Cannot recover partition

[mattr]

Hi,
thanks for your help, i have read a few of the other posts from people having the same issue but i don't know if mine is similar, so instead of trying options without knowing what i'm doing, i'm posting my log here with hope that someone can help me.

Things to consider:

The disk is a 1TB Western Digital My Passport. I understand that the disks are automatically encrypted. What I did was to unlock it first, using WD_UNLOCKER, then I ran ddrescue to put the entire contents on a Toshiba 1TB drive. Because the Toshiba is the same size, ddrescue was not able to entirely copy the disk, only 99% of it. So that means when I put the drive in, there is a partition found because WD_UNLOCKER file is there. After it's unlocked, the unlocked drive is unusable.

Then I ran testdisk on the Toshiba drive copy, and I didn't go far.
I'm not sure if I should run testdisk on the original My Passport because of the encryption, or are the errors shown not related? Is it because the Toshiba only has 99% of the copy?

Thanks for your help!

Tue Feb 18 13:45:27 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=497866382336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM021-1KJ152, S/N:W62LA47Z, FW:0002YXM1
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20180525004283F, FW:5438
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - TOSHIBA External USB 3.0
Partition table type: Intel
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
Bad relative sector.
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525762(121601/90/28)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Results
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 65 2 121597 70 9 1953456128
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
BAD_RS LBA=1591320933 6200934
check_part_i386 failed for partition type 0C
FAT32 LBA 99055 37 28 282751 53 10 2951077231
This partition ends after the disk limits. (start=1591320933, size=2951077231, end=4542398163, disk end=1953525164)
BAD_RS LBA=4598211085 6557393
file_pread(5,1,buffer,4598211085(286225/102/35)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
This partition ends after the disk limits. (start=4598211085, size=3225196828, end=7823407912, disk end=1953525164)
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4005 GB / 3730 GiB)
The following partitions can't be recovered:
FAT32 LBA 99055 37 28 282751 53 10 2951077231
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 0 65 2 121597 70 9 1953456128
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
Change partition type:
HPFS - NTFS 0 65 2 121597 70 9 1953456128
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS at 0/32/33
filesystem size 1 1953519616
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.

[recuperation]

The disk is a 1TB Western Digital My Passport. I understand that the disks are automatically encrypted. What I did was to unlock it first, using WD_UNLOCKER, then I ran ddrescue to put the entire contents on a Toshiba 1TB drive. Because the Toshiba is the same size, ddrescue was not able to entirely copy the disk, only 99% of it. So that means when I put the drive in, there is a partition found because WD_UNLOCKER file is there. After it's unlocked, the unlocked drive is unusable.

Please show your ddrescue command string.

[mattr]

ddrescue --force /dev/sdc /dev/sdb

/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.

I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.

I also ran gsmartcontrol and there were no errors.

Thank you

[recuperation]

ddrescue --force /dev/sdc /dev/sdb

/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.

I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.

I also ran gsmartcontrol and there were no errors.

Thank you

There is no WD drive in your log file!
If you copy directly from device to device ddrescue is copying sector-wise.
The target has to be at least as large as the source.
Depending on how your virtualized environment redirects such a transaction into a file (on your target???) you need additional space.

I have only little experience with virtualized environments. I personally would avoid that additional operating system layer in case of recovery.

Use a logfile when running ddrescue.

[recuperation]

ddrescue --force /dev/sdc /dev/sdb

/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.

I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.

I also ran gsmartcontrol and there were no errors.

Thank you

There is no WD drive in your log file!
If you copy directly from device to device ddrescue is copying sector-wise.
The target has to be at least as large as the source.

In a real (not virtual) environment a target that is having the same size as the source is sufficiently large.

Depending on how your virtualized environment redirects such a transaction into a file (on your target???) you need additional space.

I have only little experience with virtualized environments. I personally would avoid that additional operating system layer in case of recovery.

[mattr]

Hi,
the log file was created with testdisk running on the Toshiba after the ddrescue was done. I was under the impression that it's best not to disturb the broken disk too much that's why i made the copy. I will try to copy again to a larger drive, or do you suggest I run testdisk directly on the WD after I unlock it and therefore avoid the ddrescue part?

Thanks!

[recuperation]

Hi,
the log file was created with testdisk running on the Toshiba after the ddrescue was done.

ddrescue has its own logfile that enables you to pause and continue the duplication process.

I was under the impression that it's best not to disturb the broken disk too much that's why i made the copy. I will try to copy again to a larger drive, or do you suggest I run testdisk directly on the WD after I unlock it and therefore avoid the ddrescue part?

Thanks!

Thanks for explaining what your real problem is as this thread started as a copy job problem.
Don't stress a possibly broken drive.
By duplicating the drive you simultaneously solve the encryption issue and the health issue.

[mattr]

Hi,
the log i sent in my first post was the log of testdisk running against the copy, on the Toshiba, I was trying to recover the partitions I lost on the WD. I will try again with a larger disk to make sure ddrescue has enough space to copy the WD to a new disk.

[recuperation]

Duplicate the whole drive.