Action replay...

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ting
Posts: 5
Joined: 28 Dec 2019, 14:00

Action replay...

#1 Post by ting »

Hi Christophe,

This is something of an "action replay" on my previous post - check_part_gpt failed for partition [viewtopic.php?f=6&t=9729#p29796]

As per your suggestion in the previous post, I managed to restore my 2 external hard drives. So far, so good.

Some weeks ago, I upgraded my DAM - digital asset management - application. All I have on this drive are camera RAW files - over 3 TB or a 4 TB drive. And, let's just say, things went from bad to worse. The external hard drive system kept "hanging". Looking in the WIN 10 Event Viewer, a "finger" was continually being pointed at the UASPStor driver. My typical recourse to action was to try and shutdown the hard drive caddie. If not via the "remove hardware" feature in hidden icons box then, going into device manager to remove the driver and restart the system, etc. Then, over this past weekend, the drive went RAW.

Time to fire up TestDisk. Ran a "quick scan" - as in 2 full days later. Of note here - no issues with the hard drive caddie while running the scan. This has me thinking that the DAM app may now be the cause. But, whatever, things now don't look good.

Here are extracts from the TestDisk log:
Sun Jan 19 14:34:23 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, December 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=237979566080
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000068874240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=4000650887168
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM035-1RK172, S/N:WDEJGEDP, FW:SDM3
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - PM961 NVMe SAMSUNG 256GB, S/N:0025_38B6_71B1_63D8., FW:CXB73D1Q
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - USB3.0 , S/N:2017030601EB, FW:0101

Partition table type (auto): EFI GPT
Disk /dev/sdc - 4000 GB / 3726 GiB - USB3.0
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037167 (expected 7814037167)
hdr_lba_start=34
hdr_lba_end=7814037134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 7814035455 7813771264 [Basic data partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
2 P MS Data 264192 7814035455 7813771264 [Basic data partition]

Analyse Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=7814037167 (expected 7814037167)
hdr_lba_start=34
hdr_lba_end=7814037134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 7814035455 7813771264 [Basic data partition]
Current partition structure:
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 7814035455 7813771264 [Basic data partition]
2 P MS Data 264192 7814035455 7813771264 [Basic data partition]

search_part()
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63
NTFS at 0/32/33
filesystem size 4294963200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=2199021158400, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 4294963200
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 4294965247 4294963200
NTFS, blocksize=4096, 2199 GB / 2047 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 4649743717 6638003368 1988259652
FATX, 1017 GB / 948 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
file_pread(6,16,buffer,379030608(290942/232/59)) ReadFile Data error (cyclic redundancy check).

file_pread(6,16,buffer,379030609(290942/232/60)) ReadFile Data error (cyclic redundancy check).
[snip] a whole lot of lines of much the same thing [snap]
Half way through the log, we have this:

NTFS at 307631/72/43
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 1035071698 4942096593 3907024896
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 307631/72/43
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 4942096593 8849121488 3907024896
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=4942096593, size=3907024896, end=8849121488, disk end=7814037168)

LVM magic value at 309798/238/29

LVM magic value at 318942/93/30

SYSV4 Marker at 332762/184/16

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 5345833137 427908100190384 427902754357248 [M3&iT·]
SysV4, 219086 TB / 199257 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 347939/245/7
file_pread(6,1,buffer,3519069872(486401/81/1)) ReadFile The drive cannot find the sector requested.

file_pread(6,1,buffer,3519069873(486401/81/2)) lseek err Invalid argument
file_pread(6,1,buffer,3519069874(486401/81/3)) lseek err Invalid argument
file_pread(6,1,buffer,3519069875(486401/81/4)) lseek err Invalid argument
[snip] lots of lines of much the same thing [snap]
At the tail end of the log we have this:
file_pread(6,1,buffer,3519070008(486401/83/11)) lseek err Invalid argument
file_pread(6,1,buffer,3519071921(486401/113/34)) lseek err Invalid argument
Disk /dev/sdc - 4000 GB / 3726 GiB - CHS 486401 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (4000 GB / 3726 GiB) seems too small! (< 8001 GB / 7451 GiB)
The following partitions can't be recovered:
MS Data 4942096593 8849121488 3907024896
NTFS, blocksize=4096, 2000 GB / 1863 GiB
MS Data 7814035455 15627806718 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB

Results
MS Data 2048 4294965247 4294963200
NTFS, blocksize=4096, 2199 GB / 2047 GiB
MS Data 264192 7814035455 7813771264
NTFS found using backup sector, blocksize=4096, 4000 GB / 3725 GiB
MS Data 1035071698 4942096593 3907024896
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB

interface_write()

No partition found or selected for recovery

interface_write()

No partition found or selected for recovery

interface_write()

No partition found or selected for recovery

interface_write()

No partition found or selected for recovery

interface_write()
1 P MS Data 264192 7814035455 7813771264
write!
No extended partition

ntfs_boot_sector
1 P MS Data 264192 7814035455 7813771264
NTFS found using backup sector, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
filesystem size 1 7813771264
sectors_per_cluster 0 8
mft_lcn 0 2
mftmirr_lcn 0 49
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad

Backup boot sector
Status: OK

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
copy backup boot sector over boot sector

ntfs_boot_sector
1 P MS Data 264192 7814035455 7813771264
NTFS found using backup sector, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 49
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
repair_MFT
NTFS at 16/113/34
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.

ntfs_boot_sector
1 P MS Data 264192 7814035455 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 49
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
repair_MFT
NTFS at 16/113/34
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.

ntfs_boot_sector
1 P MS Data 264192 7814035455 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 49
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.

1 P MS Data 264192 7814035455 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
Can't open filesystem. Filesystem seems damaged.

ntfs_boot_sector
1 P MS Data 264192 7814035455 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 49
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
Failed to startup volume: No such file or directory.
Failed to open $MFT/$BITMAP: No such file or directory.
ntfs_mft_load(): Failed.
Failed to load $MFT: No such file or directory.
repair_MFT
NTFS at 16/113/34
MFT and MFT mirror are bad. Failed to repair them.
MFT and MFT mirror are bad. Failed to repair them.

ntfs_boot_sector
1 P MS Data 264192 7814035455 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
NTFS at 16/113/34
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 2
mftmirr_lcn 49
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.

TestDisk exited normally.
As I think can be observed from above, I ran some of the options in TestDisk. While it seems that I "successfully" restored the Boot Sector, I kept on getting:
MFT and MFT mirror are bad. Failed to repair them.
and
Can't open filesystem. Filesystem seems damaged.
Kind of doesn't look good does it? Any advice?

Ting
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Action replay...

#2 Post by cgrenier »

The log shows "cyclic redundancy" errors, there are bad sectors on the disk.
If you have data to recover, you should clone the disk to a new empty 4 TB or + disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once the copy is done, remove the original disk and try to recover your files from the clone.
If possible, use the warranty to replace the damaged disk.
Top
ting
Posts: 5
Joined: 28 Dec 2019, 14:00

Re: Action replay...

#3 Post by ting »

Thank you again Chrisophe,

Yup, have suspected as much - as in replacing the affected hard drive. It is still under warranty. So, there is that.

I'll do as suggested - as in cloning the affected hard drive and working on recovering data. While all the camera RAW image file are on a back up drive, substantial changes were made to the image metadata - as in the associated .XMP files. I would be keen to recover that data.

Thank you once again,

ting
Top
Locked

Return to “Filesystem repair”