External HDD with file system Raw

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Joerg85
Posts: 4
Joined: 10 Aug 2017, 09:37

External HDD with file system Raw

#1 Post by Joerg85 »

Dear All

I got a serious problem with an 1TB external USB 3.0 HDD. When using it to move data from an old computer to a new one, out of a sudden the explorer showed it as a local drive and I haven't any chance to open it and to get access to my data. The windows tool 'Datenträgerverwaltung' (don't know the English term) showed it having the file system Raw.

It tried testdisk 7,0-wip but didn't succeed.
From the log I am picking up the following after having just confirmed the highlighted 'none' for patition table type:
Boot sector
Status: OK
Backup boot sector
Status: OK
Extrapolated boot sector and current boot sector are different.
Can't open filesystem. Filesystem seems damaged.


After having started again and proceed with 'intel' type the following is logged:

Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 13577 238 11 119521 238 60 1701990410
2 * Sys=74 45381 70 3 79242 34 29 543974724 search_part()

and
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Partition not added.
Search for partition aborted
Results
interface_write()
No partition found or selected for recovery

Does this mean somthing is there and I just didn't use testdisk correctly or would it be better to use version 7.1_wip, is ther any chance to get back my approx 500GB of data

I need some help

Thanks a lot

Jörg

----------------------------------------------------------------------------------------------------------------------------------------------------
Here the complete log file:

Mon Aug 7 21:23:53 2017
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-16T08:48:23
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8242855936
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8242855936
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000170586112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=27291446784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=117907658240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=104857600000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=1000169537536
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=8242184192
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512
Disk /dev/sdb - 8242 MB / 7861 MiB - CHS 1002 255 63, sector size=512
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512

Drive C: - 27 GB / 25 GiB - CHS 3317 255 63, sector size=512

Drive D: - 117 GB / 109 GiB - CHS 14334 255 63, sector size=512

Drive E: - 104 GB / 97 GiB - CHS 12748 255 63, sector size=512

Drive F: - 1000 GB / 931 GiB - CHS 121597 255 63, sector size=512

Drive M: - 8242 MB / 7860 MiB - CHS 1002 255 63, sector size=512


Partition table type (auto): None

Drive F: - 1000 GB / 931 GiB
Partition table type: None

Interface Advanced
NTFS at 0/0/1
filesystem size 1953456128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007
clusters_per_mft_record -10
clusters_per_index_record 1

NTFS at 0/0/1
P NTFS 0 0 1 121597 5 8 1953456128
NTFS, blocksize=4096, 1000 GB / 931 GiB


ntfs_boot_sector
P NTFS 0 0 1 121597 5 8 1953456128
NTFS, blocksize=4096, 1000 GB / 931 GiB

NTFS at 0/0/1
NTFS at 0/0/1
filesystem size 1953456128

sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007

clusters_per_mft_record -10

clusters_per_index_record 1

Boot sector
Status: OK


Backup boot sector
Status: OK


Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
ntfs_mapping_pairs_decompress() failed: Input/output error.

ntfs_mft_load(): Failed.

Failed to load $MFT: Input/output error.

Failed to startup volume: Input/output error.

ntfs_mapping_pairs_decompress() failed: Input/output error.

ntfs_mft_load(): Failed.

Failed to load $MFT: Input/output error.


P NTFS 0 0 1 121597 5 8 1953456128
NTFS, blocksize=4096, 1000 GB / 931 GiB

Can't open filesystem. Filesystem seems damaged.


ntfs_boot_sector
P NTFS 0 0 1 121597 5 8 1953456128
NTFS, blocksize=4096, 1000 GB / 931 GiB

NTFS at 0/0/1
NTFS at 0/0/1

filesystem size 1953456128
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007

clusters_per_mft_record -10
clusters_per_index_record 1

Boot sector
Status: OK


Backup boot sector
Status: OK


Sectors are identical.


A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

ntfs_mapping_pairs_decompress() failed: Input/output error.
ntfs_mft_load(): Failed.

Failed to load $MFT: Input/output error.

Failed to startup volume: Input/output error.

ntfs_mapping_pairs_decompress() failed: Input/output error.
ntfs_mft_load(): Failed.

Failed to load $MFT: Input/output error.

rebuild_NTFS_BS
mft at 976728056

ntfs_find_mft: mft_lcn 786432

ntfs_find_mft: mftmirr_lcn 122091007

ntfs_find_mft: sectors_per_cluster 8

ntfs_find_mft: mft_lcn 786432

ntfs_find_mft: mftmirr_lcn 122091007

ntfs_find_mft: mft_record_size 1024

ntfs_find_mft: index_block_size 4096
New / Current boot sector
filesystem size 1953456128 1953456128

sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 122091007 122091007

clusters_per_mft_record -10 -10

clusters_per_index_record 1 1

Extrapolated boot sector and current boot sector are different.

filesystem size 1953456128 1953456128

sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 122091007 122091007

clusters_per_mft_record -10 -10

clusters_per_index_record 1 1


P NTFS 0 0 1 121597 5 8 1953456128
NTFS, blocksize=4096, 1000 GB / 931 GiB

Can't open filesystem. Filesystem seems damaged.

filesystem size 1953456128 1953456128

sectors_per_cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 122091007 122091007

clusters_per_mft_record -10 -10

clusters_per_index_record 1 1


ntfs_boot_sector

P NTFS 0 0 1 121597 5 8 1953456128
NTFS, blocksize=4096, 1000 GB / 931 GiB

NTFS at 0/0/1

NTFS at 0/0/1

filesystem size 1953456128

sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007

clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector

Status: OK


Backup boot sector
Status: OK


Sectors are identical.


