any hope? raw partition/hdd, prolly destroyed both mft records.

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
marsi
Posts: 1
Joined: 10 May 2021, 16:19

any hope? raw partition/hdd, prolly destroyed both mft records.

#1 Post by marsi »

Hi guys,

very fcked few days (week) behind me. i had to move from win7 (unvoluntary) to win10 because of work. took me like 3+ days to install win10 and also few linux distros with the fck the win10 idea, eventualy...
anyway, in midst of all that chaos i kinda lost 3rd hdd, but didn't pay too much attention to it at the time since i had other (bigger) problems to solve.

not exaclly sure when and why 3rd hdd stop working and what i did at the time :( . looking back now, at some point, i did all the things that i shouldn't do, but its nothing i wasn't doing last 20yrs...

1. in win, in disk managment i changed drive letter from D to X, in order to assing letter D to 2nd hdd. assigned D to 2nd hdd, and changed from X to E for 3rd hdd. not sure if i closed disk managment, while i was making usb with linux installation. hit restart prolly.
2. in linux, in gparted, i was doing some changes on 1st hdd few times. not sure, but maybe 3rd hdd was opened/mounted in gparted when i restarted linux. prolly in disk managment app also.
3. puled out USB stick few times while pc was reseting/booting...

not sure what fcked my 3rd hdd, its prolly me and something i did that i'm not aware off, but i'll go with blaming win10.


anyway, here is what i got now:

from win: i need to format hdd before i can use it. raw partition. (very elegant solution imo :), i'm surprised they don't offer buying new hdd as better (quicker) solution)

from chkdsk /f:

The type of the file system is NTFS.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
Unable to determine volume version and state. CHKDSK aborted.

and from testdisk:

Code: Select all


TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8001563222016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=277825454080
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=7891327123456
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - TOSHIBA HDWD120, S/N:7760WS0AS, FW:MX4OACF0
Disk /dev/sdb - 8001 GB / 7452 GiB - CHS 972801 255 63, sector size=512 - TOSHIBA HDWF180, S/N:Y769K0SIFZ1D, FW:GX0B
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - NVMe Samsung SSD 960, S/N:0025_3851_81B0_A8FB., FW:3B7Q

Partition table type (auto): EFI GPT
Disk /dev/sdb - 8001 GB / 7452 GiB - TOSHIBA HDWF180
Partition table type: EFI GPT

Analyse Disk /dev/sdb - 8001 GB / 7452 GiB - CHS 972801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15628053167 (expected 15628053167)
hdr_lba_start=34
hdr_lba_end=15628053134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Data                   264192 15413012479 15412748288 [Poker]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Data                   264192 15413012479 15412748288 [Poker]
 1 P MS Data                   264192 15413012479 15412748288 [Poker]

search_part()
Disk /dev/sdb - 8001 GB / 7452 GiB - CHS 972801 255 63
NTFS at 0/32/33
filesystem size           15412748288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=7891327123456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           15412748288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
NTFS at 959415/166/47
filesystem size           15412748288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 15413012479 15412748288
     NTFS found using backup sector, blocksize=4096, 7891 GB / 7349 GiB
NTFS at 959415/166/47
filesystem size           15412748288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               15413012479 30825760766 15412748288
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
This partition ends after the disk limits. (start=15413012479, size=15412748288, end=30825760766, disk end=15628053168)
NTFS at 959415/166/48
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               15412090881 15413012480     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
NTFS at 959415/166/48
filesystem size           921600
sectors_per_cluster       8
mft_lcn                   38400
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               15413012480 15413934079     921600 [Recovery]
     NTFS, blocksize=4096, 471 MB / 450 MiB
FAT32 at 959473/5/21
FAT1 : 6654-7422
FAT2 : 7423-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-204799
sectors : 204800
cluster_size : 2
no_of_cluster : 98304 (2 - 98305)
fat_length 769 calculated 769
set_FAT_info: name from BS used

