External Disk went RAW

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
jimmy235
Posts: 1
Joined: 28 Jul 2017, 08:39

External Disk went RAW

#1 Post by jimmy235 »

Hi folks,

My Problem with a Seagate Backup Plus STCA3000200 3TB (bought in Feb/2013):
I moved complete content of disk in a folder X (in the same disk) and created beside folder X a new folder Y for upcoming backups. Folder Y got filled with files from another disk.
After that i disconnected the USB and drive was 2-5day off. (turns power off automaticaly by disconnecting USB)
Few days later connected Drive again and after 2-3mins got the message "Drive has to be formated". Since then the filesystem is "RAW".
It takes every time 2-5mins to get the message and only after that message TestDisk or any other software is able to work with drive.
After 2days of reading and trying with TestDisk, TestDisk was not able to List any files or the right partition type. Now, few day later again, it detects again.
A deepsearch feels like that it would take years.
Drive is not making any odd noises.

My efforts with TestDisk:
TestDisk lists both folder, X and Y.
Folder Y is already rescued.
In folder X, which is my intrest, is only listing one folder, from the 20-30 folders it should have.
One strange thing:
Testdisk is sporadically detecting a "Intel"- or "EFI GPT"-Partition. In both cases i can list folder X and Y.
Had already a try with PhotoRec and sadly its not findig the files which I`m searching for.

Any suggestions?
One idea, which i got yesterday:
What if I (quick-)format the drive and then try to recover "deleted" files?

Regards
jimmy

Last .log-File:

Code: Select all


Thu Jul 27 15:11:10 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Apr 18 2015 13:02:07
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504, curses lib: pdcurses build  3401
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=999095795712
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592977920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=998501253120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=479509610496
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000579915776
Hard disk list
Disk \\.\PhysicalDrive0 - 999 GB / 930 GiB - CHS 121466 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096
Drive C: - 998 GB / 929 GiB - CHS 121394 255 63, sector size=512
Drive D: - 479 GB / 446 GiB - CHS 58297 255 63, sector size=512
Drive E: - 3000 GB / 2794 GiB - CHS 45599 255 63, sector size=4096

Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 45600  23 55  732563456 [Seagate Backup Plus Drive]
pread: Input/output error
Failed to calculate number of free clusters: Input/output error.
Failed to read index block: Input/output error.

search_part()
Disk \\.\PhysicalDrive2 - 3000 GB / 2794 GiB - CHS 45600 255 63
file_win32_pread(224,3,buffer,21(0/0/22)) read err: read after end of file
file_win32_pread(224,2,buffer,21(0/0/22)) read err: read after end of file
file_win32_pread(224,1,buffer,262(0/4/11)) read err: read after end of file
file_win32_pread(224,2,buffer,32(0/0/33)) read err: read after end of file
NTFS at 0/32/33
filesystem size           732563456
sectors_per_cluster       1
mft_lcn                   786432
mftmirr_lcn               366281727
clusters_per_mft_record   1
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 45600  23 55  732563456 [Seagate Backup Plus Drive]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
   * HPFS - NTFS              0  32 33 45600  23 55  732563456 [Seagate Backup Plus Drive]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_win32_pread(224,2,buffer,366303770(22801/90/36)) read err: read after end of file
file_win32_pread(224,1,buffer,366303770(22801/90/36)) read err: read after end of file
NTFS filesystem need to be repaired.


