Cannot recover partition
Posted: 19 Feb 2020, 18:35
Hi,
thanks for your help, i have read a few of the other posts from people having the same issue but i don't know if mine is similar, so instead of trying options without knowing what i'm doing, i'm posting my log here with hope that someone can help me.
Things to consider:
The disk is a 1TB Western Digital My Passport. I understand that the disks are automatically encrypted. What I did was to unlock it first, using WD_UNLOCKER, then I ran ddrescue to put the entire contents on a Toshiba 1TB drive. Because the Toshiba is the same size, ddrescue was not able to entirely copy the disk, only 99% of it. So that means when I put the drive in, there is a partition found because WD_UNLOCKER file is there. After it's unlocked, the unlocked drive is unusable.
Then I ran testdisk on the Toshiba drive copy, and I didn't go far.
I'm not sure if I should run testdisk on the original My Passport because of the encryption, or are the errors shown not related? Is it because the Toshiba only has 99% of the copy?
Thanks for your help!
Tue Feb 18 13:45:27 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=497866382336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM021-1KJ152, S/N:W62LA47Z, FW:0002YXM1
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20180525004283F, FW:5438
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - TOSHIBA External USB 3.0
Partition table type: Intel
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
Bad relative sector.
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525762(121601/90/28)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Results
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 65 2 121597 70 9 1953456128
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
BAD_RS LBA=1591320933 6200934
check_part_i386 failed for partition type 0C
FAT32 LBA 99055 37 28 282751 53 10 2951077231
This partition ends after the disk limits. (start=1591320933, size=2951077231, end=4542398163, disk end=1953525164)
BAD_RS LBA=4598211085 6557393
file_pread(5,1,buffer,4598211085(286225/102/35)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
This partition ends after the disk limits. (start=4598211085, size=3225196828, end=7823407912, disk end=1953525164)
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4005 GB / 3730 GiB)
The following partitions can't be recovered:
FAT32 LBA 99055 37 28 282751 53 10 2951077231
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 0 65 2 121597 70 9 1953456128
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
Change partition type:
HPFS - NTFS 0 65 2 121597 70 9 1953456128
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS at 0/32/33
filesystem size 1 1953519616
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.
thanks for your help, i have read a few of the other posts from people having the same issue but i don't know if mine is similar, so instead of trying options without knowing what i'm doing, i'm posting my log here with hope that someone can help me.
Things to consider:
The disk is a 1TB Western Digital My Passport. I understand that the disks are automatically encrypted. What I did was to unlock it first, using WD_UNLOCKER, then I ran ddrescue to put the entire contents on a Toshiba 1TB drive. Because the Toshiba is the same size, ddrescue was not able to entirely copy the disk, only 99% of it. So that means when I put the drive in, there is a partition found because WD_UNLOCKER file is there. After it's unlocked, the unlocked drive is unusable.
Then I ran testdisk on the Toshiba drive copy, and I didn't go far.
I'm not sure if I should run testdisk on the original My Passport because of the encryption, or are the errors shown not related? Is it because the Toshiba only has 99% of the copy?
Thanks for your help!
Tue Feb 18 13:45:27 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=497866382336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM021-1KJ152, S/N:W62LA47Z, FW:0002YXM1
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20180525004283F, FW:5438
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - TOSHIBA External USB 3.0
Partition table type: Intel
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
Bad relative sector.
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525762(121601/90/28)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Results
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 65 2 121597 70 9 1953456128
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
BAD_RS LBA=1591320933 6200934
check_part_i386 failed for partition type 0C
FAT32 LBA 99055 37 28 282751 53 10 2951077231
This partition ends after the disk limits. (start=1591320933, size=2951077231, end=4542398163, disk end=1953525164)
BAD_RS LBA=4598211085 6557393
file_pread(5,1,buffer,4598211085(286225/102/35)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
This partition ends after the disk limits. (start=4598211085, size=3225196828, end=7823407912, disk end=1953525164)
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4005 GB / 3730 GiB)
The following partitions can't be recovered:
FAT32 LBA 99055 37 28 282751 53 10 2951077231
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 0 65 2 121597 70 9 1953456128
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
Change partition type:
HPFS - NTFS 0 65 2 121597 70 9 1953456128
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS at 0/32/33
filesystem size 1 1953519616
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.