All data recovered with TestDisk but NTFS HDD unreadable

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Robin
Posts: 4
Joined: 06 Aug 2014, 00:39

All data recovered with TestDisk but NTFS HDD unreadable

#1 Post by Robin »

Hi there - I am new to this and not very up on the technical side, although I have done a considerable amount of reading and learning over the past few days!
I keep all my photos and videos on a 2TB internal disk which suddenly became unreadable by Windows (8).
Using TestDisk for the first time, I found that the boot sector was bad and I successfully used the back up boot data to make the primary partition readable. There is only one partition on the drive, occupying the whole (2TB) disk. I then copied all the (191 932) data files to a portable HDD with no errors.
Even though TestDisk is able to read all the information on the Primary partition, Windows cannot access this partition and sees the disk as a RAW volume which needs formatting. I sense there must be some way of modifying the MBR or MFT (not quite sure what the difference is!) so that Windows can then see all the data which is still on the partition and I can continue using the disk without having to format it. Chkdsk gets as far as 53% and then gives an error saying there is not enough room on the disk to write to it (or something like that!).
The initial TestDisk Log is shown below, which includes me restoring the boot data from the backup. Any help on getting the disk back to good health would be much appreciated!:

Partition table type (auto): Intel
Disk /dev/sdd - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel

Analyse Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
No partition is bootable

search_part()
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63
file_pread(7,11,buffer,3907027070(243201/47/45)) lseek err Invalid argument
file_pread(7,1,buffer,3907027070(243201/47/45)) lseek err Invalid argument
file_pread(7,2,buffer,3907028992(243201/78/14)) lseek err Invalid argument
file_pread(7,1,buffer,3907028991(243201/78/13)) lseek err Invalid argument
file_pread(7,13,buffer,3907028994(243201/78/16)) lseek err Invalid argument
file_pread(7,3,buffer,3907029007(243201/78/29)) lseek err Invalid argument
file_pread(7,3,buffer,3907029054(243201/79/13)) lseek err Invalid argument
file_pread(7,8,buffer,3907029070(243201/79/29)) lseek err Invalid argument
file_pread(7,11,buffer,3907029117(243201/80/13)) lseek err Invalid argument
file_pread(7,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument

Results
Can't open backup.log file: No such file or directory
interface_load

interface_write()

No partition found or selected for recovery



Sun Aug 3 20:37:23 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, June 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-07-30T07:20:09
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000397852160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=999501594624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=500106780160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000397852160
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=999501594624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=499737690112
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=499970473984
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=499971522560
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000395698176
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=2000364240896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=999500546048
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500320AS, S/N:9QM5H4NG, FW:SD1A
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500320AS, S/N:9QM4P67Y, FW:SD1A
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST3500320AS, S/N:9QM4P9S5, FW:SD1A
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WDC WD20EARS-00MVWB0, S/N:WD-WMAZA1367716, FW:51.0AB51
Disk /dev/sdf - 999 GB / 930 GiB - CHS 121515 255 63, sector size=512 - WD My Book 1110, S/N:WCAV5D450766, FW:2018
Disk /dev/sdg - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512 - WD My Passport 0820, S/N:WXG1A1461717, FW:1007

Partition table type (auto): Intel
Disk /dev/sdd - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS at 0/32/33
filesystem size 16780535352598200449 3907022848
sectors_per_cluster 32 8
mft_lcn 0 786432
mftmirr_lcn 0 244188927
clusters_per_mft_record 0 -10
clusters_per_index_record -10 1
Boot sector
Status: Bad

Backup boot sector
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244188927
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

Robin
Posts: 4
Joined: 06 Aug 2014, 00:39

Re: All data recovered with TestDisk but NTFS HDD unreadable

#2 Post by Robin »

Deep Search reveals the following errors:

Partition table type (auto): Intel
Disk /dev/sdd - 2000 GB / 1863 GiB - WDC WD20EARS-00MVWB0
Partition table type: Intel

