Incorrect endmark, invalid boot sector, HDD too small! Help.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
Phase
Posts: 7
Joined: 28 Nov 2015, 15:00

Incorrect endmark, invalid boot sector, HDD too small! Help.

#1 Post by Phase »

Hello,
I've been going almost solid through troubleshooting for 3 days with this external HDD. :cry: This drive was my backup and after my first was lost, this holds everything dear to me.
The first was 'lost at sea', quite literally it fell off a boat. Don't ask.
This backup drive was Transported an hour and a half by plane, securely wrapped in hold luggage. When I tried to re-assemble my PC at the other end, this backup drive wouldn't run.
It's a 1T WD External. I was it's first owner and I have never partitioned it myself. It does have what I believe to be a hidden file (not sure) that 'mounts' every time the drive starts up, which windows sees as a CD and I'm unsure if this counts as a separate partition. It's an instruction to 'Caring for your drive', I think. But other than this, the drive is just one whole section/single partition of files and photographs, with no OS.

At first I thought it was a power issue as it just wouldn't start up.
But after testing for that failed I decided to sata wire it into my motherboard.
It wasn't detected by windows 7 so I ran 'Disk Management' which found it but couldn't do anything with it, let alone assign it a letter. It kept wanting to initialise it, Which I declined.
After a few random programs scanned it and found nothing, I Ran the 32bit TestDisk on it.
I assumed it was an Intel Partition, but frankly I'm unsure.
TestDisk found something and told me the drives "partition sector doesn't have the endmark 0xAA55" whatever that means.
I continued with both a quick search (Around 1h Hour) and after that a deep scan (7+ hours, I fell asleep), both of which told me the same thing about 11% into the scan:

Disk /dev/sdb - 1000GB / 931 GiB - CHS 121601 255 63
Analyse cylinder X/121600: X%

check_FAT: can't read FAT boot sector
Invalid FAT boot sector
0 D FAT12 210454 186 18 368100 78 28 2532576197
FAT12 210454 186 18 368100 78 28 2532576197


The QuickScan and the DeepScan both then say this at the end:

Disk /dev/sdb - 1000GB / 931 GiB - CHS 121601 255 63

The harddisk <1000 GB / 931 GiB> seems too small! << 3027 GB / 2819 GiB>
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
Partition, Start, End, Size in sectors
> FAT12 210454 186 18 368100 78 28 2532576197
[Continue]
1296 / 1207 GiB


I've run to scans twice each now with the same results. Continuing leads to TestDisk showing no partitions in the list and asking if I would like to "add a partition, load a backup or continue".
Continuing further then leads to TestDisk telling me there is "No partition found or selected for recovery"
It then gives me the option to quit.

It seems to recognise something is there but will not allow me to go any further.
This drive contained 10 years of data, any help you can give me would be greatly appreciated, I'm almost out of ideas.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#2 Post by Fiona »

Can you copy and paste the content of your testdisk.log into your next post?

Fiona

Phase
Posts: 7
Joined: 28 Nov 2015, 15:00

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#3 Post by Phase »

Fiona wrote:Can you copy and paste the content of your testdisk.log into your next post?

Fiona
Hi Fiona
Thanks for responding.
I hope this was what you were after, it was the only file in the directory just called testdisk.
This is only a quick scan log as far as I know, I don't think I logged the deep scans.

Sat Nov 28 14:05:28 2015
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=127456509952
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=162784083968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=157285351424
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdc - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512
Drive C: - 500 GB / 465 GiB - CHS 60788 255 63, sector size=512
Drive E: - 104 MB / 100 MiB - CHS 12 255 63, sector size=512
Drive F: - 127 GB / 118 GiB - CHS 15495 255 63, sector size=512
Drive H: - 162 GB / 151 GiB - CHS 19790 255 63, sector size=512
Drive J: - 157 GB / 146 GiB - CHS 19122 255 63, sector size=512

Partition table type default to Intel
Disk /dev/sdb - 1000 GB / 931 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=3380955245 1319936
file_pread(5,3,buffer,3380955245(210454/186/18)) lseek err Invalid argument
file_pread(5,1,buffer,3380955245(210454/186/18)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 210454 186 18 368100 78 28 2532576197
This partition ends after the disk limits. (start=3380955245, size=2532576197, end=5913531441, disk end=1953525168)
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,14,buffer,1953525761(121601/90/27)) lseek err Invalid argument
file_pread(5,3,buffer,1953525775(121601/90/41)) lseek err Invalid argument
file_pread(5,3,buffer,1953525822(121601/91/25)) lseek err Invalid argument
file_pread(5,8,buffer,1953525838(121601/91/41)) lseek err Invalid argument
file_pread(5,11,buffer,1953525885(121601/92/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953527807(121601/122/57)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3027 GB / 2819 GiB)
The following partition can't be recovered:
FAT12 210454 186 18 368100 78 28 2532576197

