Still RAW after writing partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kkangjiie
Posts: 4
Joined: 24 Sep 2018, 18:43

Still RAW after writing partition

#1 Post by kkangjiie »

Hi, I have a WD elements 3.0TB that recently has failed to power on. Thus, I removed the HDD and connect it by SATA straight to the motherboard. However, it has difficulty reading the drive and Windows keep prompting me to format it.

I have went through the process of analysing, searching and writing a partition (with my files listed inside) but it is still showing as RAW and i'm kinda stucked with the sector size error:

Image

Also, not entirely sure if it's correct to use EFI GPT! should I be using Intel instead?

Code: Select all

Tue Sep 25 01:43:21 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, June 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=5000981077504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999626375168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=240054697984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4000650887168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=5000845590528
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=3000589352960
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung SSD 860 EVO 1TB, S/N:S3Z9NB0K612711X, FW:RVT01B6Q
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WDC WD40EFRX-68WT0N0, S/N:WD-WMC4E0010003, FW:80.00A80
Disk /dev/sdc - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - INTEL SSDSC2BW240A4, S/N:BTDA333507F32403GN, FW:DC32
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512 - WDC WD30EZRX-00MMMB0, S/N:WD-WCAWZ1591984, FW:80.00A80
Disk /dev/sde - 5000 GB / 4657 GiB - CHS 608001 255 63, sector size=512 - Seagate BUP BK, S/N:NA9FLQJ0, FW:0304

Partition table type (auto): EFI GPT
Disk /dev/sdd - 3000 GB / 2794 GiB - WDC WD30EZRX-00MMMB0
Partition table type: EFI GPT

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
 1 P MS Data                     2048 5860528127 5860526080 [DRAMA]

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           732565760
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               366282879
clusters_per_mft_record   1
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=3000589352960, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size           732565760
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               366282879
clusters_per_mft_record   1
clusters_per_index_record 1
     MS Data                     2048 5860528127 5860526080 [DRAMA]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(7,1,buffer,1565565872(364801/81/1)) ReadFile Incorrect function.

file_pread(7,1,buffer,1565565873(364801/81/2)) lseek err Invalid argument
file_pread(7,1,buffer,1565565874(364801/81/3)) lseek err Invalid argument
file_pread(7,1,buffer,1565565875(364801/81/4)) lseek err Invalid argument
file_pread(7,1,buffer,1565565876(364801/81/5)) lseek err Invalid argument
file_pread(7,1,buffer,1565565877(364801/81/6)) lseek err Invalid argument
file_pread(7,1,buffer,1565565878(364801/81/7)) lseek err Invalid argument
file_pread(7,1,buffer,1565565879(364801/81/8)) lseek err Invalid argument
file_pread(7,1,buffer,1565565880(364801/81/9)) lseek err Invalid argument
and the error just keeps continue going on... :(

Please help!

Regards,
KC

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Still RAW after writing partition

#2 Post by cgrenier »

The partition table is OK. You need to check the filesystem, as described in https://www.cgsecurity.org/testdisk.pdf run "cmd" (right click Run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter).

kkangjiie
Posts: 4
Joined: 24 Sep 2018, 18:43

Re: Still RAW after writing partition

#3 Post by kkangjiie »

Maybe I should add this might situation might have happened after a power surge. (can't confirm since I did not use the external HDD for awhile but that was the only event that I can recall that might have killed the external HDD board)

Just an update also I have been running the deep search for past 2 days and still running at the moment:

This is what i am seeing and it definitely looks weird (to me at least)

Image

Chkdsk returns this btw:

Code: Select all

The type of the file system is RAW.
CHKDSK is not available for RAW drives.
and this is the disk management screen:
Image

Disk 3 is the drive with problem

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Still RAW after writing partition

#4 Post by cgrenier »

No need to search the lost partition (Quick Search/Deeper Search), the partition is not deleted.
Try TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer.

kkangjiie
Posts: 4
Joined: 24 Sep 2018, 18:43

Re: Still RAW after writing partition

#5 Post by kkangjiie »

Hi, thanks for the quick reply. Tried that, but results is not good:
Image

List gave me the following error:
Image

So I didn't write it. This is the 'Boot' screen btw:
Image
Error backup sector?

Anyway, this was the Deep Search result that I quitted:
Image
Image
The first MS Data that was found using the backup sector gave me the same filesystem error and cannot list files. I can see my files in the second MS Data.

What can I do next?

kkangjiie
Posts: 4
Joined: 24 Sep 2018, 18:43

Re: Still RAW after writing partition

#6 Post by kkangjiie »

Hi, am I still able to rescue my disk on my own or do I have pay to engage the pros now?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Still RAW after writing partition

#7 Post by cgrenier »

If TestDisk can list your files, copy them!
It may work when running TestDisk, Advanced, Boot, List.

Locked