Analyse Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
No partition is bootable

search_part()
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 244188927
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(7,2,buffer,3907027058(243201/47/33)) lseek err Invalid argument
file_pread(7,1,buffer,3907027058(243201/47/33)) lseek err Invalid argument
file_pread(7,11,buffer,3907027070(243201/47/45)) lseek err Invalid argument
file_pread(7,1,buffer,3907027070(243201/47/45)) lseek err Invalid argument
file_pread(7,2,buffer,3907028992(243201/78/14)) lseek err Invalid argument
file_pread(7,8,buffer,3907027072(243201/47/47)) lseek err Invalid argument
file_pread(7,8,buffer,3907027200(243201/49/49)) lseek err Invalid argument
file_pread(7,8,buffer,3907027328(243201/51/51)) lseek err Invalid argument
file_pread(7,8,buffer,3907027456(243201/53/53)) lseek err Invalid argument
file_pread(7,8,buffer,3907027584(243201/55/55)) lseek err Invalid argument
file_pread(7,8,buffer,3907027712(243201/57/57)) lseek err Invalid argument
file_pread(7,8,buffer,3907027840(243201/59/59)) lseek err Invalid argument
file_pread(7,8,buffer,3907027968(243201/61/61)) lseek err Invalid argument
file_pread(7,8,buffer,3907028096(243201/63/63)) lseek err Invalid argument
file_pread(7,8,buffer,3907028224(243201/66/2)) lseek err Invalid argument
file_pread(7,8,buffer,3907028352(243201/68/4)) lseek err Invalid argument
file_pread(7,8,buffer,3907028480(243201/70/6)) lseek err Invalid argument
file_pread(7,8,buffer,3907028608(243201/72/8)) lseek err Invalid argument
file_pread(7,8,buffer,3907028736(243201/74/10)) lseek err Invalid argument
file_pread(7,8,buffer,3907028864(243201/76/12)) lseek err Invalid argument
file_pread(7,1,buffer,3907028991(243201/78/13)) lseek err Invalid argument
file_pread(7,1,buffer,3907028992(243201/78/14)) lseek err Invalid argument
file_pread(7,14,buffer,3907028993(243201/78/15)) lseek err Invalid argument
file_pread(7,3,buffer,3907029007(243201/78/29)) lseek err Invalid argument
file_pread(7,3,buffer,3907029054(243201/79/13)) lseek err Invalid argument
file_pread(7,8,buffer,3907029070(243201/79/29)) lseek err Invalid argument
file_pread(7,11,buffer,3907029117(243201/80/13)) lseek err Invalid argument
file_pread(7,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument

Results
* HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB

interface_write()
1 * HPFS - NTFS 0 32 33 243201 13 12 3907022848
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

starradher
Posts: 1
Joined: 19 Sep 2014, 22:27

Re: All data recovered with TestDisk but NTFS HDD unreadable

#3 Post by starradher »

do not format or write if you havent baced up all your data, intended...

see if you can assign the drive a letter also, try on another pc witx xp on it, or linux.

Robin
Posts: 4
Joined: 06 Aug 2014, 00:39

Re: All data recovered with TestDisk but NTFS HDD unreadable

#4 Post by Robin »

I am currently building a new computer so will try on that one. Not sure what you mean by intended...

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: All data recovered with TestDisk but NTFS HDD unreadable

#5 Post by Fiona »

Boot sector looks ok now.
Might be possible that your file system is faulty.
If you've already recovered all your data, you can have a try to repair your file system running chkdsk driveletter: /r
within your command prompt.
You'll need administrator privileges.
If it doesn't work for you, you can reformat your disk and copy all your data back.

Robin
Posts: 4
Joined: 06 Aug 2014, 00:39

Re: All data recovered with TestDisk but NTFS HDD unreadable

#6 Post by Robin »

Many thanks Fiona. Chkdsk did not work on the original computer but I will have a go on the new one once I have finished building it as it has a much more up-to-date motherboard and I sense that the 2TB disk was an issue for the old one!

Locked