Page 1 of 1

Can't open filesystem. Filesystem seems damaged

Posted: 07 Jul 2019, 19:15
by jorje
Hello Guys

I have lost access to my data, mostly family videos and photos ;( stored on Seagate Expansion 2000 GB
I followed steps in order:
- bought new storage Seagate Backup Plus
- raw copy Expansion to Backup Plus with HDD Raw Copy Tool
- and as log shows run below procedures with testdisk on raw backed up copy of original disk
- i took more than 9hrs to perform -->> Run TestDisk, Advanced, select the NTFS partition, Boot, RebuildBS, List.
As a result i couldn't see files, it says -->> Can't open file system. File system seems damaged.

Boot sectors are ok as in the logs... what else can I do? :(

Sun Jul 7 10:04:53 2019
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=512110190592
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=244012023808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=255987319296
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=257407582208
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=209715200000
filewin32_getfilesize(\\.\H:) GetFileSize err Niepoprawna funkcja.

filewin32_setfilepointer(\\.\H:) SetFilePointer err Niepoprawna funkcja.

Warning: can't get size for \\.\H:
filewin32_getfilesize(\\.\I:) GetFileSize err Niepoprawna funkcja.

filewin32_setfilepointer(\\.\I:) SetFilePointer err Niepoprawna funkcja.

Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=2000395698176
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - Samsung SSD 840 EVO, S/N:1SHDSNFA279724 W, FW:EXT0
Disk /dev/sdb - 512 GB / 476 GiB - CHS 62260 255 63, sector size=512 - Samsung SSD 850 PRO, S/N:3SF9XNH0096264 T, FW:EXM0
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate BUP Slim RD, S/N:NA9Y11YD, FW:0109

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - Seagate BUP Slim RD
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 24691562
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 24694666
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1638564066
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

mft at 1638567170
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 2058
ntfs_find_mft: mftmirr_lcn 5162
ntfs_find_mft: mft_record_size 1024

Potential partition:
1 P HPFS - NTFS 1536 249 26 244737 230 5 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
1 P HPFS - NTFS 101995 228 18 345196 208 60 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.

1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 13 12 3907022848
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907022848
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Re: Can't open filesystem. Filesystem seems damaged

Posted: 08 Jul 2019, 06:09
by cgrenier
Try PhotoRec. It should recover your lost files (but without the original filenames).
Read https://www.cgsecurity.org/testdisk.pdf it contains tips on how to sort the recovered files.