cgsecurity.org

Posted: **19 Sep 2019, 19:52**

I'm trying to recover a partition for a corrupted hard drive using TestDisk. I chose (EFI GPT) table type as it was suggested by TestDisk. However, the disk analyse is too slow or even stuck. It's been over 24 hours and it shows 02% (3496/121600) and been like this for a while now.

Does this mean there are bad sectors? Should I choose different table type? Any help would be appreciated.

Code: Select all



Wed Sep 18 16:13:14 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999176536064
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZEX-00RKKA0, S/N:WD-WMC1S0691519, FW:80.00A80
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM 014-1EJ164-SSHD, S/N:77735CF3, FW:HPRE

Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - ST1000LM 014-1EJ164-SSHD
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
     MS Data                     2048       2048          1
     ReFS, 512 B

LVM magic value at 2056/225/27

LVM magic value at 2661/158/15

LVM magic value at 2678/10/18
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
Search for partition aborted

Results
   P MS Data                     2048       2048          1
     ReFS, 512 B

interface_write()
 1 P MS Data                     2048       2048          1
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]
 1 P MS Reserved                   34      32767      32734 [Microsoft reserved partition]

TestDisk exited normally.

Posted: **21 Sep 2019, 22:31**

Try to clone the disk using ddrescue to a new empty disk as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, remove the original disk and try testdisk on the clone.

Posted: **22 Sep 2019, 10:35**

I did clone the disk using ddrescue and run testdisk on the clone. However, the result after analyzing the disk shows multiple deleted partitions but all of them are corrupted (no filesystem).

Posted: **22 Sep 2019, 14:05**

Did you verify that by trying to list files for each of the partitions found?

Posted: **22 Sep 2019, 22:05**

Yes, listing each one returns the same message: “no filesystem”

Posted: **23 Sep 2019, 00:50**

I would not have expected that all file systems fail simultaneously.
Now there is only Photorec left over or any third party software.

Apart from that, to have an idea of the number of broken sectors you can run smartmontools or Crystaldiskinfo.
You can look into the ddrescue logfile to see where exactly ddrescue failed to read data.

Posted: **23 Sep 2019, 11:17**

Thanks, I appreciate your help. I’m trying photoRec right now, but the filenames and structure is so important. The data is useless without the filesystem.

Posted: **23 Sep 2019, 12:21**

The only remaining option now is to use commercial software then.

Posted: **23 Sep 2019, 14:12**

cgsecurity.org

TestDisk analyse is too slow

TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow

Re: TestDisk analyse is too slow