Page 1 of 1

Primary and Backup BS Both Bad, but Identical?

Posted: 21 Nov 2019, 07:29
by rofflesaur
I have a 2TB external hard drive in my possession. The controller in the enclosure or something on the board has failed, causing the host computer to lock up when connected via USB. This also seems to have corrupted the boot sector and partition table on the drive. The drive, removed from the enclosure and connected directly via eSATA dock is accessible. Windows shows a 232.88GB unformatted partition as well as 1.59TB of unallocated space. I was told the drive was used on a Windows computer and was one large partition.

I selected Intel/PC (auto detected) partition table type in TestDisk. Analyze shows the 232.88GB partition twice as FAT32. Advanced shows the primary and backup boot sector as bad, but identical... so there's nothing to rebuild. I was not able to generate a file list by manual changing the partition type to NTFS either.

Any suggestions? Here's the initial log file after running Analyze:


Wed Nov 20 20:21:56 2019
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255415287808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=250049865216
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - MTFDDAK256MAM-1K1, S/N:133603887A11, FW:070H
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1E6164, S/N:W1E6GLSL, FW:SC48

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM001-1E6164
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2 16450559


test_FAT()
1 P FAT32 0 0 3 30400 41 62 488378643
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 0B
Current partition structure:
Invalid FAT boot sector
1 P FAT32 0 0 3 30400 41 62 488378643
1 P FAT32 0 0 3 30400 41 62 488378643

Bad relative sector.
No partition is bootable

Re: Primary and Backup BS Both Bad, but Identical?

Posted: 21 Nov 2019, 09:13
by cgrenier
The partition location seems wrong.
Run TestDisk, Analyse, Quick Search. If the partition isn't found, try Deeper Search.
List the files from the found partition. If it's OK, switch the partition to P(rimary) or *(bootable), on next screen, choose Write, confirm, Quit.

Re: Primary and Backup BS Both Bad, but Identical?

Posted: 26 Nov 2019, 08:47
by rofflesaur
When I run Quick Search, it seems to automatically do a deep search (it takes a few hours). It returns "The following partitions can't be recovered" and shows a FAT32 and NTFS partition. Here's a screenshot of the window after running Analyze > Quick Search
Annotation 2019-11-22 003049.jpg
Annotation 2019-11-22 003049.jpg (65.49 KiB) Viewed 982 times
Running Deeper Search returns the same results. Any suggestions would be greatly appreciated. Hard to believe a failed controller would cause this much chaos. I've used this software before with excellent results, but this drive is really throwing me for a loop. It's starting to look like PhotoRec might be my only option unfortunately....

Here's the log file again after running Quick Search and Deeper Search. Thanks.


Thu Nov 21 01:50:08 2019
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive2
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255415287808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=250049865216
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - MTFDDAK256MAM-1K1, S/N:133603887A11, FW:070H
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1E6164, S/N:W1E6GLSL, FW:SC48

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM001-1E6164
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2 16450559


test_FAT()
1 P FAT32 0 0 3 30400 41 62 488378643
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 0B
Current partition structure:
Invalid FAT boot sector
1 P FAT32 0 0 3 30400 41 62 488378643
1 P FAT32 0 0 3 30400 41 62 488378643

Bad relative sector.
No partition is bootable

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
file_pread(5,16,buffer,4112(0/65/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,4159(0/66/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,4159(0/66/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,4175(0/66/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,4222(0/67/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,148744255(9258/229/59)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,148744256(9258/229/60)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,148752447(9259/104/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,148752447(9259/104/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,148803663(9262/152/58)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,148811839(9263/27/44)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,148811855(9263/27/60)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,148811855(9263/27/60)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,149311488(9294/53/40)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,149311488(9294/53/40)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,149311489(9294/53/41)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,149311490(9294/53/42)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,149311551(9294/54/40)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,149311551(9294/54/40)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,149311567(9294/54/56)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,149311614(9294/55/40)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,149319680(9294/183/42)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,149319680(9294/183/42)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,149319681(9294/183/43)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,149319682(9294/183/44)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,149319743(9294/184/42)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,149319743(9294/184/42)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,154558464(9620/208/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,154558464(9620/208/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,154558465(9620/208/62)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,154558466(9620/208/63)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,154558527(9620/209/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,154558527(9620/209/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,154558590(9620/210/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,154558592(9620/210/63)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,157483134(9802/222/19)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,157483136(9802/222/21)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,157491263(9803/96/21)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,157491279(9803/96/37)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,157491279(9803/96/37)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,162711678(10128/85/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,162711680(10128/85/6)) ReadFile Data error (cyclic redundancy check).


LVM magic value at 24446/121/60
file_pread(5,16,buffer,772796542(48104/91/50)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,772796544(48104/91/52)) ReadFile Data error (cyclic redundancy check).

BAD_RS LBA=5398548409 7413732
file_pread(5,1,buffer,5398548409(336044/24/38)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 336044 24 38 517128 248 9 2909128544
This partition ends after the disk limits. (start=5398548409, size=2909128544, end=8307676952, disk end=3907029168)
file_pread(5,16,buffer,2733738110(170167/83/27)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2733738120(170167/83/37)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,2733740032(170167/113/59)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,2733740034(170167/113/61)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,2733740048(170167/114/12)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,2733740095(170167/114/59)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2733740158(170167/115/59)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2733740158(170167/115/59)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2733742098(170167/146/46)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2733742143(170167/147/28)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2733742143(170167/147/28)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,2733742159(170167/147/44)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,2733742206(170167/148/28)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2733744146(170167/179/15)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2733744191(170167/179/60)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2733744207(170167/180/13)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2733744207(170167/180/13)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,2733744254(170167/180/60)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2752528384(171336/246/47)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2752528384(171336/246/47)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2752528385(171336/246/48)) ReadFile Data error (cyclic redundancy check).

file_pread(5,14,buffer,2752528386(171336/246/49)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,2752528400(171336/246/63)) ReadFile Data error (cyclic redundancy check).

file_pread(5,3,buffer,2752528447(171336/247/47)) ReadFile Data error (cyclic redundancy check).

file_pread(5,8,buffer,2752528463(171336/247/63)) ReadFile Data error (cyclic redundancy check).

file_pread(5,11,buffer,2752528510(171336/248/47)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2752528968(171337/1/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2752528968(171337/1/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2752528969(171337/1/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2752528969(171337/1/2)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2813013693(175102/1/1)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2813013709(175102/1/17)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2813013709(175102/1/17)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2813013696(175102/1/4)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2813013704(175102/1/12)) ReadFile Data error (cyclic redundancy check).

file_pread(5,4,buffer,2813013705(175102/1/13)) ReadFile Data error (cyclic redundancy check).

file_pread(5,2,buffer,2813013710(175102/1/18)) ReadFile Data error (cyclic redundancy check).

file_pread(5,16,buffer,2970632318(184913/78/60)) ReadFile Data error (cyclic redundancy check).

file_pread(5,1,buffer,2970632318(184913/78/60)) ReadFile Data error (cyclic redundancy check).

BAD_RS LBA=3422710966 7078414
check_part_i386 failed for partition type 0C
FAT32 LBA 213053 230 32 322864 122 44 1764106924
This partition ends after the disk limits. (start=3422710966, size=1764106924, end=5186817889, disk end=3907029168)
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,14,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4253 GB / 3961 GiB)
The following partitions can't be recovered:
FAT32 LBA 213053 230 32 322864 122 44 1764106924
HPFS - NTFS 336044 24 38 517128 248 9 2909128544

Results

interface_write()

No partition found or selected for recovery