3 TB GPT partition repair problem

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
Shaping
Posts: 13
Joined: 07 May 2018, 21:28

Re: 3 TB GPT partition repair problem

#11 Post by Shaping »

The TrueCrypt/DiskCryptor materials mention backing up the header of the encrypted container. I did not do that for this drive. Does anyone know whether restoration of the saved header is the only way to repair the partition?

o new registrations are allowed on the DiskCryptor forum. I cannot ask there. Can someone please suggest a correct course of action for repairing a partially decrypted (6%) GPT DiskCryptor data drive? I'm currently doing a backup of a partition that TestDisk has not identified a file system for. That step takes 4 to 5 days, and may not be useful. Is the drive parametric data shown in the previous post eough to rewrite the defining sector (I suppose the first one) for the DiskCryptor container.

Thanks for helping.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: 3 TB GPT partition repair problem

#12 Post by cgrenier »

AFAIK without the TrueCrypt/VeraCrypt backup header, there is no way to restore your data. Sorry

Shaping
Posts: 13
Joined: 07 May 2018, 21:28

Re: 3 TB GPT partition repair problem

#13 Post by Shaping »

Can the header be recreated from from the password?

Can you suggest a good place or person to ask? I can't access the DC forum.

....

This problem, based on the basic behavior of the disk, seems to be about corruption in the MBR of this GPT disk. I'm assuming that all disks, even GPT ones, have an MBR describing the overall structure of the rest of the drive, which in this case has just one partially encrypted partition. The behavior before the brown-out was that I could use Diskcryptor to both decrypt (no mount required) and mount. After the brown-out-caused corruption, Diskcryptor cannot even see the disk so that I can continue the decryption. Windows Disk Management can see an uninitialized, unallocated disk. Does that sound like a corruption problem in the first sector of the encrypted partition or does it sound like a more global problem at the MBR level?

Can I stop creation of the backup.log file now, which hasn't changed since I started it 3 days ago and apply it to the clone? I have another 2 days to go. This is the current contents of backup.log:

#1525895149 Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364794 255 63
1 : start= 34, size= 262144, Id=00, P
2 : start= 264192, size=5860159488, Id=00, P
#1526248285 Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364794 255 63
1 : start= 34, size= 262144, Id=00, P
2 : start= 264192, size=5860159488, Id=00, P
#1526333682 Disk /dev/sde - 3000 GB / 2794 GiB - CHS 364794 255 63
1 : start= 34, size= 262144, Id=00, P
2 : start= 264192, size=5860159488, Id=00, P


Can I load that into TD for the original drive or the clone, and use the data to rewrite a new MBR or new encrypted-parition first sector?

Shaping
Posts: 13
Joined: 07 May 2018, 21:28

Re: 3 TB GPT partition repair problem

#14 Post by Shaping »

...Also I'm reasoning somewhat mechanically about where the head was on the platter at the time of power-cut. I could not see the screen at the time and though the laptop was shutdown. I chose shutdown, but it had restarted anyway. I had power-cycled the external USB RAID during this time--during boot, thinking the laptop was off. I'm assuming that the only thing of interest to the OS at that time would be the drive's MBR, not the details of the encrypted partition on a more inner sector. I'm trying to figure out how the drive-head dumped bad bits into the encrypted partition. But my assumptions could be wrong.

Shaping
Posts: 13
Joined: 07 May 2018, 21:28

Re: 3 TB GPT partition repair problem

#15 Post by Shaping »

cgrenier, you said:

If you really want to work on the clone,
- start by using testdisk on the original disk, Analyse, Backup, Quit
- run testdisk on the clone, Analyse, use Load to get the locations recorded by Backup previously, for each partition, set the partition type, on next screen, choose Write, confirm, Quit and restart your computer.
Top


The backup.log file is complete but has many millions of lines of errors after what looks like some useful data. Here is the first part of the file:

Wed May 9 14:39:19 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, April 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=30752636928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=3000537972736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=3000592977920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=256060514304
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=30752636928
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=3000537972736
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592977920
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=4000787029504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=255414239232
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=240054697984
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=30751588352
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=3000457232384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=2000395698176
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SV300S37A240G, S/N:50026B774C0C5050, FW:600ABBF0
Disk /dev/sdb - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - HFS256G39TND-N210A, S/N:FI68N00571160881C, FW:30001P10
Disk /dev/sdc - 30 GB / 28 GiB - CHS 3738 255 63, sector size=512 - SanDisk Ultra, S/N:4C530001050228106060, FW:1.00
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364794 255 63, sector size=512 - JMicron H/W RAID1, S/N:000000000000, FW:0X0=
Disk /dev/sde - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Seagate Expansion Desk, S/N:NA4JLCDL, FW:070B
Disk /dev/sdf - 4000 GB / 3726 GiB - CHS 486401 255 63, sector size=512 - Seagate Backup+ Hub BK, S/N:NA8TVFEN, FW:D781
Disk /dev/sdg - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate Expansion, S/N:NA885G3B, FW:9300
Disk \\.\PhysicalDrive4 - 3000 GB / 2794 GiB - CHS 45600 255 63, sector size=4096 - Seagate Expansion Desk, S/N:NA4JLCDL, FW:070B
Drive G: - 3000 GB / 2794 GiB - CHS 45598 255 63, sector size=4096 - Seagate Expansion Desk, S/N:NA4JLCDL, FW:070B