FAT32 at 959473/5/21
FAT: cluster=2(0x2), pos=15413942272
     EFI System            15413934080 15414138879     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
NTFS at 959485/196/8
filesystem size           213913600
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               15200225281 15414138880  213913600
     NTFS found using backup sector, blocksize=4096, 109 GB / 102 GiB
NTFS at 959485/196/8
filesystem size           213913600
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data               15414138880 15628052479  213913600
     NTFS, blocksize=4096, 109 GB / 102 GiB
file_pread(5,2,buffer,15628054528(972801/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,15628054528(972801/102/38)) lseek err Invalid argument
file_pread(5,2,buffer,15628054529(972801/102/39)) lseek err Invalid argument
file_pread(5,1,buffer,15628054531(972801/102/41)) lseek err Invalid argument
file_pread(5,1,buffer,15628054532(972801/102/42)) lseek err Invalid argument
file_pread(5,1,buffer,15628054533(972801/102/43)) lseek err Invalid argument
file_pread(5,1,buffer,15628054534(972801/102/44)) lseek err Invalid argument
file_pread(5,1,buffer,15628054535(972801/102/45)) lseek err Invalid argument
.
.
.
next 300+ rows same thing, different numbers maybe
.
.
.

file_pread(5,1,buffer,15628053304(972801/83/11)) lseek err Invalid argument
file_pread(5,1,buffer,15628055217(972801/113/34)) lseek err Invalid argument
Disk /dev/sdb - 8001 GB / 7452 GiB - CHS 972801 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (8001 GB / 7452 GiB) seems too small! (< 15 TB / 14 TiB)
The following partition can't be recovered:
     MS Data               15413012479 30825760766 15412748288
     NTFS, blocksize=4096, 7891 GB / 7349 GiB

Results
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
     MS Data                   264192 15413012479 15412748288
     NTFS found using backup sector, blocksize=4096, 7891 GB / 7349 GiB
     MS Data               15200225281 15414138880  213913600
     NTFS found using backup sector, blocksize=4096, 109 GB / 102 GiB
     MS Data               15412090881 15413012480     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
     MS Data               15413012480 15413934079     921600 [Recovery]
     NTFS, blocksize=4096, 471 MB / 450 MiB
     EFI System            15413934080 15414138879     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
     MS Data               15414138880 15628052479  213913600
     NTFS, blocksize=4096, 109 GB / 102 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.


dir_partition inode=5
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 .
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 ..
      40 dr-xr-xr-x     0      0         0  6-Oct-2020 02:38 $RECYCLE.BIN

     MS Data                   264192 15413012479 15412748288
     NTFS found using backup sector, blocksize=4096, 7891 GB / 7349 GiB
Can't open filesystem. Filesystem seems damaged.

     MS Data               15200225281 15414138880  213913600
     NTFS found using backup sector, blocksize=4096, 109 GB / 102 GiB
Can't open filesystem. Filesystem seems damaged.

     MS Data               15412090881 15413012480     921600
     NTFS found using backup sector, blocksize=4096, 471 MB / 450 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=5
     MS Data               15413012480 15413934079     921600 [Recovery]
     NTFS, blocksize=4096, 471 MB / 450 MiB
Directory /
       5 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 .
       5 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 ..
      36 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 System Volume Information

dir_partition inode=36
     MS Data               15413012480 15413934079     921600 [Recovery]
     NTFS, blocksize=4096, 471 MB / 450 MiB
Directory /System Volume Information
      36 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 .
       5 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 ..
      37 -r--r--r--     0      0     20480  6-Oct-2020 11:28 tracking.log
Directory /
       5 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 .
       5 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 ..
      36 dr-xr-xr-x     0      0         0  6-Oct-2020 11:28 System Volume Information


dir_partition inode=0
     EFI System            15413934080 15414138879     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
FAT: cluster=2(0x2), pos=15413942272
Directory /
       3 drwxr-xr-x     0      0         0  6-Oct-2020 02:20 EFI

dir_partition inode=3
     EFI System            15413934080 15414138879     204800 [EFI System Partition] [NO NAME]
     FAT32, blocksize=1024, 104 MB / 100 MiB
FAT: cluster=3(0x3), pos=15413942274
Directory /EFI
       3 drwxr-xr-x     0      0         0  6-Oct-2020 02:20 .
       0 drwxr-xr-x     0      0         0  6-Oct-2020 02:20 ..
       4 drwxr-xr-x     0      0         0  6-Oct-2020 02:20 Microsoft
   10807 drwxr-xr-x     0      0         0  6-Oct-2020 02:26 Boot
FAT: cluster=2(0x2), pos=15413942272
Directory /
       3 drwxr-xr-x     0      0         0  6-Oct-2020 02:20 EFI


