Exfat recovery... please help!

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Exfat recovery... please help!

#1 Post by tomtailford »

OK, so I've had a number of posts on here but still no resolution, apologies for a new post but thought I'd try and make things clear.

I have a GRAID 8TB striped raid in exfat which stopped working after I did something.

I managed to find files on the drive once but have since not been able to find the files again...

When I run testdisk:
Choose EFI GPT partition type (automatically found) - is this correct?
Analyse to show 2 partitions:
1 EFI System
2 Mac HFS (however it was EXFAT - I think I rewrote tables when I screwed with it)
Quick search says "check_FAT: Unusual media descriptor)

Log:

Code: Select all


Fri Apr 01 05:43:34 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=8001490518016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=256058064896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000396746752
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1500301908992
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive5 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63, sector size=512
Drive C: - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive G: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive I: - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB
Partition table type: EFI GPT

Analyse Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=15627911167 (expected 15627911167)
hdr_lba_start=34
hdr_lba_end=15627911134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600
 2 P Mac HFS                   409640 15627648983 15627239344

search_part()
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63
FAT32 at 0/0/41
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)

FAT32 at 0/0/41
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 25/127/15

HFS+ magic value at 25/127/15
part_size 2742337456
     Mac HFS                   409640 15627648983 15627239344
     HFS+ blocksize=8192 + Backup, 8001 GB / 7451 GiB
When I run testdisk:
Choose Intel partition type
Analyse to reveal 1 partition
1 EFI GPT
Also has message 'Bad relative sector. No partition is bootable'
Quick search reveals 2 partitions
HPFS - NTFS blocksize 4096, 1048MB / 1000MiB (can list files)
P FAT16 >32M 1897GB / 1766 GiB (can't list files)
List files says 'Can't open filesystem. Filesystem seems damaged'

Log:

Code: Select all



Fri Apr 01 05:56:06 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=1500301910016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=8001490518016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=256058064896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000202043392
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=2000396746752
filewin32_getfilesize(\\.\H:) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\H:) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=1500301908992
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive4 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive5 - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63, sector size=512
Drive C: - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512
Drive D: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive G: - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512
Drive I: - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63
Geometry from i386 MBR: head=1 sector=1
BAD_RS LBA=1 16065
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Bad relative sector.
No partition is bootable
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.

search_part()
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63
NTFS at 16/113/34
filesystem size           2048000
sectors_per_cluster       8
mft_lcn                   85333
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
BAD_RS LBA=2915879280 7451799
check_part_i386 failed for partition type 06
     FAT16 >32M           448854 112 11 679491  79 46 3705181362

Results
   * HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
   P FAT16 >32M           448854 112 11 679491  79 46 3705181362
Not an exFAT boot sector.

   * HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
   P FAT16 >32M           448854 112 11 679491  79 46 3705181362
Directory /

interface_write()
 1 * HPFS - NTFS             16 113 34   143 236 29    2048000
 2 P FAT16 >32M           448854 112 11 679491  79 46 3705181362
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=1 sector=1
BAD_RS LBA=1 16065
check_part_i386 1 type EE: no test
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Analyse Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63
Geometry from i386 MBR: head=1 sector=1
BAD_RS LBA=1 16065
check_part_i386 1 type EE: no test
Current partition structure:
 1 P EFI GPT                  0   0  2 267349  89  4 4294967295

Bad relative sector.
No partition is bootable

search_part()
Disk \\.\PhysicalDrive6 - 8001 GB / 7451 GiB - CHS 972792 255 63
NTFS at 16/113/34
filesystem size           2048000
sectors_per_cluster       8
mft_lcn                   85333
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
Search for partition aborted

Results
   * HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
Change partition type:
   * HPFS - NTFS             16 113 34   143 236 29    2048000
     NTFS, blocksize=4096, 1048 MB / 1000 MiB
Please can anyone help?

This is my old post - wrote-the-partition-table-thinking-i-d- ... t5564.html
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Exfat recovery... please help!

#2 Post by tomtailford »

Anyone able to offer up any help on this?

Is this considered partition recovery or would I have more luck with some assistance in filesystem repair forum?
Top
tomtailford
Posts: 19
Joined: 12 Nov 2015, 21:08

Re: Exfat recovery... please help!

#3 Post by tomtailford »

Bump - anyone here able to offer up any advice? I'm desperate to recover these files!!
Top
Locked

Return to “Partition Recovery”