Page 1 of 1

HELP - Recover Partition from WD 1TB My Passport Became Raw

Posted: 26 Sep 2019, 05:55
by julienO
Hi, and good day to all. Firstly, I apologise if my case is has already been discussed and solved by others before. However, I have did extensive research and study (I do not have PC or computer background) to try understand drives, filesystems, partitions, etc...and could not solve recovering my portable/external hard disk.

I have tried WD's software, GSsmart Control, TestDisk and even Photorec.
I have managed to recover some files using photorec, but I got more than 800GB of data for just 2 jpegs that seems to be repeating.

So after many tries with TestDisk and still the partition not being found (my disk was initially formatted for just one partition), I hope to get help from the expert(s) here.
After following the step-by-step, and completing "Deeper Search" (3 days), I got the message "The following partition can't be recovered:
HPFS - NTFS 121597 5 8 243193 232 46 1953454080
NTFS, blocksize=4096, 1000 GB / 931 GiB"

Please help me to restore this disk. My greatest appreciation to you all!

Re: HELP - Recover Partition from WD 1TB My Passport Became Raw

Posted: 26 Sep 2019, 06:04
by cgrenier
When using TestDisk, continue on next screen...
When you used PhotoRec, did you choose to write the recovered files on the source disk ?

Re: HELP - Recover Partition from WD 1TB My Passport Became Raw

Posted: 26 Sep 2019, 06:18
by julienO
Hello there, CGRENIER! Thank you so much for such quick response!
cgrenier wrote:
26 Sep 2019, 06:04
When using TestDisk, continue on next screen...
When you used PhotoRec, did you choose to write the recovered files on the source disk ?
PhotoRec : I recovered the files to another disk/main drive of my laptop
TestDisk : When I continue, I was afraid to write as there was no files displayed when I presses 'P"

Can you advise me how to post my results?

I tried to attached the log file but was not allowed by a "invalid format", which then I changed to text (txt) document, but also denied. I tried to paste everything here, but was not allowed due to the amount of characters exceeding 60,000.

Here i s a brief :
""Tue Sep 24 12:37:07 2019
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin32 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=981972549632
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=16907239424
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=1000168488960
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - HGST HTS541010B7E610, S/N:WXU1A48LCH2A, FW:03.01A03
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512 - WD My Passport 25E1, S/N:WX31A97F73SK, FW:1019

Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - WD My Passport 25E1
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63
file_pread(5,16,buffer,2080(0/33/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2080(0/33/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,2082(0/33/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2111(0/33/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2111(0/33/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,3056(0/48/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3056(0/48/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,3119(0/49/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3119(0/49/33)) ReadFile Data error (cyclic redundancy check).

NTFS at 0/32/33
filesystem size 1953454080
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(5,2,buffer,1953458231(121597/38/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953458231(121597/38/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953458239(121597/38/41)) lseek err Invalid argument
file_pread(5,1,buffer,1953458239(121597/38/41)) lseek err Invalid argument
file_pread(5,2,buffer,1953458294(121597/39/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953458294(121597/39/33)) lseek err Invalid argument
file_pread(5,8,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953458177(121597/37/42)) lseek err Invalid argument
file_pread(5,14,buffer,1953458178(121597/37/43)) lseek err Invalid argument
file_pread(5,3,buffer,1953458192(121597/37/57)) lseek err Invalid argument
file_pread(5,3,buffer,1953458239(121597/38/41)) lseek err Invalid argument
file_pread(5,8,buffer,1953458255(121597/38/57)) lseek err Invalid argument
file_pread(5,11,buffer,1953458302(121597/39/41)) lseek err Invalid argument
file_pread(5,2,buffer,1953460224(121597/70/10)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Failed to read $MFTMirr: Input/output error.
Failed to read index block: No such file or directory.
file_pread(5,16,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

NTFS filesystem needs to be repaired.


dir_partition inode=5
P HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,8,buffer,2400(0/38/7)) ReadFile Data error (cyclic redundancy check).

ntfs_readdir failed for cluster 5: No such file or directory
Directory /
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 .
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 ..

interface_write()
1 P HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63
file_pread(5,16,buffer,2049(0/32/34)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2080(0/33/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2080(0/33/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,2082(0/33/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2111(0/33/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2111(0/33/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,3056(0/48/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3056(0/48/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,3119(0/49/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,3119(0/49/33)) ReadFile Data error (cyclic redundancy check).

NTFS at 0/32/33
filesystem size 1953454080
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,16,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,2111(0/33/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,2127(0/33/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,2174(0/34/33)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,4096(0/65/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,4095(0/65/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,4098(0/65/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,4112(0/65/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,4159(0/66/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,4175(0/66/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,4222(0/67/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,10240(0/162/35)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,10240(0/162/35)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,10239(0/162/34)) ReadFile Data error (cyclic redundancy check).

file_pread(5,15,buffer,10241(0/162/36)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,10256(0/162/51)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,10303(0/163/35)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,10319(0/163/51)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,10366(0/164/35)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,12288(0/195/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,12287(0/195/3)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,12290(0/195/6)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,12304(0/195/20)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,12351(0/196/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,12367(0/196/20)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,12414(0/197/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,16384(1/5/5)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,16384(1/5/5)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,17168(1/17/33)) ReadFile Data error (cyclic redundancy check).
""

jump to end..

