Trying to recover Seagate 4tb

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kera
Posts: 4
Joined: 04 Oct 2016, 20:06

Trying to recover Seagate 4tb

#1 Post by kera »

My Windows image was stored on my 4tb external hard drive. When I reinstalled the image, my external hard drive was also re-formatted. I think I had a spare hard drive connected when I created the image. It just had several bad Linux partitions, so that is what my 4tb hard drive has now.

I followed the Testdisk step by step, and I found my files. I did Analyse and found my partition and files, so I set it to P and did a write. I left the lba partition the way it was, because I thought it might contain the partition tables? I don't know, but this did not change the problem. I could still see my files in testdisk, but I couldn't access anything on the hard drive (it was still listed as raw). I'll paste portions of the log. If you want the whole thing I will post it, but I did a lot of back and forth (checking my files over and over and re-running quick search etc), which made the log pages long.

Fri Sep 30 09:05:44 2016
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build 3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=610753576960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=371124600832
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4700372992
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512
Drive C: - 610 GB / 568 GiB - CHS 74253 255 63, sector size=512
Drive D: - 371 GB / 345 GiB - CHS 45119 255 63, sector size=512
Drive E: - 4700 MB / 4482 MiB - CHS 1120 64 32, sector size=2048

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63
FAT32 at 0/32/39
FAT32 LBA 0 32 33 4177 117 36 67108864 [NO NAME]
FAT32, blocksize=32768, 34 GB / 32 GiB
NTFS at 16/113/34
filesystem size 7813771264
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16 113 34 486401 53 52 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB

block_group_nr 81

recover_EXT2: "e2fsck -b 2654208 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=81/240, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
dir_partition inode=5
HPFS - NTFS 16 113 34 486401 53 52 7813771264
NTFS, blocksize=4096, 4000 GB / 3725 GiB
Directory /
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 .
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 ..
55 dr-xr-xr-x 0 0 0 16-Sep-2016 14:54 $RECYCLE.BIN
12331 dr-xr-xr-x 0 0 0 26-Sep-2016 08:11 Backup of Simple Drive videos pics
62 dr-xr-xr-x 0 0 0 13-Sep-2016 18:00 Documents
58 dr-xr-xr-x 0 0 0 28-Sep-2016 08:26 GANDALF
9571 dr-xr-xr-x 0 0 0 28-Sep-2016 12:15 Manual Backup
35 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Seagate
37 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Start_Here_Mac.app
53 dr-xr-xr-x 0 0 0 16-Sep-2016 13:56 System Volume Information
9560 dr-xr-xr-x 0 0 0 14-Sep-2016 17:05 WindowsImageBackup
742749 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 ...._files
48 -r--r--r-- 0 0 32 16-Jul-2012 17:33 Autorun.inf
49 -r--r--r-- 0 0 194586 4-Jun-2015 16:49 BackupPlus.ico
122985 -r--r--r-- 0 0 400 19-Sep-2016 09:34 GoFlex (F) - Shortcut.lnk
61 -r--r--r-- 0 0 528 13-Sep-2016 18:00 MediaID.bin
50 -r--r--r-- 0 0 18010688 9-May-2016 19:29 Start_Here_Win.exe
51 -r--r--r-- 0 0 1146400 8-Jan-2015 16:13 Warranty.pdf
742748 -r--r--r-- 0 0 130690 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 .....htm
13354 -r--r--r-- 0 0 297154 15-Sep-2016 11:26 kaspersky license.png
68781 -r--r--r-- 0 0 369960 15-Sep-2016 14:08 prog files.jpg
69032 -r--r--r-- 0 0 312434 15-Sep-2016 14:08 prog files2.jpg
13195 -r--r--r-- 0 0 152090 15-Sep-2016 11:25 windows license.png

interface_load
Disk \\.\PhysicalDrive1 - 4000 GB / 3726 GiB - CHS 486401 255 63 Fri Sep 30 09:04:29 2016
1 * FAT16 >32M 0 32 33 4177 117 36 67108864

interface_write()
1 P HPFS - NTFS 16 113 34 486401 53 52 7813771264


This did not fix the problem, so after finding other similar problems, and after I made sure I could still see my files I did a TestDisk, Advanced, Boot, RebuildBS, write.


rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1

Directory /
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 .
5 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 ..
55 dr-xr-xr-x 0 0 0 16-Sep-2016 14:54 $RECYCLE.BIN
12331 dr-xr-xr-x 0 0 0 26-Sep-2016 08:11 Backup of Simple Drive videos pics
62 dr-xr-xr-x 0 0 0 13-Sep-2016 18:00 Documents
58 dr-xr-xr-x 0 0 0 28-Sep-2016 08:26 GANDALF
9571 dr-xr-xr-x 0 0 0 28-Sep-2016 12:15 Manual Backup
35 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Seagate
37 dr-xr-xr-x 0 0 0 1-Aug-2016 22:45 Start_Here_Mac.app
53 dr-xr-xr-x 0 0 0 16-Sep-2016 13:56 System Volume Information
9560 dr-xr-xr-x 0 0 0 14-Sep-2016 17:05 WindowsImageBackup
742749 dr-xr-xr-x 0 0 0 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 ...._files
48 -r--r--r-- 0 0 32 16-Jul-2012 17:33 Autorun.inf
49 -r--r--r-- 0 0 194586 4-Jun-2015 16:49 BackupPlus.ico
122985 -r--r--r-- 0 0 400 19-Sep-2016 09:34 GoFlex (F) - Shortcut.lnk
61 -r--r--r-- 0 0 528 13-Sep-2016 18:00 MediaID.bin
50 -r--r--r-- 0 0 18010688 9-May-2016 19:29 Start_Here_Win.exe
51 -r--r--r-- 0 0 1146400 8-Jan-2015 16:13 Warranty.pdf
742748 -r--r--r-- 0 0 130690 28-Sep-2016 11:35 Your Amazon.com order of Kaspersky Anti-Virus 2016 .....htm
13354 -r--r--r-- 0 0 297154 15-Sep-2016 11:26 kaspersky license.png
68781 -r--r--r-- 0 0 369960 15-Sep-2016 14:08 prog files.jpg
69032 -r--r--r-- 0 0 312434 15-Sep-2016 14:08 prog files2.jpg
13195 -r--r--r-- 0 0 152090 15-Sep-2016 11:25 windows license.png
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1

ntfs_boot_sector
1 P HPFS - NTFS 16 113 34 267365 202 36 4294967295
NTFS at 16/113/34
Error: size boot_sector 3518803968 > partition 4294967295
filesystem size 7813771264 16584902953138304162
sectors_per_cluster 8 105
mft_lcn 786432 727126866
mftmirr_lcn 2 3928812524
clusters_per_mft_record -10 -90
clusters_per_index_record 1 93
Boot sector
Error: size boot_sector 3518803968 > partition 4294967295
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different.
filesystem size 4294967295 7813771264
sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 2 2
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Write new boot!


I rebooted, and now my files are not visible in testdisk and my drive just shows as an empty drive. :cry:

I saw that Mssr. Grenier suggested to one person that they manually input the partition information. Am I still able to do that, or have I ruined something along the way? Any help would be greatly appreciated. Please let me know if you'd like my full log file.
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Trying to recover Seagate 4tb

#2 Post by cgrenier »

Disk bigger than 2 TB that have sector size equal to 4096 bytes can use PC Intel partition table, otherwise they must use EFI GPT.
As your disk use 512 bytes sector, you must use EFI GPT.
Top
kera
Posts: 4
Joined: 04 Oct 2016, 20:06

Re: Trying to recover Seagate 4tb

#3 Post by kera »

OK thank you. I will try that. That must be why now it says the drive seems too small. So I haven't made any unrepairable mistakes?
Top
kera
Posts: 4
Joined: 04 Oct 2016, 20:06

Re: Trying to recover Seagate 4tb

#4 Post by kera »

I did try using EFI GPT partition by using testdisk 7.1 selecting my disk, EFI GPT, Advanced showed No partition available. Analyse says bad partition, invalid signature.

While I was running it, my computer kept saying the drive was full, so I kept transferring things to another hard drive. It turns out that the log file got to 456GB! Is this normal? Nothing will open the log file.

Back to my original question....can I set the structure back to the way it was before I made the changes? Only 1 file shows up on the drive now, where before there were directories and many files showing.
Top
kera
Posts: 4
Joined: 04 Oct 2016, 20:06

Re: Trying to recover Seagate 4tb

#5 Post by kera »

You won't believe this, but I used photorec in order to recover my files, as I was going to try some other things. After 3 days I was 75% complete in recovering my files from the drive when I had a popup asking me to upgrade to the new Windows 10. I have tried it already and didn't want it and REALLY did not want it right at that moment so I said no. It popped up again later and I clicked cancel. When I came back later to make sure the target drive was not filling up I had a message saying We have updated your computer! Really! It had, of course re-started. Microsoft is really getting pushy, just like Apple.

Anyway, my drive was still showing blank at that time, but when I looked at it last night (I have not disconnected it at all since trying the recovery process) all my files were there!!! On the 4TB!!! I'm not sure whether photorec did something or whether when there was a restart scandisk or the OS did a repair but I have my files back. So happy. Thank you for your help.
Top
Locked

Return to “Partition Recovery”