After a few episodes of blue screens on a win10 PC, a relatively new Intenso 5TB external HDD (named "Murmansk" drive letter I: file system:NTFS) with important documentaries and videos on it got RAW.
There is no physical damage on the HDD. I am not an expert on PCs.
I Initially followed the basic steps as follows:
create -> Disk /dev/sdd (disk selection) -> Intel -> Analyse -> Quick Search
After Quick Search I got these messages "Hard disk seems too small"
and "the following partition can't be recovered/ filesystem damaged"
The Log File of this 1st attempt:
Code: Select all
Wed May 22 23:50:04 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001175125504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=5000981078016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001175125504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=5000981078016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1000097185792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4695818240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=6001175090688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=5000969191424
filewin32_getfilesize(\\.\N:) GetFileSize err ÅóöáëìÝíç ëåéôïõñãßá.(Incorrect operation)
filewin32_setfilepointer(\\.\N:) SetFilePointer err ÅóöáëìÝíç ëåéôïõñãßá.(Incorrect operation)
Warning: can't get size for \\.\N:
filewin32_getfilesize(\\.\O:) GetFileSize err ÅóöáëìÝíç ëåéôïõñãßá.(Incorrect operation)
filewin32_setfilepointer(\\.\O:) SetFilePointer err ÅóöáëìÝíç ëåéôïõñãßá.(Incorrect operation)
Warning: can't get size for \\.\O:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WD WD10EZEX-08WN4A0, S/N:WD-WCC6Y1EAFHLE, FW:01.0
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - Seagate Backup+ Hub BK, S/N:NA9Q4NMH, FW:D781
Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63, sector size=4096 - Intenso External USB 3.0, S/N:2016122910159, FW:1402
Disk \\.\PhysicalDrive3 - 5000 GB / 4657 GiB - CHS 76000 255 63, sector size=4096 - Intenso External USB 3.0, S/N:2016122910159, FW:1402
Drive D: - 4695 MB / 4478 MiB - CHS 1119 64 32, sector size=2048 - ATAPI iHAS120 X, FW:FL01
Drive I: - 5000 GB / 4657 GiB - CHS 75999 255 63, sector size=4096 - Intenso External USB 3.0, S/N:2016122910159, FW:1402
Partition table type (auto): Intel
Disk /dev/sdd - 5000 GB / 4657 GiB - Intenso External USB 3.0
Partition table type: Intel
Analyse Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 P HPFS - NTFS 0 4 5 75999 254 63 1220939744
1 P HPFS - NTFS 0 4 5 75999 254 63 1220939744
No partition is bootable
search_part()
Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63
NTFS at 75999/254/63
filesystem size 1220939744
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 4 5 75999 254 63 1220939744 [Murmansk]
NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 75999/254/63
filesystem size 1220939744
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
file_pread(6,1,buffer,1221726434(76048/243/6)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 75999 254 63 151999 250 58 1220939744
NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=1220939999, size=1220939744, end=2441879742, disk end=1220942646)
file_pread(6,1,buffer,1220942847(76000/45/13)) lseek err Invalid argument
Search for partition aborted
Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (5000 GB / 4657 GiB) seems too small! (< 10001 GB / 9315 GiB)
The following partition can't be recovered:
HPFS - NTFS 75999 254 63 151999 250 58 1220939744
NTFS, blocksize=4096, 5000 GB / 4657 GiB
Results
* HPFS - NTFS 0 4 5 76000 0 32 1220939776 [Murmansk]
NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Not an exFAT boot sector.
* HPFS - NTFS 0 4 5 76000 0 32 1220939776 [Murmansk]
NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 4 5 76000 0 32 1220939776 [Murmansk]
search_part()
Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63
BAD_RS LBA=3319709394 4109838
file_pread(6,3,buffer,3319709394(206642/89/58)) lseek err Invalid argument
file_pread(6,1,buffer,3319709394(206642/89/58)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 206642 89 58 438199 97 18 3719963670
This partition ends after the disk limits. (start=3319709394, size=3719963670, end=7039673063, disk end=1220942646)
BAD_RS LBA=1477446660 16075720
file_pread(6,1,buffer,1477446660(91966/204/19)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 91966 204 19 296656 32 14 3288334010
This partition ends after the disk limits. (start=1477446660, size=3288334010, end=4765780669, disk end=1220942646)
BAD_RS LBA=1816229660 15556514
file_pread(6,1,buffer,1816229660(113055/17/15)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 113055 17 15 248286 216 23 2172498561
This partition ends after the disk limits. (start=1816229660, size=2172498561, end=3988728220, disk end=1220942646)
BAD_RS LBA=4391942050 7121846
file_pread(6,3,buffer,4391942050(273385/190/56)) lseek err Invalid argument
file_pread(6,1,buffer,4391942050(273385/190/56)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 273385 190 56 503730 62 12 3700484318
This partition ends after the disk limits. (start=4391942050, size=3700484318, end=8092426367, disk end=1220942646)
BAD_RS LBA=2048779815 10251440
file_pread(6,3,buffer,2048779815(127530/164/34)) lseek err Invalid argument
file_pread(6,1,buffer,2048779815(127530/164/34)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 127530 164 34 184406 20 46 913703881
