and (J:)'s Size is correct, but they should be located at the end of the disk. There should be no empty space after them.
This leads to me being able to list the files on (D:) (as the file systems starting position appears correct) but not on (I:) and (J:).

While I do not think it's simply TestDisks fault I wonder what went wrong with writing the backup to the Disk.
Do I have to check for something else before writing the backup to disk? Sector Size or something?

I'm currently unable to come up with a logfile as I'm still running a quick search on the disk.

The green entrys show the content of the backuped data, the white line is just a wrong entry after writing the backup to the disk and can be ignored, I guess.
Clipboard03.jpg
Clipboard03.jpg (48 KiB) Viewed 1525 times
I also tried to set the "unknown"-labeled entries to GPT EFI/NTFS and also to MS Data/NTFS. Setting it to the latter one showed me the above situation from picture 1.

Really hope someone can help with this problem - it's kind of life relevant.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: TestDisk wrote backuped Partition Tables wrong to disk

#2 Post by cgrenier »

The screenshot from Windows Disk Manager looks like it's using PC Intel partition instead of EFI GPT...
Try to rewrite the partition table using testdisk 7.1-WIP. Do you still have the same problem ?

Sevion
Posts: 2
Joined: 19 Dec 2017, 19:04

Re: TestDisk wrote backuped Partition Tables wrong to disk

#3 Post by Sevion »

I first had TestDisk quick scan the drive for about 12 hours and as I was investigating what it found I wanted to check the file systems using "p". On the 2nd partition testdisk silently crashed without any further notice. So all the quick search progress was lost.

Using MiniTool Partition Recovery I was able to get to this current state.
testdisk4.jpg
testdisk4.jpg (19.3 KiB) Viewed 1520 times
The first partition is now fully accessible again and shows it's proper partition size. (I checked a few files and guess their integrity is fine so far...) The other two are not. The 319,53 GB of "empty space" between the shown partitions are of exactly the space the 2nd partition had, but neither TestDisk nor Minitool Partition Recovery was able to find a partition at this space.
Is there any safe way to declare this empty space as a partition again?

The last partition shown at the end also seems to be my 3rd partition, but it's in a RAW state.
Using Recuva I was able to verify that files my 3rd partition are able to be found here.


What does it make it look like it's PC Intel Partition instead of EFI GPT?
Except for my system drive SSD all my hard disks are detected as EFI GPT by TestDisk (currently been using v7.0).
I have 3 identical HardDisks like the one with the issue; 3x WD Red 4TB - all using EFI GPT. I kind of doubt that I've been formating them in different ways as I did format them all using Windows' Disk Management as GPT Disks.
On the other hand I don't want to put my doubts over your knowledge either...

I thought about trying what you said but as I'm currently able to access the first partition and I don't want to risk losing this access again. I'm about to order a new Drive for this to replace but until then I'm unable to backup the whole 3 TB on it.

Thanks for any help given.

// Edit:
After running a quick check via WD Diagnostic Tool, which I had to hard-cancel with power reset after the computer stopped responding after 50 minutes, the windows told me on startup that (R:) requires an chkdsk and that it is NTFS.
Wait, what? (R:) was detected as RAW earlier and now, out of nothing, it's detected as NTFS?!
testdisk5.jpg
testdisk5.jpg (83.24 KiB) Viewed 1516 times
testdisk6.jpg
testdisk6.jpg (45.98 KiB) Viewed 1516 times
Chkdsk had to fix hundreds and hundreds of entries though, so I guess my earlier Idea it's just a damaged GPT-Sector was wrong and it's now a fully damaged hard drive issue?

Do you recommend me to rescue as many files as possible or do you think of a real chance to properly recover the partitions?

I also checked S.M.A.R.T. and compared it to the other two identical drives.
Data of damaged Drive:
C6 Offline Uncorrectable Sector Count
Limit: 0
Value: 100
Worst Value: 253
&
C8 Write Error Rate
Limit: 0
Value 100
Worst Value: 253


Data of both the other two Drives, which are fine:
C6 Offline Uncorrectable Sector Count
Limit: 0
Value: 200
Worst Value: 200
&
C8 Write Error Rate
Limit: 0
Value 200
Worst Value: 200

I wonder how to actually interprete these values, but it seems odd that the problematic drive has different values.

Locked