Page 1 of 1

WD My Book Essential 2TB Analyse Question

Posted: 11 Sep 2015, 01:43
by chaos13
Hi.

I have a WD My Book Essential 2TB that I store my media in (i.e. not bootable). As far as I can remember, I used it right out of the box without anything done to it (e.g. change file system, format, partitioned). It has always been very slow to load before; whenever I open it in Windows explorer, the drive would take about 5 minutes to load before I can explore it's contents but it wasn't something I could not deal with.

Recently, the drive could not be detected by my computer (Windows 7 32-bit). I did nothing to it; I did not move it, I did not unplug it, nothing. It just wasn't showing up in the drive list. I tried plugging it in an old Windows XP laptop and it could not be detected. I don't have a linux computer so I couldn't test it there. Having no alternative and thinking it might be the drive's case/interface that's causing the problem, I opened it and placed it in an HDD bay. After plugging it in, my Win7 PC could detect the drive, albeit in a RAW partition with the usual prompts of 'Do you want to format the drive?'.

I just restarted my pc, unplugged and plugged the HDD bay, and changed the disk's position in the hdd bay but it did not change its RAW status (I know this wouldn't work I was just being optimistic that all it needed was a few nudges here and there). So I search the web and found testdisk.

I followed the steps on how to use test disk but I have come to a part that deviates from the expected behavior. After anaylsing (quick search) the disk, I could see that it found some files. However, what's different is that the file names of the files that testdisk found are unreadable (e.g. jv083htn24t2b4trdnfli). I tried searching for a reason for this but could not find any with similar experiences (that or I am bad at searching the web or have an incredibly low iq). I did not attempt a deep search yet as I know that takes a loooooong time and I don't want to try it until I know that there's nothing else wrong with my disk.

I've attached screenshots and the log file of my testdisk run. This is my 3rd run of testdisk and I have gone nowhere. The first run is similar to the one I described in this post, which I ended since I didn't know what to do. The second run was using the Advance setting where I rebuild the boot sector which I did based on a few posts here in the forum. I thought it would just run for a day or a day and half at most so I tried this instead of deep search. The problem with that run is that it was stuck at 25~% for 3 days. I forgot to make a backup of the log for that run so I can't provide it here. Then finally, this third run which had the same results as the first run.

I have also tried using another recovery program (easus, I think) and though it was able to list a few files that might have been my files, it did so with undecipherable file names and types; what I expect was an MP4 file was turned into an SWF file. Upon downloading one of this SWF file, it could not be opened and had an error message of being corrupted.

As a side note, I've mentioned I did nothing whatsoever to the drive prior to using it. I kind of expected the file system to either be NTFS or FAT32 but testdisk seems to detect it as FAT16. I don't know if that is because my disk is FAT16 or there is an underlying problem with it. I have media files as large as 10GB on the drive and as far as I know, that's not possible on FAT file systems (I could be wrong but that has always been the reason why my flash drives are all NTFS as I could not save files larger than 4GB on it when I left it at it's default FAT32).

Can anyone please advise on what I am seeing during my testdisk run? Is there anything else that I can do to recover my files in testdisk before I resort to photorec or other methods? Thanks!

P.S. I've upload the files in a ZIP file. I don't know how to use the BBcode. I am sorry, I am an idiot.

Re: WD My Book Essential 2TB Analyse Question

Posted: 09 Nov 2015, 14:19
by chaos13
So I'm back.

When no one answered my first post, I thought it best to just forget about the drive for a while.

Anyway, I have had time last weekend so I attempted to fix the drive again.

I did a deep search and I still came up with the odd file naming thing.
I also tried to copy a file to another drive and was successful (got my hopes up... my mistake). I noticed that the size of the file would correspond to what an actual file I had on the drive would have had (by the size of it, I assume it would be a video clip). After I copied it, I tried playing the file as is. Nothing happened. I changed its file type to AVI, MKV, WMV, MP4, etc... (yes, i turned on the "show known file extensions" so I'm sure I was changing the file type and not just changing the file name) it still wouldn't play.

So, now I think testdisk is able to see the files and know that there are files in the drive, it just can't read it right. Like i said in my previous post, I am a n00b x 10 ^ 34567 so I don't know what else to do.

I figured out the BB code thing so I'm hoping someone can shed some light now that I posted the pics instead of putting it in a zip file.

I chose SDA as test disk was able to identify the partition of SDB and SDC.
Image

As you can see, test disk did not have a "suggested" partition for my drive. I chose Intel.
Image

That's what I see when I started analyzing.
Image

I don't understand what those numbers are. I am not sure if it should be a logical or primary drive.
I am not even sure it if should be FAT.
Image

Et viola, this is the file list I see. I have not seen anyone post anything like this in the forums so I do not have anything to go on.
Image

I do not know what these mean. (Like I said, n00b).
Image

Deeper search gave me the same results as the first analysis.
Image
Image

I have also attached the (abridged) log file for this particular session. I would be ever so grateful to anyone who can help me.

