cgsecurity.org

I have posted a similar query a year ago and got a very helpful solution to recover my data. Now an year after my new harddisk just 1 year old has got a similar issue. The harddisk is not accessible any more. Not detected in the windows file explorer. Only thing is the USB device connected logo.

Please find the below logs.Also just FYI, last year my old WD was detected as Intel but this one is detected as EFI.


Wed Dec 5 19:24:26 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, September 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive1) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive1) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=111044198400
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=179240435712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=209715200000
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=1000168488960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500325AS, S/N:S2W7YA4Q, FW:D005DEM1
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 25E1, S/N:WX51A87L4C99, FW:1019

Partition table type (auto): EFI GPT
Disk /dev/sdc - 1000 GB / 931 GiB - WD My Passport 25E1
Partition table type: EFI GPT

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953458175 (expected 1953458175)
hdr_lba_start=34
hdr_lba_end=1953458142
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Data 2048 1953456127 1953454080 [My Passport]
Current partition structure:
check_FAT: can't read FAT boot sector
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Data 2048 1953456127 1953454080 [My Passport]
1 P MS Data 2048 1953456127 1953454080 [My Passport]




Additionally,
Microsoft Windows [Version 10.0.17134.407]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\Khanaphoz>chkdsk /f H:
The type of the file system is RAW.
CHKDSK is not available for RAW drives.


The situation I faced last time was a different set of errors and I was advised to clone using DDRescue and try to recover. This time too do I have to follow the same steps?

Run TestDisk. In Advanced, select the partition, Boot, BackupBS, confirm, Quit
If Boot and BackupBS are missing, do you know if you had an exFAT or NTFS partition ?

I tried the Advanced mode but yes as you mentioned there was no Boot and BackupBS option.
Referred to my logs on this forum dated 14Oct2017, this hdd is NTFS format.

Any update pls

In Advanced, try Boot, RebuildBS, List and choose Write and confirm if you have been able to list your files.
If it doesn't work, use PhotoRec.

As mentioned before the only options I see in advanced mode are Type and Image Creation.

Should I clone first to new hdd and then try on the clone if I get these options?

This is what I see in Advanced option.But please note that this is in the problem disk. I have not cloned yet. Should I try cloning ?

Can anyone help please. Are the suggested steps done on a clone or the problem disk.

Still waiting for update. Am afraid whether my hdd would give up if its late.

Sorry for intruding me for a moment.

The steps specified for recovery are done on the problematic disk. Still, if you have the possibility to create a disk image; It is advisable to create it in case there is any complication that may complicate recovery.

Are you sure you followed the steps as they were explained to you?

Here are the steps to follow very well explained: https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step (you must do the section Partition table recovery)

Also if you continue reading, below says NTFS Boot sector recovery how it should appear according to what has been explained here.