Photorec only recovers manuals from external drive

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
SirCoffee
Posts: 3
Joined: 21 Jul 2015, 21:10

Photorec only recovers manuals from external drive

#1 Post by SirCoffee »

Hi guys,

I'm having an issue with my brothers external harddrive.
He broke the usbport on the case, so I opend it and removed the HDD. It couldn't be accessed by an USB-to-SATA adapter so I attached it directly to the SATA port in my PC.
I wasn't able to access the drive with windows nor with ubuntu (live). Meaning that it wasn't accessible through the explorer, however it was listed under the disk management of Windows, whereas I was asked to reinitialize it. In a first try I DIDNT do that.
I tried testdisk, but couldn't recreate the partition.
I tried photorec but were only be able to rescue about 19 GB (from roughly 250GB) worth of manuals from Western Digital and about 5 *.gpg files with 3 GB each. Plus hundreds of 1KB *.txt, *.html and *.png files. From Western Digital as well I s'pose.
So I reinitialized it with Disk Management under Windows 7.
Photorec still recovers only manuals, *.gpg files and the others.
So I added a new volume (formated the drive) under Windows.
Same with photorec after that.

The whole thing is kinda strange!
Can anyone help? Or do I have to tell my brother the bad news that his data is gone?


Thanks a lot for any hint!

Cheers

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Photorec only recovers manuals from external drive

#2 Post by Fiona »

Windows initializing will only write a 4 Bytes signatur to your MBR/Partition table (also GPT) so that windows can handle your HDD.
Without initializing you cannot write your partition into your partition table.
This behavior is since W2k.
Somehow, a lot of people are afraid of, but I've had a certain amount of user where solved their problems after windows initializing successful.
Creating a partition after initializing and formatting should be avoided because testdisk can search for partitions instead and recover them.
The initializing message often appears if the MBR or GPT is corrupt or not available anymore.
But note, it's different to initalizing using any hardwarecontroller like RAID.
If RAID suggests to initialize, there is a possibility that a safe erase will override each sector.
Datarecovery wouldn't be possible anymore.

Creating a partition equalliy to your previous partition and formatting it will override your underlying file system.
In case you'll need datarecovery software.
If you're unsure or you didn´t format equally you can run testdisk / Aanlyse / Quick Search and if nothing would be found Deeper Search also.
You can select your found partitions and press p to have a try to list your files.
If you can list your data you can recover it.
If you only see an empty file system, your file system is probably overridden and you'll need datarecovery software.
Can you copy and paste the content of your testdisk.log into your next post?

Fiona

SirCoffee
Posts: 3
Joined: 21 Jul 2015, 21:10

Re: Photorec only recovers manuals from external drive

#3 Post by SirCoffee »

Hi Fiona,

Last night I ran testdisk but I can't list any files (by pressing "p"). same by using Advanced / List files
Do you have any recommendation how to recover the data.

below the contents of the logfile.

Thank you for your help :)


Wed Jul 22 19:00:55 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=500107862016
filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\PhysicalDrive2
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=240155361280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000169537536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=0
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=499971522560
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512
Drive C: - 240 GB / 223 GiB - CHS 29197 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512
Drive F: - 499 GB / 465 GiB - CHS 60784 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdb - 500 GB / 465 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 267349 89 4 4294967295

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 16/113/34
filesystem size 976506880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB
file_pread(5,2,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,2,buffer,976773200(60801/81/33)) lseek err Invalid argument
file_pread(5,1,buffer,976773200(60801/81/33)) lseek err Invalid argument
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,8,buffer,976773376(60801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,976773504(60801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,976773632(60801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,976773760(60801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,976773888(60801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,976774016(60801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,976774144(60801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,976774272(60801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,976774400(60801/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,976774528(60801/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,976774656(60801/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,976774784(60801/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,976774912(60801/108/44)) lseek err Invalid argument
file_pread(5,8,buffer,976775040(60801/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,13,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(5,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(5,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(5,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(5,2,buffer,976777215(60801/145/16)) lseek err Invalid argument

Results
* HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB

interface_write()
1 P HPFS - NTFS 16 113 34 60801 47 46 976506880

search_part()
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 16/113/34
filesystem size 976506880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB
NTFS at 60801/47/46
filesystem size 976506880
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS found using backup sector, blocksize=4096, 499 GB / 465 GiB
file_pread(5,2,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,2,buffer,976773200(60801/81/33)) lseek err Invalid argument
file_pread(5,1,buffer,976773200(60801/81/33)) lseek err Invalid argument
file_pread(5,3,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,1,buffer,976773183(60801/81/16)) lseek err Invalid argument
file_pread(5,8,buffer,976773199(60801/81/32)) lseek err Invalid argument
file_pread(5,11,buffer,976773246(60801/82/16)) lseek err Invalid argument
file_pread(5,2,buffer,976775168(60801/112/48)) lseek err Invalid argument
file_pread(5,8,buffer,976773376(60801/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,976773504(60801/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,976773632(60801/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,976773760(60801/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,976773888(60801/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,976774016(60801/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,976774144(60801/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,976774272(60801/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,976774400(60801/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,976774528(60801/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,976774656(60801/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,976774784(60801/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,976774912(60801/108/44)) lseek err Invalid argument
file_pread(5,8,buffer,976775040(60801/110/46)) lseek err Invalid argument
file_pread(5,1,buffer,976775167(60801/112/47)) lseek err Invalid argument
file_pread(5,13,buffer,976775170(60801/112/50)) lseek err Invalid argument
file_pread(5,3,buffer,976775183(60801/112/63)) lseek err Invalid argument
file_pread(5,3,buffer,976775230(60801/113/47)) lseek err Invalid argument
file_pread(5,8,buffer,976775246(60801/113/63)) lseek err Invalid argument
file_pread(5,11,buffer,976775293(60801/114/47)) lseek err Invalid argument
file_pread(5,2,buffer,976777215(60801/145/16)) lseek err Invalid argument

Results
* HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB


dir_partition inode=5
* HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 .
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 ..
37 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 21-Jul-2015 03:23 System Volume Information


dir_partition inode=5
* HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 .
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 ..
37 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 21-Jul-2015 03:23 System Volume Information

dir_partition inode=35
* HPFS - NTFS 16 113 34 60801 47 46 976506880
NTFS, blocksize=4096, 499 GB / 465 GiB
Directory /System Volume Information
35 dr-xr-xr-x 0 0 0 21-Jul-2015 03:23 .
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 ..
41 -r--r--r-- 0 0 131072 22-Jul-2015 07:48 001.dat
40 -r--r--r-- 0 0 131072 21-Jul-2015 19:18 002.dat
36 -r--r--r-- 0 0 20480 21-Jul-2015 19:18 tracking.log
Directory /
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 .
5 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 ..
37 dr-xr-xr-x 0 0 0 21-Jul-2015 03:15 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 21-Jul-2015 03:23 System Volume Information

interface_write()
1 * HPFS - NTFS 16 113 34 60801 47 46 976506880
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
1 P EFI GPT 0 0 2 267349 89 4 4294967295
SIGINT detected! TestDisk has been killed.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Photorec only recovers manuals from external drive

#4 Post by cgrenier »

Try again PhotoRec, in Options, enable the expert mode, start a recovery, use a 512 byte blocksize, use the default options otherwise. Does it recover more files this way ?

SirCoffee
Posts: 3
Joined: 21 Jul 2015, 21:10

Re: Photorec only recovers manuals from external drive

#5 Post by SirCoffee »

Hi cgrenier,

thanks for your hint, but unfortunately it recovers still the exact same file...

does anything else come to your mind?

Locked