"file_pread(5,8,buffer,187236431(11654/236/54)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,187236478(11654/237/38)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,187236822(11654/243/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,187236822(11654/243/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,187236885(11654/244/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,187236948(11654/245/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,187263039(11656/149/13)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,187263039(11656/149/13)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,187263055(11656/149/29)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,187263102(11656/150/13)) ReadFile Data error (cyclic redundancy check).

NTFS at 121597/5/8
filesystem size 1953454080
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
NTFS at 121597/5/8
filesystem size 1953454080
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(5,2,buffer,1959747589(121988/164/38)) lseek err Invalid argument
file_pread(5,1,buffer,1959747589(121988/164/38)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 121597 5 8 243193 232 46 1953454080
NTFS, blocksize=4096, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=1953456127, size=1953454080, end=3906910206, disk end=1953458176)
file_pread(5,2,buffer,1953458175(121597/37/40)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,1953458177(121597/37/42)) lseek err Invalid argument
file_pread(5,2,buffer,1953458231(121597/38/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953458231(121597/38/33)) lseek err Invalid argument
file_pread(5,2,buffer,1953458239(121597/38/41)) lseek err Invalid argument
file_pread(5,1,buffer,1953458239(121597/38/41)) lseek err Invalid argument
file_pread(5,2,buffer,1953458294(121597/39/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953458294(121597/39/33)) lseek err Invalid argument
file_pread(5,1,buffer,1953458176(121597/37/41)) ReadFile The drive cannot find the sector requested.

file_pread(5,7,buffer,1953458177(121597/37/42)) lseek err Invalid argument
file_pread(5,8,buffer,1953458184(121597/37/49)) lseek err Invalid argument
file_pread(5,3,buffer,1953458192(121597/37/57)) lseek err Invalid argument
file_pread(5,3,buffer,1953458239(121597/38/41)) lseek err Invalid argument
file_pread(5,8,buffer,1953458255(121597/38/57)) lseek err Invalid argument
file_pread(5,11,buffer,1953458302(121597/39/41)) lseek err Invalid argument
file_pread(5,2,buffer,1953460224(121597/70/10)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2000 GB / 1862 GiB)
The following partition can't be recovered:
HPFS - NTFS 121597 5 8 243193 232 46 1953454080
NTFS, blocksize=4096, 1000 GB / 931 GiB

Results
* HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Failed to read $MFTMirr: Input/output error.
Failed to read index block: No such file or directory.
file_pread(5,16,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

NTFS filesystem needs to be repaired.


dir_partition inode=5
* HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,8,buffer,2400(0/38/7)) ReadFile Data error (cyclic redundancy check).

ntfs_readdir failed for cluster 5: No such file or directory
Directory /
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 .
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 ..

interface_write()
1 P HPFS - NTFS 0 32 33 121597 5 8 1953454080 [My Passport]
Failed to read $MFTMirr: Input/output error.
Failed to read index block: No such file or directory.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
1 P EFI GPT 0 0 2 267349 89 4 4294967295
Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - WD My Passport 25E1
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953458175 (expected 1953458175)
hdr_lba_start=34
hdr_lba_end=1953458142
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 2048 1953456127 1953454080 [My Passport] [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,16,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2064(0/32/49)) ReadFile Data error (cyclic redundancy check).

NTFS filesystem needs to be repaired.


dir_partition inode=5
1 P MS Data 2048 1953456127 1953454080 [My Passport] [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,8,buffer,2400(0/38/7)) ReadFile Data error (cyclic redundancy check).

ntfs_readdir failed for cluster 5: No such file or directory
Directory /
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 .
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 ..

ntfs_boot_sector
1 P MS Data 2048 1953456127 1953454080 [My Passport] [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953454080
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to read $MFTMirr: No such file or directory.
Failed to read index block: No such file or directory.
file_pread(5,16,buffer,2065(0/32/50)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2065(0/32/50)) ReadFile Data error (cyclic redundancy check).

NTFS filesystem needs to be repaired.

ntfs_readdir failed for cluster 5: No such file or directory
Directory /
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 .
5 dr-xr-xr-x 0 0 0 4-Feb-2019 16:24 ..

ntfs_boot_sector
1 P MS Data 2048 1953456127 1953454080 [My Passport] [My Passport]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 1953454080
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - WD My Passport 25E1
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
1 P EFI GPT 0 0 2 267349 89 4 4294967295
Change partition type:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

TestDisk exited normally.""

Thanks!

Re: HELP - Recover Partition from WD 1TB My Passport Became Raw

Posted: 27 Sep 2019, 12:34
by cgrenier
There are a lot of "cyclic redundancy check" errors in your log file, your disk contains bad sectors.
You should clone the disk to a new empty disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, remove the original disk and try to recover your data from the clone.

Re: HELP - Recover Partition from WD 1TB My Passport Became Raw

Posted: 01 Oct 2019, 04:07
by julienO
Dear cgrenier, thank you very much! I will have to see if I can find the additional disk/space for me to do the disk cloning. Will update if there is progress.