Need more details for Boot Sector Rebuild

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
warmbeers
Posts: 6
Joined: 15 Jan 2018, 07:34

Need more details for Boot Sector Rebuild

#1 Post by warmbeers »

NTFS 4 TB WD Green turned to RAW, probably due to use in supposed hot swap dock.
After a deep search with testdisk i got some sort of error including "Not an exFAT boot sector. Can't open filesystem. Filesystem seems damaged."
Tried running again and it came up showing "Non partitioned media" with a hint "None" so i tried that.

The first time the partition came up:
Boot Sector
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical

Wasn't sure how to handle as that exact condition was not explained in any documentation i could find.
So i punted and chose Rebuild BS after doing a list and seeing my files.
After the rebuild it listed out 6 items in 2 columns, most of which were different and stated:
"Extrapolated boot sector and current boot sector are different" with choices for Dump, List, Write and Quit

So what does that mean? Did it try to rebuild the boot sector or does that mean the rebuild attempt failed because of the difference? Do I have to choose Write after the rebuild to get the Boot Sector in place? Really rather quite unsure if this is not repairable or if there is something else i can try.

Any help appreciated.
ed

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need more details for Boot Sector Rebuild

#2 Post by cgrenier »

Is your disk setup to use 4k sector or 512 bytes sector ?
Did you had a single NTFS partition ? A single exFAT partition ? Somethething else ?
Please post the testdisk.log file.

warmbeers
Posts: 6
Joined: 15 Jan 2018, 07:34

Re: Need more details for Boot Sector Rebuild

#3 Post by warmbeers »

The drive has been used primarily on 2 different machines but also several others over time. I've never had to consider the 512 VS 4K but when i recently tried to look at the drives on either CPU (msinfo32/Components/Storage/Disks) they all seem to be set for 512 on both CPUs including the problem drive.
It was set up as a single NTFS partition.

Not sure how to post the log files, when i drag them to the attachment tab below they get opened in the browser. If i click on add files and try to add them that way i get:
ERROR
Invalid file extension: testdisk - 1st run.log
The 3rd run of 3 - the shortest- is included via text below.
not sure if that will be helpful or not.
Thanks
ed



Mon Jan 15 01:45:05 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, January 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=235929576960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=264126297600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=49319424
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=21383168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=940040404992
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2000396746752
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000AAKX-083CA1, S/N:2020202057202d44435759414c55364c32353031, FW:19.01H19
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 7071526 85 13, sector size=512 - WDC WD40 EZRX-00SPEB0, FW:80.0
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ASMT 2115, S/N:00000000000000000000
Drive F: - 21 MB / 20 MiB - CHS 5 64 32, sector size=2048 - HL-DT-ST DVD-ROM GDRH20N, FW:0D04

Partition table type (auto): None
Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40 EZRX-00SPEB0
Partition table type: None

Interface Advanced
NTFS at 0/0/1
heads/cylinder 255 (NTFS) != 85 (HD)
sect/track 63 (NTFS) != 13 (HD)
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 976754646
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS at 0/0/1
heads/cylinder 255 (NTFS) != 85 (HD)
sect/track 63 (NTFS) != 13 (HD)
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Info: size boot_sector 976754646, partition 3519069872
P NTFS 0 0 1 7071526 72 2 7814037168 [GODZILLA]
NTFS, blocksize=4096, 4000 GB / 3726 GiB

ntfs_boot_sector
P NTFS 0 0 1 7071526 72 2 7814037168 [GODZILLA]
NTFS, blocksize=4096, 4000 GB / 3726 GiB
NTFS at 0/0/1
heads/cylinder 255 (NTFS) != 85 (HD)
sect/track 63 (NTFS) != 13 (HD)
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Info: size boot_sector 976754646, partition 3519069872
filesystem size 976754646 6675292082131043297
sectors_per_cluster 1 117
mft_lcn 786432 1632288
mftmirr_lcn 2 258344843
clusters_per_mft_record 1 -125
clusters_per_index_record 1 -5
Boot sector
Warning: number of heads/cylinder mismatches 255 (NTFS) != 85 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 13 (HD)
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need more details for Boot Sector Rebuild

#4 Post by cgrenier »

It's very unusual to see an harddisk without a partition table.
Can you try Advanced, Boot, RebuildBS, List ?
If you can see your files, choose Write, confirm, Quit and restart your computer.

warmbeers
Posts: 6
Joined: 15 Jan 2018, 07:34

Re: Need more details for Boot Sector Rebuild

#5 Post by warmbeers »

I ran testdisk
Selected my disk, selected None for the partition type - which showed a single P NTFS partition
Quit to get back to the menu with Advanced
Chose Advanced - Boot - got the warning about mismatches X3 and Backup BS Status: Bad
Chose Rebuild BS - ran for a while showing ####### / ########## but then jumped to the screen with the 2 columns of data for filesystem size, sectors_per_cluster, mft_lcn, mftmirr_lcn, clusters_per_mft_record etc.
I did a screen capture of that screen
tried to List and the program crashed pretty much immediately.
looked at the log, the information at the end had different values than my screen capture.
The end of the log file is below and the stackdump file is below that .