dir_partition inode=5
     MS Data               15414138880 15628052479  213913600
     NTFS, blocksize=4096, 109 GB / 102 GiB
Directory /
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 .
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 ..
   91282 dr-xr-xr-x     0      0         0  6-Oct-2020 03:41 $AV_ASW
      64 dr-xr-xr-x     0      0         0  6-Oct-2020 04:46 $Recycle.Bin
   99261 dr-xr-xr-x     0      0         0  6-Oct-2020 03:36 AMD
   99099 dr-xr-xr-x     0      0         0  6-Oct-2020 03:34 CIMTEMP
   89707 dr-xr-xr-x     0      0         0 16-Nov-2019 01:01 Documents and Settings
      65 dr-xr-xr-x     0      0         0  6-Oct-2020 04:37 PerfLogs
      66 dr-xr-xr-x     0      0         0  7-Oct-2020 20:53 Program Files
    1543 dr-xr-xr-x     0      0         0  6-Oct-2020 03:53 Program Files (x86)
    1648 dr-xr-xr-x     0      0         0  6-Oct-2020 04:37 ProgramData
    1866 dr-xr-xr-x     0      0         0  6-Oct-2020 02:46 Recovery
   87994 dr-xr-xr-x     0      0         0  1-May-2021 18:36 System Volume Information
    1867 dr-xr-xr-x     0      0         0  6-Oct-2020 02:55 Users
    3003 dr-xr-xr-x     0      0         0  6-Oct-2020 04:42 Windows
      53 -r--r--r--     0      0 27435225088  5-May-2021 17:52 hiberfil.sys
     176 -r--r--r--     0      0 10200547328  5-May-2021 17:52 pagefile.sys
   33845 -r--r--r--     0      0 268435456  5-May-2021 17:52 swapfile.sys


dir_partition inode=5
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 .
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 ..
      40 dr-xr-xr-x     0      0         0  6-Oct-2020 02:38 $RECYCLE.BIN

dir_partition inode=40
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
ntfs_readdir failed for cluster 40: Input/output error
Directory /$RECYCLE.BIN
      40 dr-xr-xr-x     0      0         0  6-Oct-2020 02:38 .
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 ..
   20988 dr-xr-xr-x     0      0         0  9-Jun-2018 10:49 S-1-5-18
      41 dr-xr-xr-x     0      0         0 29-Jun-2018 16:44 S-1-5-21-1350785218-4038914454-1068601573-1001
  100114 dr-xr-xr-x     0      0         0 27-Feb-2021 22:09 S-1-5-21-2960108660-746196553-3917765268-1000

dir_partition inode=100114
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB
ntfs_readdir failed for cluster 100114: Input/output error
Directory /$RECYCLE.BIN/S-1-5-21-2960108660-746196553-3917765268-1000
  100114 dr-xr-xr-x     0      0         0 27-Feb-2021 22:09 .
      40 dr-xr-xr-x     0      0         0  6-Oct-2020 02:38 ..
ntfs_readdir failed for cluster 40: Input/output error
Directory /$RECYCLE.BIN
      40 dr-xr-xr-x     0      0         0  6-Oct-2020 02:38 .
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 ..
   20988 dr-xr-xr-x     0      0         0  9-Jun-2018 10:49 S-1-5-18
      41 dr-xr-xr-x     0      0         0 29-Jun-2018 16:44 S-1-5-21-1350785218-4038914454-1068601573-1001
  100114 dr-xr-xr-x     0      0         0 27-Feb-2021 22:09 S-1-5-21-2960108660-746196553-3917765268-1000
ntfs_readdir failed for cluster 5: Input/output error
Directory /
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 .
       5 dr-xr-xr-x     0      0         0  5-May-2021 14:40 ..
      40 dr-xr-xr-x     0      0         0  6-Oct-2020 02:38 $RECYCLE.BIN

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 8001 GB / 7452 GiB - CHS 972801 255 63
NTFS at 0/32/33
filesystem size           15412748288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=7891327123456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           15412748288
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                     2048 15412750335 15412748288 [Poker]
     NTFS, blocksize=4096, 7891 GB / 7349 GiB

recover_EXT2: s_block_group_nr=0/2, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8144
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 97656
recover_EXT2: part_size 781248
Last mount time:    Tue Aug  1 12:10:16 2017
     Linux filesys. data        39600     820847     781248
     ext4 blocksize=4096 Large_file Sparse_SB, 399 MB / 381 MiB
after this i started deep scan, and after 4-5 hours i kinda eyeboled (if thats the word) to ~10 days.
So, my question is: Is it worth to let deep scan run for 10 days (prolly ~5)? given the info above, is there a chance for easy fix after deep scan (without extracting data to other hdd and copying them back)?
i'm no expert, not even intermediate in this topic, but from what i could read from log feels that there is not much hope.

thanks!

btw. i hope someone will reply in next 10 days :D :D :D

Locked