cgsecurity.org

Hi,

i got a problem with a 5 TB QNAP NAS which is attached via ISCSI to Windows.

I had to restart the QNAP because it says i have to format it, because it seems to be a RAW partition and unpartitioned in another volume.

After the reboot it kept saying this. I have seen that the 5 TB Partition turned to MBR which is not correct.

With the tool Aomei Partition Assitant i have changed the disk layout from MBR to GPT.

After this it remained the same problem.

With diskpart i have analysed the partition.

Here i found my right partition and have also access to the data.

I tried to write the partition table to disk, but without success.

After that it told me to restart, so i restarted the QNAP and the server. Without any success. The partition still remains RAW and is not seen in the OS.

Please help me. Thank you very much

Attached are some Screenshots.https://icsit2018-my.sharepoint.com/:f: ... w?e=gHPXqP


https://icsit2018-my.sharepoint.com/:f: ... w?e=gHPXqP

Run TestDisk, Create a log file, select /dev/sdd, EFI GPT, Analyse, Quick Search, Write, confirm, Quit
If it doesn't solve the problem, run testdisk again, choose Append, /dev/sdd, EFI GPT, Analyze, Quit and post the new testdisk.log file

Thank you,

i did the first step of your answer.

The partition is RAW like before.

I didn't restart the server. Should i restart Server and QNAP NAS?

Here is the log:



Wed Jan 29 17:26:49 2020
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows Server 2008 R2 (7601) SP1
Compiler: GCC 7.4, Cygwin32 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=123480309760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=461708984320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=128849018880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=5497558138880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=123480309760
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=461708984320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=128849018880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=5497558138880
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=123372306432
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2199023255040
Hard disk list
Disk /dev/sda - 123 GB / 115 GiB - CHS 15012 255 63, sector size=512 - VMware Virtual disk, S/N:6000c29f474604a723f04b51f60010c3, FW:1.0
Disk /dev/sdb - 461 GB / 430 GiB - CHS 56132 255 63, sector size=512 - VMware Virtual disk, S/N:6000c2991ee30eddf16d853f1a846e9a, FW:1.0
Disk /dev/sdc - 128 GB / 120 GiB - CHS 15665 255 63, sector size=512 - VMware Virtual disk, S/N:6000c2943e90ee0bf79b6727fb97079e, FW:1.0
Disk /dev/sdd - 5497 GB / 5120 GiB - CHS 668373 255 63, sector size=512 - QNAP iSCSI Storage, S/N:136a6d61-a08a-4e46-8a56-c00505f1a229, FW:4.0

Partition table type (auto): EFI GPT
Disk /dev/sdd - 5497 GB / 5120 GiB - QNAP iSCSI Storage
Partition table type: EFI GPT

Analyse Disk /dev/sdd - 5497 GB / 5120 GiB - CHS 668373 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=10737418239 (expected 10737418239)
hdr_lba_start=34
hdr_lba_end=10737418206
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Data 32768 4295000062 4294967295 [Basic data partition]
Current partition structure:
Error: size boot_sector 2147446784 > partition 4294967295
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Data 32768 4295000062 4294967295 [Basic data partition]
1 P MS Data 32768 4295000062 4294967295 [Basic data partition]

search_part()
Disk /dev/sdd - 5497 GB / 5120 GiB - CHS 668373 255 63
NTFS at 2/10/9
filesystem size 10737381376
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=16777216, part_size=5497539264512, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 2/10/9
filesystem size 10737381376
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 32768 10737414143 10737381376 [Veeam]
NTFS, blocksize=4096, 5497 GB / 5119 GiB
file_pread(7,1,buffer,2147483648(668373/95/11)) ReadFile Das Laufwerk kann den angeforderten Sektor nicht finden.


file_pread(7,8,buffer,2147483726(668373/96/26)) lseek err Invalid argument
file_pread(7,11,buffer,2147483773(668373/97/10)) lseek err Invalid argument
file_pread(7,1,buffer,2147485696(668373/127/43)) lseek err Invalid argument
file_pread(7,7,buffer,2147483649(668373/95/12)) lseek err Invalid argument
file_pread(7,8,buffer,2147483656(668373/95/19)) lseek err Invalid argument
file_pread(7,1,buffer,2147483666(668373/95/29)) lseek err Invalid argument
file_pread(7,1,buffer,2147483713(668373/96/13)) lseek err Invalid argument
file_pread(7,1,buffer,2147483734(668373/96/34)) lseek err Invalid argument
file_pread(7,1,buffer,2147483784(668373/97/21)) lseek err Invalid argument
file_pread(7,1,buffer,2147485697(668373/127/44)) lseek err Invalid argument

Results
P MS Data 32768 10737414143 10737381376 [Veeam]
NTFS, blocksize=4096, 5497 GB / 5119 GiB

interface_write()
1 P MS Data 32768 10737414143 10737381376 [Veeam]
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

i did the second part of your idea.

Here is the log file:

https://icsit2018-my.sharepoint.com/:u: ... g?e=D7VFNj

IT WORKS!!!!!



I restarted the Server and now i got the partition back!!!!!


Thank you very much for your great help.

I wish you all the best