Thanks for your help.
ed

End of the log file for ADVANCED - BOOT - Rebuild BS - List
Info: size boot_sector 976754646, partition 3519069872
filesystem size 976754646 6675292082131043297
sectors_per_cluster 1 117
mft_lcn 786432 1632288
mftmirr_lcn 2 258344843
clusters_per_mft_record 1 -125
clusters_per_index_record 1 -5
Boot sector
Warning: number of heads/cylinder mismatches 255 (NTFS) != 85 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 13 (HD)
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
1 [main] testdisk_win 2476 cygwin_exception::open_stackdumpfile: Dumping stack trace to testdisk_win.exe.stackdump

Stackdump
Exception: STATUS_ACCESS_VIOLATION at eip=0042691A
eax=00000031 ebx=00000000 ecx=0028AC28 edx=00000000 esi=FFFFFFFF edi=800FF060
ebp=800CA638 esp=0028AE40 program=C:\Users\EMS\Downloads\testdisk-7.1-WIP - contains ZIP fldr too\testdisk_win.exe, pid 2476, thread main
cs=0023 ds=002B es=002B fs=0053 gs=002B ss=002B
Stack trace:
Frame Function Args
End of stack trace

warmbeers
Posts: 6
Joined: 15 Jan 2018, 07:34

Re: Need more details for Boot Sector Rebuild

#6 Post by warmbeers »

Is this thing beyond recovery?

Maybe i wasn't clear in my last post, after the rebuild BS attempt, which i think failed (but maybe that is the way it is supposed to work? :? ) trying a list crashed the program.
Still unable to access the data from Win Explorer and drive still shows as RAW in Disk Manager.
Next steps, if any?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Need more details for Boot Sector Rebuild

#7 Post by cgrenier »

Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter).
What is the output ?

warmbeers
Posts: 6
Joined: 15 Jan 2018, 07:34

Re: Need more details for Boot Sector Rebuild

#8 Post by warmbeers »

Responds with:
"The type of the file system is RAW.
CHKDSK is not available for RAW drives"
ed

warmbeers
Posts: 6
Joined: 15 Jan 2018, 07:34

Re: Need more details for Boot Sector Rebuild

#9 Post by warmbeers »

Hoping i can get a bit more detail about the screens as i work thru this fix.
Is there documentation somewhere about the information provided? Apologies if it exists i was unable to locate it.
For example when i get the first screen where the disks are listed the disk i am interested in is listed as:
  • Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40 EZRX-00SPEB0
wondering what the "/dev/sdb" represents and more importantly what is the "3726 GiB"?
Is that maybe the formatted capacity? From what i think i know 4TB should equal 3725.3064 GiB but maybe it's just a rounding error, or does it represent some other info?
Then when i proceed on the Partition Table Type "[None ]" is highlighted with a note at the bottom "None partition table type has been detected". Does testdisk check for a partition table each time you choose proceed, so that landing on None indicates that whatever check it attempted failed, or does it simply return to whatever selection was previously chosen?
If it does the check each time then i am wondering why if i change the selection from [None ] to [Intel ] i first get a result listing the same info as above plus another line including sector size
  • Disk /dev/sdb - 4000 GB / 3726 GiB - WDC WD40 EZRX-00SPEB0
    CHS 7071526 85 13 - sector size=512
Choosing [Advanced ] i get a compressed version of the information above w/o the disk model or sector size and then a table:
  • Partition Start End Size in Sectors
    3 * Sys=2B 1645770 5 1 2138236 20 11 544175136
    2 * Sys=73 1735609 10 3 2228312 31 7 544437093
    1 * HPFS - NTFS 1752279 84 8 3413833 26 7 1836016416
    4 * SpeedStor 2574230 31 2 2574280 9 11 54974
Lots of questions here
  1. Any reason the partition numbers in the first column are out of sequence? Does that indicate anything?
  2. If the test for paritions found None why are these partitions listed here?
  3. If i understand the columns there are 3 for start and 3 for end, with the last col for sector size. Do the larger numbers refer to sector positions or something else and what do the smaller numbers refer to?
  4. All the start and end numbers seem to overlap, what do they actually represent, or do they mean that this drive is really a mess?
Thanks for any information you can provide.
ed

Locked