Partition recovery, wrong number of partitions

[aldowski]

Hi;
Problem related to Seagate 3TB HD. I used the HD with USB 3.0 adapter to SATA. It was connected to an USB Hub, then to laptop.
After some time, on the USB Hub there was red alert light, I disconnected the HD, but I was not able to see anything from it.
The adapter USB 3.0 to SATA was broken, not working at all after that, but it is not big issue.
Problem is related to the data on the HD, more specific, partition table / file system.

I downloaded, started the Testdisk, used the recommended parameters. New log file created, as I remember I saved existing config every time I was changing something, before write.
It looks that at the beginning it found 2+1 partitions. Then, after 2-3 checks, it shows only one. As mentioned, the HD is 3TB, There should be 2 partitions. Now I can see that Testdisk recognized only 1 partition.
Is there any possibility to retrieve previous state(s)? As I saved few times, also there should be some in existing log, I hope.

I have 2X bigger HD (6TB) now for the purpose of copying data from the mentioned 3TB HD with broken Partition table.
Would there be a possibility to rollback the status based on Testdisk internal temporary backups (step back) or log, please, so I would be able to go thru process again?

Thank you.

[cgrenier]

Under Windows, you can read the testdisk.log file with wordpad or notepad++.
It's possible to manually add a partition ('a' key after Analyse, Quick Search and/or Deeper Search) and enter the values corresponding to a previous partition.
Set the partition as P(rimary), *(botable) or L(ogical). On next screen, choose Write, confirm, Quit and restart your computer.

[aldowski]

Hi;

thanks a lot for response.

The disc I have issues with is Seagate 3TB ST3000DM001. It was being connected to the Laptop all the time with the USB->SATA adapter.

I even have screenshot with previous (2 partitions) state with Teskdisk details (those details being found with Testdisk on 1st attempt of recovery), but later (next attempt) it recognized only 1 single huge partition 3TB.

The issue may be also related to the MBR or GPT. I cannot be sure which one was used on the disk before it went broken. I saved (write) newly status, hope there will be a possibility to recover that.

I will try steps you suggested, just to ask should I change MBR to GPT and vice versa, will that make any difference? In this case it is connected thru mentioned adapter, should the HD be disconnected, shut down itself, or it would be better for any reason to shut down Laptop itself?

Thank you.

[recuperation]

Hello aldowski,

it is strange that you are continuing to use an adapter that you described as broken in your previous post.
I guess disconnecting the adapter would work, but restarting the computer is the safest way.

In this case it is connected thru mentioned adapter, should the HD be disconnected, shut down itself, or it would be better for any reason to shut down Laptop itself?

[aldowski]

Hi;

I bought 2 new SATA->USB3 adapters (more expensive, hopefully better quality) and I am using them (having both source and destination HDDs connected to Laptop).
Old one is, as I said, broken, cannot be used at all. It was misunderstanding, I wanted to say that I am using the same way to connect the HDD to the Laptop SATA->USB3.
Also, I bought 2X SATA HDD 3.5" docking station with USB3 cable.

Now, question is, if Testdisk user does the "Write" command, does that mean that the Backup boot sector which is being used for recovery, is overwritten? I did "Write" command 2 times, as I said, I still have screenshot from the first attempt of Testdisk to recognize partitions, so I may use it. I will check log, as suggested, also I will try to clone the HDD, just in case.

Thanks for suggestions.

[recuperation]

I bought 2 new SATA->USB3 adapters (more expensive, hopefully better quality) and I am using them (having both source and destination HDDs connected to Laptop).

This is a bad idea, from a power supply viewpoint. The docking station is OK.

Now, question is, if Testdisk user does the "Write" command, does that mean that the Backup boot sector which is being used for recovery, is overwritten? I did "Write" command 2 times, as I said, I still have screenshot from the first attempt of Testdisk to recognize partitions, so I may use it. I will check log, as suggested, also I will try to clone the HDD, just in case.

I do not understand where you executed a "write" command.
You are confusing something: The boot sector is a structure within a partition which is probably OK.
Your are expecting 2 partitions. Have Testdisk (deep search) them and rewrite the partition table.

