Reboot Raw Disk

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
grumbleskin
Posts: 7
Joined: 15 Aug 2017, 01:46

Reboot Raw Disk

#1 Post by grumbleskin »

I rebooted my machine and the disk has come back RAW.
I am in the process of doing a Deep Scan, but my question is...

When I ran Testdisk it said there were parameters on the disk that were wrong.
Boot Sector seems ok and Backup seems ok.

Disk comes back GPT which is correct but it is saying it is a MSData.

Says MFT and backup are screwed up.

With the parameters of the driving showing weird, could it be looking in the wrong sector for the MFT?
The drive hasn't tried to chkdsk nor has it asked me to format. Just says "parameter is incorrect" in windows.

Her is my log:



Fri Dec 1 09:48:09 2017
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdh)=3000504418304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdi)=3000504418304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdj)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdk)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdl)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdm)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive7)=3000504418304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive8)=3000504418304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive9)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive10)=2000313909248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive11)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive12)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=126767120384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=128033226752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000194048000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=3000502321152
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3000501272576
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=2000311812096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=2000311812096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=2000311812096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=2000311812096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=2000311812096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=2000311812096
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=3000591450112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=500105740288
filewin32_getfilesize(\\.\Z:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\Z:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\Z:
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 72736 191 18, sector size=512
Disk /dev/sdb - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512
Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Disk /dev/sdd - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Disk /dev/sde - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Disk /dev/sdf - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Disk /dev/sdg - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 364790 255 63, sector size=512
Disk /dev/sdi - 3000 GB / 2794 GiB - CHS 364790 255 63, sector size=512
Disk /dev/sdj - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Disk /dev/sdk - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Disk /dev/sdl - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdm - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Drive C: - 126 GB / 118 GiB - CHS 72016 191 18, sector size=512
Drive D: - 128 GB / 119 GiB - CHS 15565 255 63, sector size=512
Drive E: - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512
Drive F: - 3000 GB / 2794 GiB - CHS 364790 255 63, sector size=512
Drive G: - 3000 GB / 2794 GiB - CHS 364790 255 63, sector size=512
Drive H: - 2000 GB / 1862 GiB - CHS 243190 255 63, sector size=512
Drive N: - 3000 GB / 2794 GiB - CHS 364801 255 63, sector size=512
Drive O: - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdh - 3000 GB / 2794 GiB
Partition table type: EFI GPT

Analyse Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 364790 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=5860360191 (expected 5860360191)
hdr_lba_start=34
hdr_lba_end=5860360158
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
1 P MS Data 2048 5860358143 5860356096 [Basic data partition]

search_part()
Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 364790 255 63
NTFS at 0/32/33
filesystem size 5860356089
sectors_per_cluster 8
mft_lcn 22359
mftmirr_lcn 22358
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=3000502317568, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size 5860356089
sectors_per_cluster 8
mft_lcn 22359
mftmirr_lcn 22358
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 5860358136 5860356089
NTFS, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364790/107/53
filesystem size 5860356089
sectors_per_cluster 8
mft_lcn 22359
mftmirr_lcn 22358
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2055 5860358143 5860356089
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
NTFS at 364790/107/53
filesystem size 5860356089
sectors_per_cluster 8
mft_lcn 22359
mftmirr_lcn 22358
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(11,1024,buffer,1565572791(364801/190/53)) lseek err Invalid argument
file_pread(11,1,buffer,1565572791(364801/190/53)) lseek err Invalid argument
NTFS: Can't read MFT
MS Data 5860358143 11720714231 5860356089
NTFS, blocksize=4096, 3000 GB / 2794 GiB
This partition ends after the disk limits. (start=5860358143, size=5860356089, end=11720714231, disk end=5860360192)
file_pread(11,1,buffer,1565392896(364790/140/23)) ReadFile Incorrect function.


file_pread(11,1,buffer,1565394579(364790/167/5)) lseek err$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Invalid argument
file_pread(11,1,buffer,1565394580(364790/167/6)) lseek err Invalid argument
file_pread(11,1,buffer,1565394581(364790/167/7)) lseek err Invalid argument

file_pread(11,1,buffer,1565393032(364790/142/33)) lseek err Invalid argument
file_pread(11,1,buffer,1565394945(364790/172/56)) lseek err Invalid argument
Disk /dev/sdh - 3000 GB / 2794 GiB - CHS 364790 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3000 GB / 2794 GiB) seems too small! (< 6001 GB / 5588 GiB)
The following partition can't be recovered:
MS Data 5860358143 11720714231 5860356089
NTFS, blocksize=4096, 3000 GB / 2794 GiB

Results
MS Data 2048 5860358136 5860356089
NTFS, blocksize=4096, 3000 GB / 2794 GiB
MS Data 2055 5860358143 5860356089
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB

MS Data 2048 5860358136 5860356089
NTFS, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.

MS Data 2055 5860358143 5860356089
NTFS found using backup sector, blocksize=4096, 3000 GB / 2794 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()

No partition found or selected for recovery

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Reboot Raw Disk

#2 Post by cgrenier »

Run "cmd" (right click run as administrator) and "chkdsk /f d:" (replace d: by the correct drive letter).
What is the results ?

grumbleskin
Posts: 7
Joined: 15 Aug 2017, 01:46

Re: Reboot Raw Disk

#3 Post by grumbleskin »

The type of file system is NTFS.
Unable to determine volume version and state. CHKDSK aborted.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Reboot Raw Disk

#4 Post by cgrenier »

You can use PhotoRec to recover your data but it will not recover the original filenames. You can also try some commercial data recovery utilities, they may have better success in recovering the original file hierarchy.

Locked