2TB wraparound Intel storage matrix driver fault.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zazzn
Posts: 10
Joined: 08 May 2014, 00:35

2TB wraparound Intel storage matrix driver fault.

#1 Post by zazzn »

Hello,

I'm writing here for hope that someone can help me restore my partition to working order.

After finding a thread http://hardforum.com/showpost.php?p=103 ... ostcount=4 regarding the corruption of disks after writing more than 2 TB I realized this must be my problem. Initially, I posted about recovery regarding a drive that went raw 3 months or so ago on here, and chalked it up to a bad drive / earthquake. After replacing that drive, and copying data to it, the drive corrupted again in the same fashion. Looking at the disk with WinHex, I can see after a set amount of sectors there is nothing but zeros. Meaning that there is no data, which cemented the fact that the issue i'm facing is the 2TB limit wraparound bug.

Basically, after writing 2 TB, driver doesn't know how to address further, so it starts writing over the start of the drive at which point it writes over the partition information or MFT. By doing this, the drive shows up in windows as RAW but partitioned correctly.

When i try to recover the MFT via test disk it does not work and claims that both the mirror and the main MFT are corrupt. I was able to see the MFT files in WinHex, and extracted them to another disk (i do not know if these are the original or even good ones, as they just showed up under a directory in winhex when exploring the disk)

What I would like to know is if there is any way I can recover or manually insert the MFT files again so that the disk recognizes where the files start and stop so I can recover the disk with out brute force searching for indicators of files with various apps like NTFS getdataback ect.

The primary boot sector was showing inconsistent data, but that is fine because this is not a bootable disk it was a backup 4TB disk in my home sever.

I have 3 of these 4TB disks currently and they were all formatted in the same way.

zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Re: 2TB wraparound Intel storage matrix driver fault.

#2 Post by zazzn »

Alright after a lot of reading testing and backing up i found this thread, which actually looks and is very helpful.

They shead a lot of light on what the MFT is and how it works. That along with some other sites made me understand the concepts of what it does.

http://www.tomshardware.com/answers/id- ... ctors.html

Then there is this gold mine for recovery outside of software that should be posted here on the first page of Testdisk.
This explains how to recover disks on the hardware level how they work and what can be done. I think this was at a past defcon, basically any home user that will not spend 3k to recover data, this will teach you how to attempt your self if it's worth a few bucks but not thousands or more of your time then money.

https://www.youtube.com/watch?v=BWSzSeQm7pE


Finally, back to my issue, i've made no progress, I noticed that the boot sector was corrupt, along with the some of the partition info, it's strange because the whole sector was not corrupt. Even if I copy the correct info in there form a known same drive partitioned and formatted the same, it does not seem to fix the drive. I also the MFT has issues because when i try to use WinHex, it does view some of the files on the disk but only 46 of thousands, I don't know what can intelligently look and try to repair the MFT. Or if there is anything like that at all.

I wish I wasn't shooting so far in the dark here, it's so hard to find ACTUAL good data on the internet on how to rebuild manually a boot sector/partition table though a hexeditor using using the default template from a good known working drive, or the standard values for GPT partition ect.

IE what sectors to modify via the calculations like hidden sectors + this number = where your partition table sector should be for that partition.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: 2TB wraparound Intel storage matrix driver fault.

#3 Post by cgrenier »

If the boot sector is corrupted, run TestDisk, Advanced, Boot, BackupBS to use the backup boot sector.
If both the boot sector and its backup are corrupted, run TestDisk, Advanced, Boot, RebuildBS, List and if you can see your files, choose Write and confirm.
If the boot sector and its backup are ok and the MFT is corrupted and ONLY in this case, run TestDisk, Advanced, Boot, Repair MFT.

zazzn
Posts: 10
Joined: 08 May 2014, 00:35

Re: 2TB wraparound Intel storage matrix driver fault.

#4 Post by zazzn »

Hi there CGrenier,

Looks like the BS's where corrupted, and I saw that in winhex when I looked, I have another disk which was identical in terms of the way it was GPT/NTFS. Testdisk verified that both were corrupt and re-wrote the standard boot sectors. However, when I choose repair MFT it fails but if i go in winhex and search for the MFT at the default start location + hidden sectors in winhex, i'll find the FILE0 which usually means it's the MFT so I'm not sure why it's failing.

Going to check winhex now to see where the MFT start location is and if it's correct!

Any other suggestions would be helpful!

Locked