dir_partition inode=5
   * HPFS - NTFS              0  32 33 45600  23 55  732563456 [Seagate Backup Plus Drive]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
Directory /
       5 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 .
       5 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 ..
     111 dr-xr-xr-x     0      0         0 31-Jan-2017 18:14 $RECYCLE.BIN
  837042 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 FOLDER Y
  595293 dr-xr-xr-x     0      0         0 27-Jan-2014 20:36 RECYCLER
      27 dr-xr-xr-x     0      0         0 25-Apr-2015 12:54 System Volume Information
  837039 dr-xr-xr-x     0      0         0  1-Jun-2017 18:00 FOLDER X
   22128 dr-xr-xr-x     0      0         0  5-Dec-2014 12:18 found.000
     111 -r--r--r--     0      0        20 31-Jan-2017 18:14 $RECYCLE.BIN:Mac_Metadata
       5 -r--r--r--     0      0         8  3-Jun-2017 16:12 ..:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
       5 -r--r--r--     0      0         4  3-Jun-2017 16:12 ..:MTIME
       5 -r--r--r--     0      0         8  3-Jun-2017 16:12 .:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
       5 -r--r--r--     0      0         4  3-Jun-2017 16:12 .:MTIME
  595293 -r--r--r--     0      0        20 27-Jan-2014 20:36 RECYCLER:Mac_Metadata
      27 -r--r--r--     0      0        20 25-Apr-2015 12:54 System Volume Information:Mac_Metadata
   22128 -r--r--r--     0      0        20  5-Dec-2014 12:18 found.000:Mac_Metadata

dir_partition inode=837039
   * HPFS - NTFS              0  32 33 45600  23 55  732563456 [Seagate Backup Plus Drive]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_win32_pread(224,2,buffer,216327007(13465/187/2)) read err: read after end of file
file_win32_pread(224,1,buffer,216327007(13465/187/2)) read err: read after end of file
ntfs_readdir failed for cluster 837039: Input/output error
Directory /FOLDER X
  837039 dr-xr-xr-x     0      0         0  1-Jun-2017 18:00 .
       5 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 ..
  347000 dr-xr-xr-x     0      0         0 23-Jan-2014 20:16 Samsung NP-N150Plus Treiber usw
       5 -r--r--r--     0      0         8  3-Jun-2017 16:12 ..:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
       5 -r--r--r--     0      0         4  3-Jun-2017 16:12 ..:MTIME
  660938 -r--r--r--     0      0     17734  7-Nov-2007 07:00 eula.1042.txt
  660835 -r--r--r--     0      0     95248  7-Nov-2007 07:03 install.res.1040.dll
Directory /
       5 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 .
       5 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 ..
     111 dr-xr-xr-x     0      0         0 31-Jan-2017 18:14 $RECYCLE.BIN
  837042 dr-xr-xr-x     0      0         0  3-Jun-2017 16:12 FOLDER Y
  595293 dr-xr-xr-x     0      0         0 27-Jan-2014 20:36 RECYCLER
      27 dr-xr-xr-x     0      0         0 25-Apr-2015 12:54 System Volume Information
  837039 dr-xr-xr-x     0      0         0  1-Jun-2017 18:00 FOLDER X
   22128 dr-xr-xr-x     0      0         0  5-Dec-2014 12:18 found.000
     111 -r--r--r--     0      0        20 31-Jan-2017 18:14 $RECYCLE.BIN:Mac_Metadata
       5 -r--r--r--     0      0         8  3-Jun-2017 16:12 ..:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
       5 -r--r--r--     0      0         4  3-Jun-2017 16:12 ..:MTIME
       5 -r--r--r--     0      0         8  3-Jun-2017 16:12 .:C0B21842-99B8-46E2-A991-EC7EEE7FEF28
       5 -r--r--r--     0      0         4  3-Jun-2017 16:12 .:MTIME
  595293 -r--r--r--     0      0        20 27-Jan-2014 20:36 RECYCLER:Mac_Metadata
      27 -r--r--r--     0      0        20 25-Apr-2015 12:54 System Volume Information:Mac_Metadata
   22128 -r--r--r--     0      0        20  5-Dec-2014 12:18 found.000:Mac_Metadata
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: External Disk went RAW

#2 Post by cgrenier »

Your disk contains bad sectors, you need to clone the disk to a new empty disk (same size or bigger) using ddrescue.
Read https://www.cgsecurity.org/testdisk.pdf chapters "DDRescue: data recovery from damaged disk" and "Creating a live USB".
Once the copy is done (it can take days or weeks), remove the original disk and try try to recover your data from the clone.
Top
Locked

Return to “Filesystem repair”