This partition ends after the disk limits. (start=2048779815, size=913703881, end=2962483695, disk end=1220942646)
BAD_RS LBA=5169425748 8490826
file_pread(6,3,buffer,5169425748(321781/221/61)) lseek err Invalid argument
file_pread(6,1,buffer,5169425748(321781/221/61)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
FAT16 >32M 321781 221 61 388655 76 23 1074321638
This partition ends after the disk limits. (start=5169425748, size=1074321638, end=6243747385, disk end=1220942646)
NTFS at 75999/254/63
filesystem size 1220939744
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
HPFS - NTFS 0 4 5 75999 254 63 1220939744 [Murmansk]
NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
NTFS at 75999/254/63
filesystem size 1220939744
sectors_per_cluster 1
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record 1
clusters_per_index_record 1
file_pread(6,1,buffer,1221726434(76048/243/6)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 75999 254 63 151999 250 58 1220939744
NTFS, blocksize=4096, 5000 GB / 4657 GiB
This partition ends after the disk limits. (start=1220939999, size=1220939744, end=2441879742, disk end=1220942646)
file_pread(6,1,buffer,1220942847(76000/45/13)) lseek err Invalid argument
file_pread(6,1,buffer,1220942848(76000/45/14)) lseek err Invalid argument
file_pread(6,1,buffer,1220942847(76000/45/13)) lseek err Invalid argument
Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (5000 GB / 4657 GiB) seems too small! (< 33 TB / 30 TiB)
The following partitions can't be recovered:
HPFS - NTFS 75999 254 63 151999 250 58 1220939744
NTFS, blocksize=4096, 5000 GB / 4657 GiB
HPFS - NTFS 91966 204 19 296656 32 14 3288334010
HPFS - NTFS 113055 17 15 248286 216 23 2172498561
FAT32 127530 164 34 184406 20 46 913703881
FAT16 >32M 206642 89 58 438199 97 18 3719963670
FAT32 LBA 273385 190 56 503730 62 12 3700484318
FAT16 >32M 321781 221 61 388655 76 23 1074321638
Results
* HPFS - NTFS 0 4 5 76000 0 32 1220939776 [Murmansk]
NTFS found using backup sector, blocksize=4096, 5000 GB / 4657 GiB
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
This is the log file:
Code: Select all
Thu May 23 10:27:30 2019
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, December 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=6001175125504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=5000981078016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=6001175125504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=5000981078016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1000097185792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4695818240
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=6001175090688
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=5000969191424
filewin32_getfilesize(\\.\N:) GetFileSize err Εσφαλμένη λειτουργία.
filewin32_setfilepointer(\\.\N:) SetFilePointer err Εσφαλμένη λειτουργία.
Warning: can't get size for \\.\N:
filewin32_getfilesize(\\.\O:) GetFileSize err Εσφαλμένη λειτουργία.
filewin32_setfilepointer(\\.\O:) SetFilePointer err Εσφαλμένη λειτουργία.
Warning: can't get size for \\.\O:
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WD WD10EZEX-08WN4A0, S/N:WD-WCC6Y1EAFHLE, FW:01.0
Disk /dev/sdb - 6001 GB / 5589 GiB - CHS 729601 255 63, sector size=512 - Seagate Backup+ Hub BK, S/N:NA9Q4NMH, FW:D781
Disk /dev/sdd - 5000 GB / 4657 GiB - CHS 76000 255 63, sector size=4096 - Intenso External USB 3.0, S/N:2016122910159, FW:1402
Disk \\.\PhysicalDrive3 - 5000 GB / 4657 GiB - CHS 76000 255 63, sector size=4096 - Intenso External USB 3.0, S/N:2016122910159, FW:1402
Drive D: - 4695 MB / 4478 MiB - CHS 1119 64 32, sector size=2048 - ATAPI iHAS120 X, FW:FL01
Drive I: - 5000 GB / 4657 GiB - CHS 75999 255 63, sector size=4096 - Intenso External USB 3.0, S/N:2016122910159, FW:1402
Partition table type (auto): Intel
Disk /dev/sdd - 5000 GB / 4657 GiB - Intenso External USB 3.0
Partition table type: Intel
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
1 P HPFS - NTFS 0 4 5 75999 254 63 1220939744
ntfs_boot_sector
1 P HPFS - NTFS 0 4 5 75999 254 63 1220939744
NTFS at 0/4/5
filesystem size 11797157940903298790 1220939744
sectors_per_cluster 148 1
mft_lcn 4025226182940823097 786432
mftmirr_lcn 16306854626075542534 2
clusters_per_mft_record 13 1
clusters_per_index_record -54 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 523593
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096
mft at 1348994
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096
mft at 1669493
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096
mft at 2003042
read_mft_info failed
ntfs_find_mft: sectors_per_cluster invalid
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 0
ntfs_find_mft: mft_record_size 4096
Failed to rebuild NTFS boot sector.
ntfs_boot_sector
1 P HPFS - NTFS 0 4 5 75999 254 63 1220939744
NTFS at 0/4/5
filesystem size 11797157940903298790 1220939744
sectors_per_cluster 148 1
mft_lcn 4025226182940823097 786432
mftmirr_lcn 16306854626075542534 2
clusters_per_mft_record 13 1
clusters_per_index_record -54 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Should I continue through "RebuildBS, List. If you can see your files, choose Write, confirm, Quit and restart your computer." or should I do something else?
Should I backup the files that have been found with Deep Scan by a Data Recovery software before proceeding, (Only 1/3 of the files are found and could be recovered by the Data Recovery Software).
Your advice would be much appreciated. Thank you