Guide on recovery please

[leetaxor]

Hello,
I have a 3TB HDD currently connected over USB with a handful of other disks.
This one has given up, the rest are ok.

If I go into Windows Disk Management it tells me the disk is uninitialised and asks whether to pick GPT or MRB - I haven't done anything yet, as I would like the data from the disk.
I've run Western Digital's tool which finds the disk and, although it doesn't have a Volume mounted on it, otherwise seems ok.

So I run test disk and get the following log entries;

Code: Select all

Wed Jun  5 09:18:40 2019
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, May 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sde)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdf)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdg)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=240057409536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=4000787030016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive4)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive5)=3000592982016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive6)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=239411920896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=239463301120
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396746752
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

F: is a DVD drive.
It's sdf that we're interested in - it's a 3TB drive with no volume on it.

Then I went into the basic information:

Code: Select all

Partition table type (auto): EFI GPT
Disk /dev/sdf - 3000 GB / 2794 GiB - ASMT ASM1156-PM
Partition table type: EFI GPT

Analyse Disk /dev/sdf - 3000 GB / 2794 GiB - CHS 364801 255 63
hdr_size=92
hdr_lba_self=5860533167
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=5860533134
hdr_lba_table=5860533135
hdr_entries=128
hdr_entsz=128
check_part_gpt failed for partition
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition] [ImportantDox]
Current partition structure:
Bad GPT partition, invalid signature.
Trying alternate GPT
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 1 P MS Reserved                   34     262177     262144 [Microsoft reserved partition]
 2 P MS Data                   264192 5860532223 5860268032 [Basic data partition] [ImportantDox]

But when I ran a basic search for partitions the program hung. Log file reveals IO errors:

Code: Select all

search_part()
Disk /dev/sdf - 3000 GB / 2794 GiB - CHS 364801 255 63
NTFS at 16/113/34
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=135266304, part_size=3000457232384, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 16/113/34
filesystem size           5860268032
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                   264192 5860532223 5860268032 [ImportantDox]
     NTFS, blocksize=4096, 3000 GB / 2794 GiB
file_pread(9,2,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(9,1,buffer,5860534272(364801/98/34)) lseek err Invalid argument
file_pread(9,2,buffer,5860534273(364801/98/35)) lseek err Invalid argument
[....]

So ok, the disk has some issues... This is WD, i'm used to disks dying.
How do I get it so that I can read the contents of the disk, in Windows, and transfer whatever is transferable out of the ImportantDox partition onto another disk?
I've read a couple of the guides on here but I'm unsure of what specifically to do. Any advice would be appreciated.

[cgrenier]

Run "cmd" (right click run as administrator"), use "cd testdisk-7.1-WIP" to go in testdisk directory and run "testdisk_win /safe".
If it doesn't hang anymore, you should be able to rewrite the partition table.
If it doesn't work, boot from a Linux (ie. fedora) live usb/dvd and try the linux version of testdisk.
If it's still not good, clone under Linux your disk to a new empty disk (bigger than 3 To) using ddrescue, remove the original disk and try testdisk on the clone.