Raid 5 partition lost

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bbohica
Posts: 3
Joined: 11 Oct 2018, 23:56

Raid 5 partition lost

#1 Post by bbohica »

I've lost my RAID 5 partition. The raid drive is healthy (promise controller, 4x1TB drives, raid 5 size 3TB)

Testdisk finds 6 partitions labeled as Mac HFS. I'm not sure why they are Mac HFS, I don't recall how I set it up, but I'm on a PC with Win 7 Embedded.

When I click P, it says "this filesystem hasn't been implemented" so I can't tell which is the proper partition or how to recover the files. I"m afraid to "write" any of the partition structures to disk in case its the wrong partition choice. I'm not sure what to do next and would appreciate some advice.

Cheers.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Raid 5 partition lost

#2 Post by cgrenier »

As your computer is running Windows, the HFS "partition" are probably false positive.
After selecting the disk, is EFI GPT auto-detetected ?
In Advanced, is a MS Data partition using the whole disk listed ?

bbohica
Posts: 3
Joined: 11 Oct 2018, 23:56

Re: Raid 5 partition lost

#3 Post by bbohica »

Yes, EFI GPT was auto detected. Also, this is not a boot drive, just a data drive.

In Advanced, I have
1 P MS Reserved ..... [Microsoft reserved]
2 P MS Data ............[Basic data partition]

I just ran the tool again and it's searching for the two MS drives now with the below info given. Does the duplicate listing of 1 and 2 indicate corruption in a certain way?

Current partition structure:
No Fat, NTFS, ext2, JFS, Reiser, cramfs, or XFS marker
1 P MS Reserved 10 65545 65536 [Microsoft Reserved]
1 P MS Reserved 10 65545 65536 [Microsoft Reserved]
No Fat, NTFS, ext2, JFS, Reiser, cramfs, or XFS marker
2 P MS Data 66048 1465045503 1464979456 [ Basic data partition]
2 P MS Data 66048 1465045503 1464979456 [ Basic data partition]

It still just seems to be finding Mac HFS partions so far but I'm still in the first percent of the search.

bbohica
Posts: 3
Joined: 11 Oct 2018, 23:56

Re: Raid 5 partition lost

#4 Post by bbohica »

It's at 96% now after 2 days of running, here is the log file, still no really clear what is going on.




Thu Oct 11 09:59:34 2018

Command line: TestDisk


TestDisk 7.1-WIP, Data Recovery Utility, June 2018

Christophe GRENIER <grenier@cgsecurity.org>

https://www.cgsecurity.org

OS: Windows 7 (7601) SP1

Compiler: GCC 6.4, Cygwin 2009.0

ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320078872576

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=3000413257728

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320078872576

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=3000413257728

filewin32_getfilesize(\\.\PhysicalDrive2) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\PhysicalDrive2) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\PhysicalDrive2

filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\PhysicalDrive3

filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\PhysicalDrive4

filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.


filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.


Warning: can't get size for \\.\PhysicalDrive5

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=319971917824

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=185389056

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=3000277925888

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0

Warning: can't get size for \\.\G:

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0

Warning: can't get size for \\.\H:

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0

Warning: can't get size for \\.\I:

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0

Warning: can't get size for \\.\J:

Hard disk list

Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63, sector size=512 - Intel Raid 0 Volume, S/N:Volume0, FW:1.0.

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 91194 255 63, sector size=2048 - Promise 4 Disk RAID5, S/N:3456ef5078cd000400000000000000000000000000000000, FW:1.10

Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 91194 255 63, sector size=2048 - Promise 4 Disk RAID5, S/N:3456ef5078cd000400000000000000000000000000000000, FW:1.10

Drive D: - 185 MB / 176 MiB - CHS 44 64 32, sector size=2048 - HL-DT-ST BD-RE BH10LS38, S/N:8KCAP25912 5, FW:1.00

Drive E: - 3000 GB / 2794 GiB - CHS 91190 255 63, sector size=2048 - Promise 4 Disk RAID5, S/N:3456ef5078cd000400000000000000000000000000000000, FW:1.10


Partition table type (auto): EFI GPT

Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - Promise 4 Disk RAID5

Partition table type: EFI GPT


Analyse Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 91194 255 63

hdr_size=92

hdr_lba_self=1

hdr_lba_alt=1465045535 (expected 1465045535)

hdr_lba_start=10

hdr_lba_end=1465045526

hdr_lba_table=2

hdr_entries=128

hdr_entsz=128

check_part_gpt failed for partition

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

check_part_gpt failed for partition

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]