Code: Select all

Sun Nov  8 19:11:33 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=750048509952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000396746752
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
filewin32_getfilesize(\\.\M:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\M:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\M:
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive C: - 750 GB / 698 GiB - CHS 91188 255 63, sector size=512
Drive D: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512

Partition table type default to Intel
Partition table type (auto): Intel
Partition table type default to Intel
Partition table type (auto): Intel
Partition table type default to Intel
Disk /dev/sdc - 2000 GB / 1863 GiB
Partition table type: Intel

Interface Advanced

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Partition table type default to Intel
Disk /dev/sdc - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
BAD_RS LBA=836683475 10673085
check_part_i386 failed for partition type 06
     FAT16 >32M           52081  35  6 64261  78 44  195674448

* A WHOLE BUNCH OF THESE - chaos13
file_pread(6,11,buffer,1911945342(119013/23/49)) ReadFile Data error (cyclic redundancy check).

file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument

Results
   L FAT16 >32M           52081  35  6 64261  78 44  195674448


dir_partition inode=0
   L FAT16 >32M           52081  35  6 64261  78 44  195674448
Directory /
* A WHOLE BUNCH OF THESE TOO - chaos13
 232761644 -rwxr-xr-x     0      0 1696384139 16-Jul-2016 11:00 ~	↑M￵ᄌs>.ᅴ	

add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         52081   0  1 64261 254 63  195687765
 5 L FAT16 >32M           52081  35  6 64261  78 44  195674448

search_part()
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
BAD_RS LBA=836683475 10673085
check_part_i386 failed for partition type 06
     FAT16 >32M           52081  35  6 64261  78 44  195674448

* A WHOLE BUNCH OF THESE AS WELL- chaos13
file_pread(6,16,buffer,568451072(35384/112/57)) ReadFile Data error (cyclic redundancy check)

file_pread(6,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(6,14,buffer,3907031041(243201/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,3907031055(243201/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,3907031102(243201/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,3907031118(243201/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,3907031165(243201/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,3907033087(243201/143/14)) lseek err Invalid argument

Results
   L FAT16 >32M           52081  35  6 64261  78 44  195674448


dir_partition inode=0
   L FAT16 >32M           52081  35  6 64261  78 44  195674448
Directory /
* DITTO - chaos13
 232761644 -rwxr-xr-x     0      0 1696384139 16-Jul-2016 11:00 ~	↑M￵ᄌs>.ᅴ	

dir_partition inode=69716919
   L FAT16 >32M           52081  35  6 64261  78 44  195674448
fat.c get_next_cluster unknown fat type
FAT: Directory entry is marked as free.
FAT: cluster=69716919(0x427cbb7), pos=130456605
file_pread(6,17613,buffer,674522782(576685/203/61)) lseek err Invalid argument
file_pread(6,2,buffer,674522782(576685/203/61)) lseek err Invalid argument
FAT: Can't read directory cluster.
Directory /ᆳ;Qツヒᅥᅴ.￵YN
Directory /
* DITTO again - chaos13
 232761644 -rwxr-xr-x     0      0 1696384139 16-Jul-2016 11:00 ~	↑M￵ᄌs>.ᅴ	

fat_copy dst=/testdisk-7.0/cネ<f0ノ■.}Hᆴ first_cluster=261300617 (386791772) size=117834641
file_pread(6,17613,buffer,2535139132(1761901/53/5)) lseek err Invalid argument
fat_copy: Can't read cluster 261300617.
fat.c get_next_cluster unknown fat type
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535156744(1761902/77/40)) lseek err Invalid argument
fat_copy: Can't read cluster 261300618.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535174356(1761903/102/12)) lseek err Invalid argument
fat_copy: Can't read cluster 261300619.
fat.c get_next_cluster unknown fat type
file_pread(6,17612,buffer,2535191968(1761904/126/47)) lseek err Invalid argument
fat_copy: Can't read cluster 261300620.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535209579(1761905/151/18)) lseek err Invalid argument
fat_copy: Can't read cluster 261300621.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535227191(1761906/175/53)) lseek err Invalid argument
fat_copy: Can't read cluster 261300622.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535244803(1761907/200/25)) lseek err Invalid argument
fat_copy: Can't read cluster 261300623.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535262415(1761908/224/60)) lseek err Invalid argument
fat_copy: Can't read cluster 261300624.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535280027(1761909/249/32)) lseek err Invalid argument
fat_copy: Can't read cluster 261300625.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535297639(1761911/19/4)) lseek err Invalid argument
fat_copy: Can't read cluster 261300626.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535315251(1761912/43/39)) lseek err Invalid argument
fat_copy: Can't read cluster 261300627.
fat.c get_next_cluster unknown fat type
file_pread(6,17612,buffer,2535332863(1761913/68/11)) lseek err Invalid argument
fat_copy: Can't read cluster 261300628.
fat.c get_next_cluster unknown fat type
file_pread(6,17613,buffer,2535350474(1761914/92/45)) lseek err Invalid argument
fat_copy: Can't read cluster 261300629.
fat.c get_next_cluster unknown fat type
file_pread(6,1193,buffer,2535368086(1761915/117/17)) lseek err Invalid argument
fat_copy: Can't read cluster 261300630.