Bad filesystem and boot sectors; files are repeated 8 times?

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
brg6769
Posts: 1
Joined: 25 Feb 2021, 03:02

Bad filesystem and boot sectors; files are repeated 8 times?

#1 Post by brg6769 »

Please see my explanation below, but my questions are:
1)Should I attempt a rebuild of the boot sectors as it appears both the main and backup sectors are damaged?
2)Why is a 1TB drive reflecting as ~8 TB when I am trying to create a Disk Image of it?
3)Should I attempt repair without first creating an image?
4)When I used testdisk to perform a partition analysis (Analyze) of this drive, it looks like it found the partitions,
but when I viewed the files they all look to be dated from 2012 (ie inception of the drive). If I try to recover these partitions, will all my current
files become unrecoverable?


BACKGROUND:
Have a 1 TB Toshiba/Hitachi HDS721010DLE630 hard disk that wouldn't boot after a power outage. Took the drive out and tried to power it up with
a separate power cable; sometimes it beeps 6 times and doesn't appear to spin up; other times it does spin up and can see
it in Disk Management with a 3.5 GB RAW 'healthy' partition and a 928 GB unallocated 'partition'.

First tried Easeus; was able to save and transfer a few GB of my files, but most of my files that I found looked to be corrupted (could
not open them after I saved them to a different disk, or if they did open, the underlying data had no connection to the
filename itself). It seems the file directory has no proper connection anymore to the actual data.
On top of that, these corrupted files almost always had multiple copies of the
same file (ie. filex.txt, filex_1.txt, filex_2.txt, etc) all the way up to 8 files each I believe.
Had the exact same filesize on each of these files for a given filename.

Next, using testdisk, I've gotten these messages:
Can't open filesystem. Filesystem seems damaged.
Boot sector: bad Backup boot sector: Bad ntfs_boot_sector: Can't read backup boot sector.

I wanted to first create DD images of the hard disk before working on it, but when I try to back up the Unallocated
portion of the drive, it indicates that it will be 7,997,748 MB in size, which won't fit on the backup drive I have.
I don't know how this is possible given that this is only a 1 TB drive. This seems related to the filename duplication issue above.


<<<TESTDISK LOG (sans Analyze process) >>>


Wed Feb 24 21:04:04 2021
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2021
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 9.3, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
Failed to startup volume: Invalid argument.
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4000786153472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000786153472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=499498614784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4000784056320
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3825205248
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500DM009-2F110A, S/N:W9A8FVJT, FW:CC43
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WD My Book 25ED, S/N:WX42D80C42DH, FW:1031
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Hitachi HDS721010DLE630, S/N:152D20337A0C
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Hitachi HDS721010DLE630, S/N:152D20337A0C
Drive F: - 3825 MB / 3648 MiB - CHS 58 255 63, sector size=4096 - Hitachi HDS721010DLE630, S/N:152D20337A0C

Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - Hitachi HDS721010DLE630
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 * HPFS - NTFS 0 32 33 58 66 8 933888
2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285
Not an exFAT boot sector.

1 * HPFS - NTFS 0 32 33 58 66 8 933888
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285
Can't open filesystem. Filesystem seems damaged.
Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - Hitachi HDS721010DLE630
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 * HPFS - NTFS 0 32 33 58 66 8 933888
2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285
Not an exFAT boot sector.

1 * HPFS - NTFS 0 32 33 58 66 8 933888
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.

2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285
Can't open filesystem. Filesystem seems damaged.

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 * HPFS - NTFS 0 32 33 58 66 8 933888
2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285
Partition table type defaults to None
Drive F: - 3825 MB / 3648 MiB - Hitachi HDS721010DLE630
Partition table type: None

Interface Advanced
P Unknown 0 0 1 58 33 39 933888
Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - Hitachi HDS721010DLE630
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
1 * HPFS - NTFS 0 32 33 58 66 8 933888
2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285

ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 58 66 8 933888
filesystem size 1 8048742538622943012
sectors_per_cluster 0 98
mft_lcn 0 4255054225
mftmirr_lcn 0 3305486450
clusters_per_mft_record 0 -26
clusters_per_index_record 0 106
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_boot_sector
2 P HPFS - NTFS 59 0 1 121601 48 31 1952575285
filesystem size 35779447885861 1
sectors_per_cluster 0 0
mft_lcn 1305143552 0
mftmirr_lcn 1208493132 0
clusters_per_mft_record 72 0
clusters_per_index_record 0 0
Boot sector
Status: Bad

Backup boot sector
ntfs_boot_sector: Can't read backup boot sector.
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Bad filesystem and boot sectors; files are repeated 8 times?

#2 Post by recuperation »

brg6769 wrote: 25 Feb 2021, 04:26 Please see my explanation below, but my questions are:
1)Should I attempt a rebuild of the boot sectors as it appears both the main and backup sectors are damaged?
No.
2)Why is a 1TB drive reflecting as ~8 TB when I am trying to create a Disk Image of it?
Lack of documentation! The drives is correctly indicating 931GB. Use ddrescue as described in the manual.
3)Should I attempt repair without first creating an image?
No.
4)When I used testdisk to perform a partition analysis (Analyze) of this drive, it looks like it found the partitions,
but when I viewed the files they all look to be dated from 2012 (ie inception of the drive). If I try to recover these partitions, will all my current
files become unrecoverable?
I don't know.
Duplicate your duplicate to have a drive where can safely play around.
BACKGROUND:
Have a 1 TB Toshiba/Hitachi HDS721010DLE630 hard disk that wouldn't boot after a power outage. Took the drive out and tried to power it up with
a separate power cable; sometimes it beeps 6 times and doesn't appear to spin up; other times it does spin up and can see
Please ensure proper power supply to exclude a supply issue. Use a dockingstation.
Your description could suggest that you get power from one computer while simultaneously being connected with the data cable to another.
If it continues beeping or does not spin up contact a professional recovery company.
First tried Easeus
Maybe you should try Microsoft?
Easeus is a company. Try being precise.
I wanted to first create DD images of the hard disk before working on it, but when I try to back up the Unallocated
portion of the drive
dd is not able to work on unallocated portions of the drive. There is something wrong with your description.
Your drive size is fine:
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500DM009-2F110A, S/N:W9A8FVJT, FW:CC43
Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - WD My Book 25ED, S/N:WX42D80C42DH, FW:1031
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Hitachi HDS721010DLE630, S/N:152D20337A0C
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 15200 255 63, sector size=4096 - Hitachi HDS721010DLE630, S/N:152D20337A0C

Drive F: - 3825 MB / 3648 MiB - CHS 58 255 63, sector size=4096 - Hitachi HDS721010DLE630, S/N:152D20337A0C

Locked