Hi,
thanks for your help, i have read a few of the other posts from people having the same issue but i don't know if mine is similar, so instead of trying options without knowing what i'm doing, i'm posting my log here with hope that someone can help me.
Things to consider:
The disk is a 1TB Western Digital My Passport. I understand that the disks are automatically encrypted. What I did was to unlock it first, using WD_UNLOCKER, then I ran ddrescue to put the entire contents on a Toshiba 1TB drive. Because the Toshiba is the same size, ddrescue was not able to entirely copy the disk, only 99% of it. So that means when I put the drive in, there is a partition found because WD_UNLOCKER file is there. After it's unlocked, the unlocked drive is unusable.
Then I ran testdisk on the Toshiba drive copy, and I didn't go far.
I'm not sure if I should run testdisk on the original My Passport because of the encryption, or are the errors shown not related? Is it because the Toshiba only has 99% of the copy?
Thanks for your help!
Tue Feb 18 13:45:27 2020
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 7.4, Cygwin 3000.3
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204883968
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=497866382336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST500LM021-1KJ152, S/N:W62LA47Z, FW:0002YXM1
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:20180525004283F, FW:5438
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - TOSHIBA External USB 3.0
Partition table type: Intel
Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
Bad relative sector.
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,14,buffer,1953525762(121601/90/28)) lseek err Invalid argument
file_pread(5,3,buffer,1953525776(121601/90/42)) lseek err Invalid argument
file_pread(5,3,buffer,1953525823(121601/91/26)) lseek err Invalid argument
file_pread(5,8,buffer,1953525839(121601/91/42)) lseek err Invalid argument
file_pread(5,11,buffer,1953525886(121601/92/26)) lseek err Invalid argument
file_pread(5,2,buffer,1953527808(121601/122/58)) lseek err Invalid argument
Results
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
* HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 * HPFS - NTFS 0 65 2 121597 70 9 1953456128
search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
BAD_RS LBA=4096 2048
check_part_i386 failed for partition type 07
HPFS - NTFS 0 65 2 121597 70 9 1953456128
BAD_RS LBA=1591320933 6200934
check_part_i386 failed for partition type 0C
FAT32 LBA 99055 37 28 282751 53 10 2951077231
This partition ends after the disk limits. (start=1591320933, size=2951077231, end=4542398163, disk end=1953525164)
BAD_RS LBA=4598211085 6557393
file_pread(5,1,buffer,4598211085(286225/102/35)) lseek err Invalid argument
check_part_i386 failed for partition type 07
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
This partition ends after the disk limits. (start=4598211085, size=3225196828, end=7823407912, disk end=1953525164)
NTFS at 121601/25/24
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
file_pread(5,2,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,1,buffer,1953525759(121601/90/25)) lseek err Invalid argument
file_pread(5,2,buffer,1953525760(121601/90/26)) lseek err Invalid argument
file_pread(5,1,buffer,1953525760(121601/90/26)) lseek err Invalid argument
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 4005 GB / 3730 GiB)
The following partitions can't be recovered:
FAT32 LBA 99055 37 28 282751 53 10 2951077231
HPFS - NTFS 286225 102 35 486984 157 62 3225196828
Results
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
HPFS - NTFS 0 65 2 121597 70 9 1953456128
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Input/output error.
$MFT has invalid magic.
ntfs_mft_load(): Failed.
Failed to load $MFT: Input/output error.
Failed to startup volume: Invalid argument.
Not an exFAT boot sector.
HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS found using backup sector, blocksize=4096, 1000 GB / 931 GiB
Can't open filesystem. Filesystem seems damaged.
Not an exFAT boot sector.
HPFS - NTFS 0 65 2 121597 70 9 1953456128
Can't open filesystem. Filesystem seems damaged.
Change partition type:
HPFS - NTFS 0 65 2 121597 70 9 1953456128
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 63
check_part_i386 failed for partition type 07
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
ntfs_boot_sector
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616
NTFS at 0/32/33
filesystem size 1 1953519616
sectors_per_cluster 0 8
mft_lcn 0 786432
mftmirr_lcn 0 2
clusters_per_mft_record 0 -10
clusters_per_index_record 0 1
Boot sector
Status: Bad
Backup boot sector
Status: OK
Sectors are not identical.
A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
TestDisk exited normally.