Current partition structure:

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]


search_part()

Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 91194 255 63


HFS+ magic value at 678/161/1


HFS+ magic value at 678/161/1

part_size 299120

Mac HFS 10902213 11201332 299120

HFS+ blocksize=2048 + Backup, 612 MB / 584 MiB


HFS+ magic value at 760/143/31


HFS+ magic value at 760/143/31

part_size 308851

Mac HFS 12218439 12527289 308851

HFS+ blocksize=2048 + Backup, 632 MB / 603 MiB


HFS+ magic value at 779/204/5


HFS+ magic value at 779/204/5

part_size 328850

Mac HFS 12527491 12856340 328850

HFS+ blocksize=2048 + Backup, 673 MB / 642 MiB

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)


HFS+ magic value at 5740/97/11


HFS+ magic value at 5740/97/11

part_size 299120

Mac HFS 92219221 92518340 299120

HFS+ blocksize=2048 + Backup, 612 MB / 584 MiB


HFS+ magic value at 6149/116/53


HFS+ magic value at 6149/116/53

part_size 308851

Mac HFS 98791045 99099895 308851

HFS+ blocksize=2048 + Backup, 632 MB / 603 MiB


HFS+ magic value at 6186/183/5


HFS+ magic value at 6186/183/5

part_size 328850

Mac HFS 99389623 99718472 328850

HFS+ blocksize=2048 + Backup, 673 MB / 642 MiB

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

check_FAT: number of bytes per sector mismatches 512 (FAT) != 2048 (HD)

Search for partition aborted


Results

P Mac HFS 10902213 11201332 299120

HFS+ blocksize=2048 + Backup, 612 MB / 584 MiB

P Mac HFS 12218439 12527289 308851

HFS+ blocksize=2048 + Backup, 632 MB / 603 MiB

P Mac HFS 12527491 12856340 328850

HFS+ blocksize=2048 + Backup, 673 MB / 642 MiB

P Mac HFS 92219221 92518340 299120

HFS+ blocksize=2048 + Backup, 612 MB / 584 MiB

P Mac HFS 98791045 99099895 308851

HFS+ blocksize=2048 + Backup, 632 MB / 603 MiB

P Mac HFS 99389623 99718472 328850

HFS+ blocksize=2048 + Backup, 673 MB / 642 MiB


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850


P Mac HFS 10902213 11201332 299120

HFS+ blocksize=2048 + Backup, 612 MB / 584 MiB

Support for this filesystem hasn't been implemented.


P Mac HFS 12218439 12527289 308851

HFS+ blocksize=2048 + Backup, 632 MB / 603 MiB

Support for this filesystem hasn't been implemented.


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850


P Mac HFS 10902213 11201332 299120

HFS+ blocksize=2048 + Backup, 612 MB / 584 MiB

Support for this filesystem hasn't been implemented.


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850


interface_write()

1 P Mac HFS 10902213 11201332 299120

2 P Mac HFS 12218439 12527289 308851

3 P Mac HFS 12527491 12856340 328850

4 P Mac HFS 92219221 92518340 299120

5 P Mac HFS 98791045 99099895 308851

6 P Mac HFS 99389623 99718472 328850

simulate write!


Interface Advanced

hdr_size=92

hdr_lba_self=1

hdr_lba_alt=1465045535 (expected 1465045535)

hdr_lba_start=10

hdr_lba_end=1465045526

hdr_lba_table=2

hdr_entries=128

hdr_entsz=128

check_part_gpt failed for partition

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

check_part_gpt failed for partition

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]


Analyse Disk \\.\PhysicalDrive1 - 3000 GB / 2794 GiB - CHS 91194 255 63

hdr_size=92

hdr_lba_self=1

hdr_lba_alt=1465045535 (expected 1465045535)

hdr_lba_start=10

hdr_lba_end=1465045526

hdr_lba_table=2

hdr_entries=128

hdr_entsz=128

check_part_gpt failed for partition

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

check_part_gpt failed for partition

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]

Current partition structure:

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

1 P MS Reserved 10 65545 65536 [Microsoft reserved partition]

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]

2 P MS Data 66048 1465045503 1464979456 [Basic data partition]

Locked