No partition found or selected for recovery after Deep Scan

[marcoborsoi]

Hello!
So, I had a machine with 2 Western Digital Caviar Blue Serial ATA 320GB working in RAID 1 (not sure, but I know that it was a RAID for performance).
About 2 years I built a new machine using a SSD of 120GB to install Windows 8 and I formatted the 2 Western Digital to use them to store my data.

Last week one of the WD became RAW and when attempting to access the drive in Windows I see a message asking you to format the drive "You need to format the disk in drive before you can use it. Do you want to format it?"
The other WD isn't visible anymore int Windows Explorer and it appears was Unallocated in Disk Management.

I spent a whole week using several software trying to find my data without success. I also used testdisk, which results I will put in details here hoping someone could help me because I'm stuck.

Any help will be appreciated!

Thanks in advance!

Disk Management

img001.png (34.86 KiB) Viewed 6158 times

The 2 WD disks with problems

img002.png (16.05 KiB) Viewed 6158 times

The sdb disk

img003.png (15.67 KiB) Viewed 6158 times

Code: Select all

Mon Jun  1 20:59:34 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=127666225152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=320072933376
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1000169537536
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512
Drive C: - 127 GB / 118 GiB - CHS 15521 255 63, sector size=512
Drive I: - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 320 GB / 298 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0  32 33 46047 109  6  739749880
 1 * HPFS - NTFS              0  32 33 46047 109  6  739749880
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          46047 109 15 77825 200  7  510519296
 2 P HPFS - NTFS          46047 109 15 77825 200  7  510519296

search_part()
Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
file_pread(5,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(5,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(5,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(5,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(5,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(5,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(5,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(5,2,buffer,625145855(38913/135/6)) lseek err Invalid argument

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

[Fiona]

Looks like that your RAID is degraded.
Before you can run any diagnose you should get back your RAID/array exactly like before.
You shouldn't initialize, partition and format anything.
TestDisk would be able to search for partitions and can recover them.

Fiona

[marcoborsoi]

Thanks for your response Fiona.
I wrote that I had a RAID 1 in the older machine, but actually it was a RAID 0 (setup on BIOS).

I'm sorry, I'm not an expert on disk management, so I'll just tell what I did and what I didn't.

When I built the new machine with Windows 8.1 on the 128GB SSD, I formatted the two 320GB HDD to use them only for data, but I did not make any RAID setup. I've been seen them always as two separated disks.

So, dummy question: Is it possible that the RAID 0 was done automatically?

Thanks!

[Fiona]

I don't belief that a RAID creates itself automatically.
Currently your RAID is degraded.
You can watch the amount of cylinders of your disk and partitions:
One Cylinder has 255 Heads (partitions 0-254) and a Head has 63 sectors.
So the size of a Cylinder will be approximately 8 MB.
See here:
Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

But your partitions are still in your partition table and they end after disk limit, because only a single disk is recognized and not a RAID0 anymore.
1 * HPFS - NTFS 0 32 33 46047 109 6 739749880
The value of Cylinder of your first disk is 38913 and your first partition already ends after your disk limit at the value 46047.
And your second partition:
2 P HPFS - NTFS 46047 109 15 77825 200 7 510519296

To resolve your problem, your RAID0 must be recreated exactly like before.
Please don't initialize, create any partitions and format anyrhing.
TestDisk can look for your partitions and recover them.

Fiona

[marcoborsoi]

Hello Fiona. Thanks for your response.

I will try to rebuild the RAID (besides I've never done that) and I will post again the results.
I found some guides and I will try to follow them. Please let me know if you have some that you can recommend to me.

Thanks again!

[marcoborsoi]

Hi Fiona!

Good news! All my data was successfully recovered using ReclaiMe. They are now safe in an external drive.

I used the ReclaiMe Free RAID Recovery to make an analysis on the disks and it generated a xml file to open the File Recovery (another software) in RAID mode. I could see all my directories and files. In order to save them, I purchased the standard license.

The console output was:

This is a plain-text general description of the reconstructed array layout.

The array type is RAID0 (also called Stripe Set).
The array consists of 2 disks.

The disks are ordered as follows:
#00: Disk 1 - WDC WD3200AAJS-56B4A0, Serial number WCAT1A866415, \\.\PhysicalDrive1
#01: Disk 2 - WDC WD3200AAJS-56B4A0, Serial number WCAT1A870096, \\.\PhysicalDrive2

Block size is 128.0 KB , same as 256 sectors.
The data starts at sector (LBA) 0 (this is often called "offset" or "start offset").

Block map is as follows:
1 2

And the XML file generated (to be used in File Recovery) was:

<?xml version="1.0" encoding="utf-8"?>
<!--


Generated by ReclaiMe Free RAID Recovery build 1722, http://www.FreeRaidRecovery.com
-->
<blockmap blocksize="256" numrows="1" blocklist="M,00,P,E:M,01,P,E">
<disk path="\\.\PhysicalDrive1" offset="0" numsectors="625142448" serial="WCAT1A866415" signature="625142448::E156770B:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:E2CF1BDA:329DC6D0:48085C43:E6FE4D2C:4E80C542:730509F4:B7A988BB:39DBFED3:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:CAA635DA:4CF0D3D0:3D7B055C:DC20FABE:8FCF09AE:30FCEDC0:D6EDE65C:30FCEDC0:630205ED:02981817:30FCEDC0:30FCEDC0:30FCEDC0" />
<disk path="\\.\PhysicalDrive2" offset="0" numsectors="625142448" serial="WCAT1A870096" signature="625142448::8267B399:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:BCBB41DA:897446A6:8CCB8886:1B4475C9:20895FE5:87C1E53F:06E7592D:52F5BC19:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:30FCEDC0:50F42123:F704A95D:0A22B830:1FC2EBBE:CF48080D:30FCEDC0:ADA7C56B:30FCEDC0:B6011D93:B9B02E53:30FCEDC0:30FCEDC0:30FCEDC0" />
<!--

Block size: 128.0 KB

1 2

-->
</blockmap>

However, I am still stuck on how to make my partitions work again. I saw on another post that an user with a similar problem increased the number of cylinders in order to see his partition, but I'm not sure how to proceed and which values I should input in this case.

I would like to thank you again Fiona for your help and for open my eyes with the RAID problem!