A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

_______________________________________________________________________________________________________________

Partition table type (auto): None
Drive F: - 1000 GB / 931 GiB


Partition table type: Intel


Analyse
Drive F: - 1000 GB / 931 GiB - CHS 121597 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=218129509 5918957
check_part_i386 1 type 72: no test
BAD_RS LBA=729050177 1083631
check_part_i386 2 type 74: no test
BAD_RS LBA=168653938 1838434

Current partition structure:

1 * Sys=72 13577 238 11 119521 238 60 1701990410

Bad relative sector.

2 * Sys=74 45381 70 3 79242 34 29 543974724

Bad relative sector.

3 * NetWare 3.11+ 10498 56 41 10498 56 40 0


Bad relative sector.

Only one partition must be bootable

Space conflict between the following two partitions

1 * Sys=72 13577 238 11 119521 238 60 1701990410

2 * Sys=74 45381 70 3 79242 34 29 543974724

search_part()


Drive F: - 1000 GB / 931 GiB - CHS 121597 255 63
NTFS at 121597/5/8
filesystem size 1953456128

sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007

clusters_per_mft_record -10

clusters_per_index_record 1
HPFS - NTFS 0 0 1 121597 5 8 1953456128
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB

Partition not added.

Search for partition aborted


Results

interface_write()


No partition found or selected for recovery

search_part()

Drive F: - 1000 GB / 931 GiB - CHS 121597 255 63

NTFS at 121597/5/8
filesystem size 1953456128

sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007

clusters_per_mft_record -10

clusters_per_index_record 1
HPFS - NTFS 0 0 1 121597 5 8 1953456128
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB

Partition not added.

Search for partition aborted


Results

interface_write()


No partition found or selected for recovery

simulate write!


write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition



Analyse

Drive F: - 1000 GB / 931 GiB - CHS 121597 255 63

Geometry from i386 MBR: head=116 sector=52

BAD_RS LBA=218129509 5918957

check_part_i386 1 type 72: no test

BAD_RS LBA=729050177 1083631

check_part_i386 2 type 74: no test

BAD_RS LBA=168653938 1838434

Current partition structure:

1 * Sys=72 13577 238 11 119521 238 60 1701990410

Bad relative sector.

2 * Sys=74 45381 70 3 79242 34 29 543974724

Bad relative sector.

3 * NetWare 3.11+ 10498 56 41 10498 56 40 0

Bad relative sector.

Only one partition must be bootable
Space conflict between the following two partitions

1 * Sys=72 13577 238 11 119521 238 60 1701990410

2 * Sys=74 45381 70 3 79242 34 29 543974724

search_part()

Drive F: - 1000 GB / 931 GiB - CHS 121597 255 63
NTFS at 121597/5/8
filesystem size 1953456128

sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 122091007

clusters_per_mft_record -10

clusters_per_index_record 1
HPFS - NTFS 0 0 1 121597 5 8 1953456128

NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB

Partition not added.
Search for partition aborted


Results

interface_write()

No partition found or selected for recovery
Last edited by Joerg85 on 16 Aug 2017, 20:22, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: External HDD with file system Raw

#2 Post by cgrenier »

Have you try chkdsk ? What is the output ?
Read "Repairing filesystem" from https://www.cgsecurity.org/testdisk.pdf

Joerg85
Posts: 4
Joined: 10 Aug 2017, 09:37

Re: External HDD with file system Raw

#3 Post by Joerg85 »

I didn't try chkdsk, because the disk manager is showing the disk having now the raw file system and as I understood para 7,5 of testdisk.pdf chkdsk is not available for this file system. Shall I try it nevertheless?

Thanks

Jörg

Joerg85
Posts: 4
Joined: 10 Aug 2017, 09:37

Re: External HDD with file system Raw

#4 Post by Joerg85 »

I did read the instruction and since the disk manager showed the disk as having the file system raw, I only used testdisk.
this what I did
1. I selected 'created'
at the next screen patition table type 'none' has been highlighted by testdisk

2. I selected 'advance'
a the next screen I got:
P NTFS 0 0 1 121597 5 8 1953456128

3. I selected 'boot'
at the next screen I got
Boot sector
status: OK

back up boot sector
status OK
sectors are identical

A valid NTFS Boot sector must be present in order to access any data; even if the partition in not
bootable

3. I selected 'List'
at the next screen I got:
Can't open file system. Filesystem seems damaged

4. I selected 'quit' and then 'rebuild boot BS'
at the next screen I got:
file system size 1953456128 1953456128
sectors per cluster 8 8
mft_lcn 786432 786432
mftmirr_lcn 122091007 122091007
clusters_per_mft_record -10 -10
clusters_per_index_record 1 1
Extrapolated boot sector and current boot sector are different

5. I selected 'lst'
at the next screen I got:
Can't open filesystem. Filesystem seems damaged

should I have selected MFT_repair furhter up?

Joerg85
Posts: 4
Joined: 10 Aug 2017, 09:37

Re: External HDD with file system Raw

#5 Post by Joerg85 »

Update
Problem has been solved in the meantime by a colleague. As I have been told Win 10 inbuild tools were sufficient to convert it back from raw into NTFS

Locked