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced

Interface Advanced
SIGHUP detected! TestDisk has been killed.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#4 Post by Fiona »

TestDisk 7.1WIP 32bit is recommended.
I didn't find any result running Deeper Search.
Your logfile only contain info that you were running Quick Search and the menu Advanced.
Deeper Search searches additional for a backup of the boot sector, can display data and recover partitions found by the backup of the boot sector.

Fiona

Phase
Posts: 7
Joined: 28 Nov 2015, 15:00

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#5 Post by Phase »

Hi Fiona,

I'll run a 3rd deepsearch using the version you reccomended, this time with a log.
I'll post the log after it's done.
I'm worried the Boot Sector might be scrambled.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#6 Post by Fiona »

Therer is no necessity to run another Quick Search.
You can press enter to stop it!
At the "Write"-display, select Deeper Search and press enter.
Please copy and paste the content.

Fiona

Phase
Posts: 7
Joined: 28 Nov 2015, 15:00

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#7 Post by Phase »

Hay Fiona
The deep search took a while.
Here's the log:


Tue Dec 1 13:57:22 2015
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, September 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, Cygwin32 2002.0
Compilation date: 2015-11-26T14:10:31
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=500000882688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=127456509952
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5001AALS-00L3B2, S/N:2020202057202d444d5753413359353232383330, FW:01.03B01
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EADS-11M2B1, S/N:2020202057202d44435756413335323539313034, FW:01.00A01
Disk /dev/sdc - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - OCZ-VERTEX4, S/N:434f2d5a4149384e3049353753395a39334b3038, FW:1.5

Partition table type default to Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WDC WD10EADS-11M2B1
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=3380955245 1319936
file_pread(5,3,buffer,3380955245(210454/186/18)) lseek err Invalid argument
file_pread(5,1,buffer,3380955245(210454/186/18)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 210454 186 18 368100 78 28 2532576197
This partition ends after the disk limits. (start=3380955245, size=2532576197, end=5913531441, disk end=1953525168)
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3027 GB / 2819 GiB)
The following partition can't be recovered:
FAT12 210454 186 18 368100 78 28 2532576197

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=3380955245 1319936
file_pread(5,3,buffer,3380955245(210454/186/18)) lseek err Invalid argument
file_pread(5,1,buffer,3380955245(210454/186/18)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 210454 186 18 368100 78 28 2532576197
This partition ends after the disk limits. (start=3380955245, size=2532576197, end=5913531441, disk end=1953525168)
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 3027 GB / 2819 GiB)
The following partition can't be recovered:
FAT12 210454 186 18 368100 78 28 2532576197

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
New options :
Dump : No
Align partition: Yes
Expert mode : No

TestDisk exited normally.

Phase
Posts: 7
Joined: 28 Nov 2015, 15:00

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#8 Post by Phase »

There doesn't seem to be that much more code, but after a deep scan that's all it gives me.
:?

Phase
Posts: 7
Joined: 28 Nov 2015, 15:00

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#9 Post by Phase »

I'm not sure what else to do Fiona,
If this is all it gives in the log what could be the problem?
This was the full log after a cancelled quick scan and a full deep scan.

Vize
Posts: 2
Joined: 05 Dec 2015, 22:14

Re: Incorrect endmark, invalid boot sector, HDD too small! H

#10 Post by Vize »

Apologies for cutting in your conversation, but your description brought some old memories back to life.

I take it that the disk with problems is the 2nd disk: dev/sdb WDC WD10EADS.
This makes the disk part of the (unfortunately infamous) Western Digital WD Green Series (manufactured ~2009)

Is this disk part of an external backup drive like WD MyBook Essential connected via USB ?
If so, your problem is in all likelihood a damaged USB connector board.
Small fragile board but absolute essential to read data from disk and -that's why infamous- for 'security' reasons was paired with the disk, making it almost impossible to replace or bypass.
Not all hope would be lost though...just yet ;)

Locked