Partition table type (auto): EFI GPT
Disk /dev/sdd - 3000 GB / 2794 GiB - JMicron H/W RAID1
Partition table type: EFI GPT

Analyse Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364794 255 63
hdr_size=92
hdr_lba_self=5860425727
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=5860425694
hdr_lba_table=5860425695
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
check_part_gpt failed for partition
2 P MS Data 264192 5860423679 5860159488 [Basic data partition]
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860423679 5860159488 [Basic data partition]
2 P MS Data 264192 5860423679 5860159488 [Basic data partition]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
1 P MS Reserved 34 262177 262144 [Microsoft reserved partition]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS Data 264192 5860423679 5860159488 [Basic data partition]
2 P MS Data 264192 5860423679 5860159488 [Basic data partition]
Backup partition structure
partition_save

search_part()
Disk /dev/sdd - 3000 GB / 2794 GiB - CHS 364794 255 63
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 27048/161/45

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 434536307 1456631238262642 1456630803726336 [í†ÿ|§‹]
SysV4, 745794 TB / 678296 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 142114/145/4

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2283070548 138580328244307 138578045173760 [F…h]
SysV4, 70951 TB / 64530 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 2852842437 5766106747 2913264311
FATX, 1491 GB / 1389 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 3350147833 5455478862590712 5455475512442880 [õD’œ"–šdÉÁ¦œ[‘É85°‹©œÎ?*¿ ]
BeFS blocksize=32, 2793203 TB / 2540403 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad number of sectors per cluster

0 0000 0000 00 00 00 00 00 00 00 00
Unknown 3541098688 3706482053 165383365
WBFS, 84 GB / 78 GiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.
check_FAT: Bad jump in FAT partition
file_pread(7,1,buffer,5860425728(364794/160/39)) ReadFile The drive cannot find the sector requested.

file_pread(7,1,buffer,5860425729(364794/160/40)) lseek err Invalid argument
file_pread(7,1,buffer,5860425730(364794/160/41)) lseek err Invalid argument
file_pread(7,1,buffer,5860425731(364794/160/42)) lseek err Invalid argument
file_pread(7,1,buffer,5860425732(364794/160/43)) lseek err Invalid argument
file_pread(7,1,buffer,5860425733(364794/160/44)) lseek err Invalid argument
file_pread(7,1,buffer,5860425734(364794/160/45)) lseek err Invalid argument
file_pread(7,1,buffer,5860425735(364794/160/46)) lseek err Invalid argument
file_pread(7,1,buffer,5860425736(364794/160/47)) lseek err Invalid argument
file_pread(7,1,buffer,5860425737(364794/160/48)) lseek err Invalid argument
file_pread(7,1,buffer,5860425738(364794/160/49)) lseek err Invalid argument
file_pread(7,1,buffer,5860425739(364794/160/50)) lseek err Invalid argument
file_pread(7,1,buffer,5860425740(364794/160/51)) lseek err Invalid argument
file_pread(7,1,buffer,5860425741(364794/160/52)) lseek err Invalid argument
file_pread(7,1,buffer,5860425742(364794/160/53)) lseek err Invalid argument
file_pread(7,1,buffer,5860425743(364794/160/54)) lseek err Invalid argument
file_pread(7,1,buffer,5860425744(364794/160/55)) lseek err Invalid argument
file_pread(7,1,buffer,5860425745(364794/160/56)) lseek err Invalid argument
file_pread(7,1,buffer,5860425746(364794/160/57)) lseek err Invalid argument
file_pread(7,1,buffer,5860425747(364794/160/58)) lseek err Invalid argument
file_pread(7,1,buffer,5860425748(364794/160/59)) lseek err Invalid argument
file_pread(7,1,buffer,5860425749(364794/160/60)) lseek err Invalid argument
file_pread(7,1,buffer,5860425750(364794/160/61)) lseek err Invalid argument
file_pread(7,1,buffer,5860425751(364794/160/62)) lseek err Invalid argument
file_pread(7,1,buffer,5860425752(364794/160/63)) lseek err Invalid argument
file_pread(7,1,buffer,5860425753(364794/161/1)) lseek err Invalid argument
file_pread(7,1,buffer,5860425754(364794/161/2)) lseek err Invalid argument
file_pread(7,1,buffer,5860425755(364794/161/3)) lseek err Invalid argument
file_pread(7,1,buffer,5860425756(364794/161/4)) lseek err Invalid argument
file_pread(7,1,buffer,5860425757(364794/161/5)) lseek err Invalid argument
file_pread(7,1,buffer,5860425758(364794/161/6)) lseek err Invalid argument

----------------

I tried the following procedure to try to correct the MBR:

1. Mount your external encrypted disc
2. Start TestDisk
3. Choice <No Log>
4. Select in the list your external encrypted disc
5. Select the partition table type to <none>
6. Select <Advanced>
7. Choice <type>
8. Choice from the list the right filesystem (i.e. FAT/NTFS...)
9. Choice <boot>
10. Choice <Rebuild BS>

from https://diskcryptor.net/forum/index.php?topic=2153.0

After waiting about 1 day for the MFT search to finish, saw the following page screen:
Attachments
TestDisk screen after Rebuild BS.png
TestDisk screen after Rebuild BS.png (21.57 KiB) Viewed 2285 times

Locked