recover external harddrive

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
DerickKuch
Posts: 4
Joined: 30 Sep 2014, 17:56

recover external harddrive

#1 Post by DerickKuch »

Testdisk has said The disk seems too small! Unable to recover.

Below i have included a log, is there anything i can do at this point to reocover the data?

http://pastebin.com/FtaYqKef

Code: Select all

Mon Sep 29 08:23:46 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, August 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2014-09-25T08:47:05
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119926685696
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202240512
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=500104691712
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - HDS725050KLA360, S/N:202020202020524b4e563536415a41484c33464b, FW:K2AOAB0A
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - KINGSTON SH103S3120G, S/N:3035323042363237413337303130383920202020, FW:507KC4
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST910004 30AS

Partition table type (auto): Intel
Disk /dev/sdc - 1000 GB / 931 GiB - ST910004 30AS
Partition table type: Intel

Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=62
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
Invalid NTFS or EXFAT boot
 1 P HPFS - NTFS              0   1  1 121600 254 62 1953520001
 1 P HPFS - NTFS              0   1  1 121600 254 62 1953520001
No partition is bootable

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4152106017 952922
file_pread(6,3,buffer,4152106017(258456/164/46)) lseek err Invalid argument
file_pread(6,1,buffer,4152106017(258456/164/46)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
     FAT16 <32M           258456 164 46 510154  75 50 4043522768
This partition ends after the disk limits. (start=4152106017, size=4043522768, end=8195628784, disk end=1953525168)
BAD_RS LBA=3153245888 11988143
file_pread(6,3,buffer,3153245888(196280/122/3)) lseek err Invalid argument
file_pread(6,1,buffer,3153245888(196280/122/3)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M           196280 122  3 323887 250 20 2050014537
This partition ends after the disk limits. (start=3153245888, size=2050014537, end=5203260424, disk end=1953525168)
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4196 GB / 3907 GiB)
The following partitions can't be recovered:
     FAT16 >32M           196280 122  3 323887 250 20 2050014537
     FAT16 <32M           258456 164 46 510154  75 50 4043522768

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4152106017 952922
file_pread(6,3,buffer,4152106017(258456/164/46)) lseek err Invalid argument
file_pread(6,1,buffer,4152106017(258456/164/46)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
     FAT16 <32M           258456 164 46 510154  75 50 4043522768
This partition ends after the disk limits. (start=4152106017, size=4043522768, end=8195628784, disk end=1953525168)
BAD_RS LBA=3153245888 11988143
file_pread(6,3,buffer,3153245888(196280/122/3)) lseek err Invalid argument
file_pread(6,1,buffer,3153245888(196280/122/3)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M           196280 122  3 323887 250 20 2050014537
This partition ends after the disk limits. (start=3153245888, size=2050014537, end=5203260424, disk end=1953525168)
file_pread(6,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(6,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(6,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(6,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(6,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(6,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(6,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(6,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4196 GB / 3907 GiB)
The following partitions can't be recovered:
     FAT16 >32M           196280 122  3 323887 250 20 2050014537
     FAT16 <32M           258456 164 46 510154  75 50 4043522768

Results

interface_write()
 
No partition found or selected for recovery
Failed to startup volume: Invalid argument.
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=62
check_part_i386 failed for partition type 07
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
 1 P HPFS - NTFS              0   1  1 121600 254 62 1953520001
Not an exFAT boot sector.

 1 P HPFS - NTFS              0   1  1 121600 254 62 1953520001
Can't open filesystem. Filesystem seems damaged.
SIGHUP detected! TestDisk has been killed.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: recover external harddrive

#2 Post by Fiona »

I assume that your Fat16<32M-partition is wrong?
It ends after disk limit, that's why it's not recoverable.
Did you only have 1 NTFS partition using the whole space?
Did you run a full scan of Deeper Search?
Might be possible that more partitions are found using backup boot sector.
Did you run a RebuildBS?
It's as long as you don't confirm at Write only a diagnose.
If it's successful, you can use the menu List to have another try to list your data.

Fiona

DerickKuch
Posts: 4
Joined: 30 Sep 2014, 17:56

Re: recover external harddrive

#3 Post by DerickKuch »

This is a clients external. I'm assuming it only has one partition. The deeper scan showed the same info quickscan did. The disk seems too small. I'm not sue what do next. I have only run scans on the disk.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: recover external harddrive

#4 Post by Fiona »

Can you try to run a RebuildBS?
You'll find it at TestDisk / Advanced and Boot.
TestDisk will check your file system using the MFT and its mirror and will display the result.
If it's successful, you can use the menu List to have a try to list your data.
Please let me know the result.
Until yet, you shouldn't use the menu Write nor Repair MFT.
Please copy the content of your testdisk.log into your next post.

Fiona

DerickKuch
Posts: 4
Joined: 30 Sep 2014, 17:56

Re: recover external harddrive

#5 Post by DerickKuch »

Okay, so first i tried to use the backup BS, and it said the disk was corrupt and unreadable.. still atleast its not saying i need to reformat now.

Im using the rebuildBS as we speak and its scanning the disk right now. I will post the log as soon as im done.

EDIT: It also knows the partition is NTFS and not Fat now... so thats also another step in the right direction.

I created a sector by sector backup and am running Photorec on it atm. It has recovered some 9000 files so far. Thats good. If anything there will be recovered data. It is a FULL 1TB hard drive so im sure Photorec is going to take a long time on that. Its been 17 hours so far.

Locked