[aldowski]

Hi;

OK, will try the Deeper search option.

Related to the SATA->USB (those new adapters I bought), both do have dedicated power supplies, adapters (a must for 3.5", in case of 2.5' it is not a must but it is better to have own, dedicated power supply).

Anyway, I will continue using only the Box, docking station, not those adapters.

After reading the tutorial again, checking all details in every step, I saw that I did not use the "P" option (after partition searching), to see existing (found) files, folders tree for chosen partition, I did realize that later. If there was a list of files folders, not broken one, but with structure being correctly listed, it should be good sign of success.

I used "Write" at the same window, screen when the Deeper search is available, when I saw the structure (only partition structure) which looks as expected.

I'll try to go thru procedure again, with Deeper search, for 3TB it may be long process. Will do that during next day or weekend.

Thanks for suggestion.

[aldowski]

Hi;

At the start, I got result from Testdisk:

.

It is visible that it shows [New Volume] names of both partitions.

I did not go to use option "P" for file listing, I just went thru Analyze process, then I saved (Write) results.

I saw later that the found partitions were different, somehow not showing the correct values.

Then I manually tried to add two partitions, having the same details from the previous image.

I got this:


Now, there is no name [New Volume] for the first partition, files cannot be listed using "P".

Second partition still has the name, files can be listed.

Next two images are showing the status when first and second partition are chosen at the list:





First partition has just GB / GiB info, second, which can be listed has info about the type = NTFS and blocksize = 4096.

Few hours ago I started copying data from the second partition to the other, large HDD, it has ~95000 files copied already and 0 failed.

Have to say that I already tried to recover the first partition using deep search, still did not get first partition available.

Have to ask, please, is it possible to add manually the type NTFS and blocksize=4096 for the first partition, is there anything else needed, any suggestion what can be done now?

Would that somehow resolve the issue or is there something else to be changed, so the first partition would be visible again?

Thank you.

[recuperation]

Have to ask, please, is it possible to add manually the type NTFS and blocksize=4096 for the first partition, is there anything else needed, any suggestion what can be done now?

I don't know where to add this information manually. The fact that testdisk does not show any files suggests that either the NTFS boot sector is broken despite appearing valid or that the boot sector points to location with broken information, p.e. to a dammaged MFT.
http://www.ntfs.com/ntfs-partition-boot-sector.htm

Would that somehow resolve the issue or is there something else to be changed, so the first partition would be visible again?

No.
1. You can run Photorec now.
OR
2. You could purchase professional help at companies like Kroll Ontrack etc.
OR
3. You can either learn everything about NTFS and try to examine the broken file system.

=> You either invest lots of money or lots of time - unfortunately.

[aldowski]

Hi;

Thanks for reply.

I would say that I still have hope the Testdisk may somehow resolve the problem.

Main reason is that - I successfully copied all data from second 1TB partition to another HDD, it required ~10 hours but it looks well, great.

At the moment, I am trying to recall what exactly I did when the 1st partition, 2TB became unreachable. As visible on screens, it was reachable, the name was visible as for the second partition.

When I start Testdisk and choose this 3TB HDD, I got the message: "Hint: EFI GPT partition table type has been detected." I cannot be sure if I did not replace existing Intel / PC Partition somehow with EFI GPT type and after that wrote that, so that created the problem. Anyway, I must use / choose Intel/PC to get list of existing partitions (including mentioned one which looks good, from where I restored files successfully), otherwise I am getting partition named "MS Data" which does not looks correct.

I must ask related to this, cause, I saw some discussions on this forum related to the similar problems (getting "MS Data" partition, EFI GPT related, with nothing listed), what I may do next. I checked the ntfs.com site, it has lot of information, suggestions, still, as mentioned, I hope Testdisk may find 1st partition and it's filesystem.

Is there a way to recover the partition type? I tried to rebuild / recover boot, MBR, MFT, it found some records, but no files are being listed.

Also, as visible at one of screenshots, both partitions are named "[New Volume]", would that make any good if I would try to search complete HDD for the exact string "[New Volume]", with expectation that there will be 2 results? If yes, which search software would be suggested to do this on the HDD not accessible by Windows?

Thank you.