Issues with a partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
cgauffin
Posts: 4
Joined: 26 Apr 2015, 11:08

Issues with a partition

#1 Post by cgauffin »

Hi

I'm having some issues with my external hdd that crashed.
So I took it out and put it into my computer to fix the errors.

Now I've broken the case and the disk still don't work.
I've run testdisk and copied all the files I could, but I can't copy it all since I don't have any space left.
I did have a drive letter on it before but something I've probably done have now removed it.

Can someone help me to read my log and help me to figure out what's wrong.

The disk identifies as a EFI/GPT table with NTFS file structure. The sector size might be the problem since it keeps telling me that I've got 512 and that NTFS runs at 4096. but I don't have a clue.

I've tried to rebuild the boot sector but when I go thru the process it can't show my files anymore so I don't dare to overwrite. I've tried a lot of different settings there.
My Backup boot sector only shows 000000 and so on. So I've tried to copy my original to the backup but only gets an error saying that it "Can't overwrite NTFS backup boot sector".

PLEASE help me.//CG

cgauffin
Posts: 4
Joined: 26 Apr 2015, 11:08

Re: Issues with a partition

#2 Post by cgauffin »

Sun Apr 26 11:51:17 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1000202241024
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000200176128

Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Drive C: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive E: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdc - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Analyse Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]

search_part()
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732563456
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 366281727
clusters_per_mft_record 1
clusters_per_index_record 1
NTFS part_offset=8388608, part_size=3000579915776, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
filesystem size 732563456
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 366281727
clusters_per_mft_record 1
clusters_per_index_record 1
MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(6,1,buffer,1565565872(364801/81/1)) ReadFile Begäran kunde inte utföras på grund av ett fel i en I/O-enhet.

file_pread(6,1,buffer,1565565873(364801/81/2)) lseek err Invalid argument
file_pread(6,1,buffer,1565565874(364801/81/3)) lseek err Invalid argument
file_pread(6,1,buffer,1565565875(364801/81/4)) lseek err Invalid argument

*80 pages of similar errors cut out*
_______________________________________________________________


Results
P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS filesystem need to be repaired.


dir_partition inode=5
P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Directory /
5 dr-xr-xr-x 0 0 0 8-Apr-2015 00:13 .
5 dr-xr-xr-x 0 0 0 8-Apr-2015 00:13 ..
1701 dr-xr-xr-x 0 0 0 17-Jan-2015 20:43 $RECYCLE.BIN
28436 dr-xr-xr-x 0 0 0 11-Dec-2013 00:32 Bilder
28811 dr-xr-xr-x 0 0 0 13-Aug-2014 01:36 Bilder 2
15637 dr-xr-xr-x 0 0 0 13-Dec-2014 15:40 Projekt
15426 dr-xr-xr-x 0 0 0 15-Jan-2015 04:11 Foton
30417 dr-xr-xr-x 0 0 0 27-Apr-2013 21:28 Foton 2
41692 dr-xr-xr-x 0 0 0 13-Jul-2014 12:43 Program
43529 dr-xr-xr-x 0 0 0 15-Dec-2014 19:11 Webb
44338 dr-xr-xr-x 0 0 0 4-May-2014 18:16 Övrigt
11846 dr-xr-xr-x 0 0 0 19-Apr-2014 02:19 0f0a5875d687d26b5bc2d9689c7b20b9
15195 dr-xr-xr-x 0 0 0 21-Apr-2014 15:23 520dce4480b40d7403d86e
16851 dr-xr-xr-x 0 0 0 18-Sep-2014 17:40 6ac9d3c36a554262e8f29b
15260 dr-xr-xr-x 0 0 0 21-Apr-2014 16:37 6be4cea83ff0e34dda05390c
16685 dr-xr-xr-x 0 0 0 13-Dec-2014 15:04 Jobb
15144 dr-xr-xr-x 0 0 0 12-Feb-2014 11:04 My Online Documents
15415 dr-xr-xr-x 0 0 0 17-Jan-2015 18:50 Ny mapp
27 dr-xr-xr-x 0 0 0 14-Dec-2012 13:32 System Volume Information
15411 dr-xr-xr-x 0 0 0 15-Jan-2015 21:42 UserBenchmark
1594 dr-xr-xr-x 0 0 0 13-May-2014 19:36 d217ad22a89c1b308c3d90
127845 dr-xr-xr-x 0 0 0 8-Apr-2015 00:14 Ö2
26104 dr-xr-xr-x 0 0 0 19-Mar-2015 21:41 öööööTransfere

