3TB external drive became RAW

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
oyvdei
Posts: 5
Joined: 21 Jul 2015, 13:36

3TB external drive became RAW

#1 Post by oyvdei »

Hello, please I'm in need for some help.

I got an Seagate expansion external drive with 3TB. A little time ago, the USB 3.0 port got broken, so I bought a new enclosure with a new connector from another manufacturer. When I connected it to my computer, I couldn't get access and Windows wanted me to format the drive. The drive was visible in Windows though, as station (F:) as before, but with no other info. When I ran chkdsk, it said it had became RAW and couldn't do anything.

I got a tip from a friend to try TestDisk. I read a lot on this board to get a hang of what I had to do. After Create, I saw the drive as "Disk /dev/sdb - 3000 GB/2794 GiB". I chose Intel then Analyse and Quick Search. After that, I couldn't see my files and folders in List, just some other stuff, so I ran Deep Search.

When the Deep Search was finished after many hours, I went in the partition I thought was right (I wasn't able to see a List with files here). In the hope of fixing the problem, I probably hesitated a bit and didn't exactly knew what I was doing. I chose Write and rebooted.

Now, Windows don't recognize the drive anymore, it is not visible. It's still visible in TestDisk though, so I try again now.

I take screenshots this time as seen below, as the same with the file log. Can you see from this if I still can recover my drive? I have many valuable files on it I don't want to lose.
00751871f1f9ba4bcf7444d7226829de.png
00751871f1f9ba4bcf7444d7226829de.png (48.29 KiB) Viewed 2780 times
d8cbe89d92bdaf49cd7ff35f1e583fa5.png
d8cbe89d92bdaf49cd7ff35f1e583fa5.png (44.25 KiB) Viewed 2780 times
The test_logical error didn't show the first time I tried before I wrote the partition the first time.
f24de5f7838424fb842e6467c16bab09.png
f24de5f7838424fb842e6467c16bab09.png (74.84 KiB) Viewed 2780 times

oyvdei
Posts: 5
Joined: 21 Jul 2015, 13:36

Re: 3TB external drive became RAW

#2 Post by oyvdei »

96e78d009b837f5b5fc77e20af582da6.png
96e78d009b837f5b5fc77e20af582da6.png (58.94 KiB) Viewed 2779 times
And this is the result after Quick Search. I'm currently running the Deep Search now. So far it reports about an invalid FAT boot sector.

Can it be I have to change something in the disk geometry?

Following is the log file prior to the Quick Search:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=214748364800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=258513829888
filewin32_getfilesize(\\.\E:) GetFileSize err Feil funksjon.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Feil funksjon.

Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\G:) GetFileSize err Feil funksjon.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Feil funksjon.

Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Drive C: - 214 GB / 200 GiB - CHS 26108 255 63, sector size=512
Drive D: - 258 GB / 240 GiB - CHS 31429 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425
Change partition type:
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425
Change partition type:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
Change partition type:
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55
Edit: The Deeper Search is now finished.
fed371044b553b5b027c130c7c7b0bbb.png
fed371044b553b5b027c130c7c7b0bbb.png (82.1 KiB) Viewed 2762 times
The second partition shows 923 GB/860 GiB and the third shows 2076 GB/1933 GiB.

oyvdei
Posts: 5
Joined: 21 Jul 2015, 13:36

Re: 3TB external drive became RAW

#3 Post by oyvdei »

Hi. I'm still stuck right where I was..

I am in fact able to access my files with another data recovery program. But to save my files that way and then format my drive, will be a very twisted and time consuming process for me.
I'll be very happy if there is a way to repair and recover my partition(s) with TestDisk, so I once again can get directly access to all my files without formatting the drive :)

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: 3TB external drive became RAW

#4 Post by Fiona »

Sry for late.
TestDisk Deeper Search might be time consuming too.
But it would be necessary to run and find your lost partition.
Your current partition table only contain an extended partition and a FAT16-Partition which is probably wrong.
Looks like that you aborted Deeper Search:
Search for partition aborted

Results

oyvdei
Posts: 5
Joined: 21 Jul 2015, 13:36

Re: 3TB external drive became RAW

#5 Post by oyvdei »

Hi again, and thanks for your reply.
I had in fact run Deeper Search a couple of times when I made this topic, but I messed up the log file, I guess.

Anyway, I still haven't got any further with my lost partition. I'm starting to think I have to manually add a partition or change something with the disk geometry.
But I don't know, so any further help is much appreciated.

I ran Deeper Search again, and here is my current log file:

Code: Select all

Mon Aug  3 17:39:49 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=214748364800
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=258513829888
filewin32_getfilesize(\\.\E:) GetFileSize err Feil funksjon.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Feil funksjon.

Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\G:) GetFileSize err Feil funksjon.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Feil funksjon.

Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Drive C: - 214 GB / 200 GiB - CHS 26108 255 63, sector size=512
Drive D: - 258 GB / 240 GiB - CHS 31429 255 63, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=12354332 14010884
check_part_i386 failed for partition type 06
     FAT16 >32M           268118  94 37 316462  57 53  776644046
file_pread(5,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument

Results
   L FAT16 >32M           268118  94 37 316462  57 53  776644046
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
 1 E extended LBA         268118   0  1 316462 254 63  776662425
 5 L FAT16 >32M           268118  94 37 316462  57 53  776644046

search_part()
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
BAD_RS LBA=12354332 14010884
check_part_i386 failed for partition type 06
     FAT16 >32M           268118  94 37 316462  57 53  776644046
BAD_RS LBA=2549719637 2743124
file_pread(5,3,buffer,2549719637(426062/14/22)) lseek err Invalid argument
file_pread(5,1,buffer,2549719637(426062/14/22)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA            426062  14 22 477639 244 42  828599016
This partition ends after the disk limits. (start=6844686933, size=828599016, end=7673285948, disk end=5860533168)
BAD_RS LBA=3331482131 11102796
file_pread(5,3,buffer,3331482131(474724/132/52)) lseek err Invalid argument
file_pread(5,1,buffer,3331482131(474724/132/52)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M           474724 132 52 727142 157  6 4055096700
This partition ends after the disk limits. (start=7626449427, size=4055096700, end=11681546126, disk end=5860533168)
check_part_i386 failed for partition type 06
     FAT16 >32M           268118  94 37 316462  57 53  776644046
BAD_RS LBA=2756655873 5875812
file_pread(5,3,buffer,2756655873(438943/61/32)) lseek err Invalid argument
file_pread(5,1,buffer,2756655873(438943/61/32)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M           438943  61 32 551234 218 22 1803964797
This partition ends after the disk limits. (start=7051623169, size=1803964797, end=8855587965, disk end=5860533168)
file_pread(5,2,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566976(364801/98/34)) lseek err Invalid argument
file_pread(5,1,buffer,1565566975(364801/98/33)) lseek err Invalid argument
file_pread(5,14,buffer,1565566977(364801/98/35)) lseek err Invalid argument
file_pread(5,3,buffer,1565566991(364801/98/49)) lseek err Invalid argument
file_pread(5,3,buffer,1565567038(364801/99/33)) lseek err Invalid argument
file_pread(5,8,buffer,1565567054(364801/99/49)) lseek err Invalid argument
file_pread(5,11,buffer,1565567101(364801/100/33)) lseek err Invalid argument
file_pread(5,2,buffer,1565569023(364801/131/2)) lseek err Invalid argument
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 5980 GB / 5570 GiB)
The following partitions can't be recovered:
     FAT32 LBA            426062  14 22 477639 244 42  828599016
     FAT16 >32M           438943  61 32 551234 218 22 1803964797
     FAT16 >32M           474724 132 52 727142 157  6 4055096700

Results
   L FAT16 >32M           268118  94 37 316462  57 53  776644046
interface_load
Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63 Fri Jul 31 12:10:04 2015
 1 D No partition         267349  89  4 315694  89  3  776662425
check_part_i386 1 type 00: no test
Invalid partition structure.
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
 1 E extended LBA         267349  89  4 315694  89  3  776662425
Change partition type:
 1 E extended LBA         267349  89  4 315694  89  3  776662425

Analyse Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 364801 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 E extended LBA         267349  89  4 315694  89  3  776662425
No partition is bootable

test_logical: 
Partition sector doesn't have the endmark 0xAA55

oyvdei
Posts: 5
Joined: 21 Jul 2015, 13:36

Re: 3TB external drive became RAW

#6 Post by oyvdei »

Hi Fiona. As mentioned in my previously reply, I ran Deeper Search properly as you requested. Is there anything in my log file that can help identify the issue with the partitions?

chops
Posts: 2
Joined: 17 Aug 2015, 17:24

Re: 3TB external drive became RAW

#7 Post by chops »

oh my friend I am in the same boat as you. I think our problem was using the wrong kind of enclosure. I might of used one that could not handle 3TB, I read somewhere this can cause read issues. Just try to run Photorec dude, see if you can backup your files and then just format the drive and reupload your stuff. Stop using the enclosure, plug the HDD into your computer (if you have a desktop). Im currently using the Photorec tutorial and i see all my files popping up again. I ran chkdsk too after I changed the enclosure, fkd the HDD lol. Damn you windows!

Locked