Cannot recover partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 3035
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Cannot recover partition
Please show your ddrescue command string.mattr wrote: 19 Feb 2020, 18:35 The disk is a 1TB Western Digital My Passport. I understand that the disks are automatically encrypted. What I did was to unlock it first, using WD_UNLOCKER, then I ran ddrescue to put the entire contents on a Toshiba 1TB drive. Because the Toshiba is the same size, ddrescue was not able to entirely copy the disk, only 99% of it. So that means when I put the drive in, there is a partition found because WD_UNLOCKER file is there. After it's unlocked, the unlocked drive is unusable.
Re: Cannot recover partition
ddrescue --force /dev/sdc /dev/sdb
/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.
I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.
I also ran gsmartcontrol and there were no errors.
Thank you
/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.
I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.
I also ran gsmartcontrol and there were no errors.
Thank you

-
- Posts: 3035
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Cannot recover partition
There is no WD drive in your log file!mattr wrote: 20 Feb 2020, 02:37 ddrescue --force /dev/sdc /dev/sdb
/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.
I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.
I also ran gsmartcontrol and there were no errors.
Thank you![]()
If you copy directly from device to device ddrescue is copying sector-wise.
The target has to be at least as large as the source.
Depending on how your virtualized environment redirects such a transaction into a file (on your target???) you need additional space.
I have only little experience with virtualized environments. I personally would avoid that additional operating system layer in case of recovery.
Use a logfile when running ddrescue.
Last edited by recuperation on 20 Feb 2020, 08:35, edited 1 time in total.
-
- Posts: 3035
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Cannot recover partition
There is no WD drive in your log file!mattr wrote: 20 Feb 2020, 02:37 ddrescue --force /dev/sdc /dev/sdb
/dev/sdc is the WD My Passport
/dev/sdb is the Toshiba.
I didn't add any parameter, I ran it under a virtualbox running peppermint, it was showing 0 read errors, 99% done because of lack of disk space. I understand that I need 5% more than the original disk so I was wondering if this was my issue with testdisk, or if it was not related. I can redo the ddrescue with a log and parameters if needed.
I also ran gsmartcontrol and there were no errors.
Thank you![]()
If you copy directly from device to device ddrescue is copying sector-wise.
The target has to be at least as large as the source.
In a real (not virtual) environment a target that is having the same size as the source is sufficiently large.
Depending on how your virtualized environment redirects such a transaction into a file (on your target???) you need additional space.
I have only little experience with virtualized environments. I personally would avoid that additional operating system layer in case of recovery.
Re: Cannot recover partition
Hi,
the log file was created with testdisk running on the Toshiba after the ddrescue was done. I was under the impression that it's best not to disturb the broken disk too much that's why i made the copy. I will try to copy again to a larger drive, or do you suggest I run testdisk directly on the WD after I unlock it and therefore avoid the ddrescue part?
Thanks!
the log file was created with testdisk running on the Toshiba after the ddrescue was done. I was under the impression that it's best not to disturb the broken disk too much that's why i made the copy. I will try to copy again to a larger drive, or do you suggest I run testdisk directly on the WD after I unlock it and therefore avoid the ddrescue part?
Thanks!
-
- Posts: 3035
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Cannot recover partition
ddrescue has its own logfile that enables you to pause and continue the duplication process.mattr wrote: 20 Feb 2020, 22:07 Hi,
the log file was created with testdisk running on the Toshiba after the ddrescue was done.
Thanks for explaining what your real problem is as this thread started as a copy job problem.I was under the impression that it's best not to disturb the broken disk too much that's why i made the copy. I will try to copy again to a larger drive, or do you suggest I run testdisk directly on the WD after I unlock it and therefore avoid the ddrescue part?
Thanks!
Don't stress a possibly broken drive.
By duplicating the drive you simultaneously solve the encryption issue and the health issue.
mattr
Hi,
the log i sent in my first post was the log of testdisk running against the copy, on the Toshiba, I was trying to recover the partitions I lost on the WD. I will try again with a larger disk to make sure ddrescue has enough space to copy the WD to a new disk.
the log i sent in my first post was the log of testdisk running against the copy, on the Toshiba, I was trying to recover the partitions I lost on the WD. I will try again with a larger disk to make sure ddrescue has enough space to copy the WD to a new disk.
-
- Posts: 3035
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Cannot recover partition
Duplicate the whole drive.