interface_write()
1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
simulate write!
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860533167 (expected 5860533167)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB

ntfs_boot_sector
1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Info: size boot_sector 732563456, partition 1565540352
filesystem size 732563456 1
sectors_per_cluster 1 0
mft_lcn 786432 0
mftmirr_lcn 366281727 0
clusters_per_mft_record 1 0
clusters_per_index_record 1 0
Boot sector
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
Failed to startup volume: Input/output error.
$MFTMirr location mismatch or first 4 records are fragmented. Run chkdsk.
Failed to load $MFTMirr: Input/output error.
rebuild_NTFS_BS
mft at 2930253816
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096

mft at 6291456
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 5860507648 732563456
sectors_per_cluster 8 1
mft_lcn 786432 786432
mftmirr_lcn 0 366281727
clusters_per_mft_record 1 1
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 5860507648 732563456
sectors_per_cluster 8 1
mft_lcn 786432 786432
mftmirr_lcn 0 366281727
clusters_per_mft_record 1 1
clusters_per_index_record 1 1

1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.
filesystem size 5860507648 732563456
sectors_per_cluster 8 1
mft_lcn 786432 786432
mftmirr_lcn 0 366281727
clusters_per_mft_record 1 1
clusters_per_index_record 1 1

ntfs_boot_sector
1 P MS Data 16384 5860524031 5860507648 [Seagate Backup Plus Drive]
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 1/5/5
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Info: size boot_sector 732563456, partition 1565540352
filesystem size 732563456 1
sectors_per_cluster 1 0
mft_lcn 786432 0
mftmirr_lcn 366281727 0
clusters_per_mft_record 1 0
clusters_per_index_record 1 0
Boot sector
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Status: OK

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Issues with a partition

#3 Post by Fiona »

Boot sector size can be changed using the menu geometry and boot sector size.
Currently 512 and should be 4096 in your case.
But read at the bottom of your screen, it's very dangerous.
As long as you don't use in TestDisk the menu WRITE or Repair MFT etc.., nothing should be changed.
But if this improves the result of listing files, copying files to another intact disk or partition might be improved.
Until yet I've seen that your backup of your boot sector is bad.
In case I don't recommend to use OrgBS.
The backup of your boot sector is located at the end of your partition.
Modifying it could change your file system.
Also, if you were building in your disk internally, perhaps it caused your sector size issue?

Fiona

cgauffin
Posts: 4
Joined: 26 Apr 2015, 11:08

Re: Issues with a partition

#4 Post by cgauffin »

Thanks for a quick response!
Unfortunately it didn't help at all.
As soon as I make the change too 4096 it jumps back to 512 again.

Any idea why?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Issues with a partition

#5 Post by Fiona »

No, I've no idea why it jumps back?
The value should be normally kept during the whole session?
Obviously if you close testdisk the value gets lost.
But this is intended, because you shouldn't use Write to avoid any changes.
Now I've broken the case and the disk still don't work.
Can you put your disk back into your enclosure and run another diagnose?
Only in case if it'd be still working?

Fiona

cgauffin
Posts: 4
Joined: 26 Apr 2015, 11:08

Re: Issues with a partition

#6 Post by cgauffin »

Thanks but no it doesn't work.

I've given up on the information and I've tried to save the HD.
Unfortunately I can't even reformat it.
It keeps getting I/O errors and read errors and I can't even get chkdsk to run on it now.
All help is appreciated if anyone have a good tool.
I have tried all I know of and some that I probably shouldn't have tried.

Locked