Back down the rabbit hole

Message

skitsnygg · #1 Post by **skitsnygg** » 25 Jun 2020, 21:28

I have a 3TB WD external drive that my girlfriend knocked off a table (and likely disconnected) from the computer (os x) about three years ago. I have dove in to trying to recover the contents unsuccessfully a number of times so before starting again, I'd like to take a different approach and ask here. I''ve scoured the boards and read a plethora of information but wanted to confirm if I should be using intel (which was detected) or EFI? I know mac uses EFI for partition type and the log lists 1 EFI partition but I don't want to cancel this scan (intel) if it's not necessary as it's at 90% and it's taken me about a week to get this far as my roommates are blasting air conditioners and my building is old so the breaker keeps flipping off. If I remember correctly, the drive had 3 partitions, one was about 2TB and encrypted, a CCC backup partition (which would definitely explain the EFI) and I believe one other but I can't remember what was on it. I believe all three partitions should have been formatted HFS+. I just ran drivedx and it's showing the drive is failing with 24 pending sectors, when I ran it the other day it said status was OK. While I would love to have all the files off of this drive (it contains ~15 years of my life and I have no backup) I simply cannot wait for a ddrescue clone as the last time I tried while the partitions were still being recognized about a year and a half ago it was estimated to take over a year (I want to say three). Please advise what my best option is here, is this a pointless endeavor? Should I cancel the current scan and re-run using EFI? I'm attaching screenshots of drivedx as well as the current testdisk output. Log is below:

Code: Select all

Wed Jun 24 15:10:06 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 19.5.0 (Darwin Kernel Version 19.5.0: Tue May 26 20:41:44 PDT 2020; root:xnu-6153.121.2~2/RELEASE_X86_64) x86_64
Compiler: GCC 4.2
ext2fs lib: none, ntfs lib: none, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.7
Hard disk list
Disk /dev/disk0 - 250 GB / 232 GiB - 488397168 sectors (RO), sector size=512
Disk /dev/disk1 - 240 GB / 223 GiB - 468862128 sectors (RO), sector size=512
Disk /dev/disk4 - 3000 GB / 2794 GiB - 5860467633 sectors, sector size=512
Disk /dev/rdisk0 - 250 GB / 232 GiB - 488397168 sectors (RO), sector size=512
Disk /dev/rdisk1 - 240 GB / 223 GiB - 468862128 sectors (RO), sector size=512
Disk /dev/rdisk2 - 249 GB / 232 GiB - 60998436 sectors (RO), sector size=4096
Disk /dev/rdisk3 - 239 GB / 222 GiB - 58397831 sectors (RO), sector size=4096
Disk /dev/rdisk4 - 3000 GB / 2794 GiB - 5860467633 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/rdisk4 - 3000 GB / 2794 GiB
Partition table type: Intel

Analyse Disk /dev/rdisk4 - 3000 GB / 2794 GiB - 5860467633 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=1 1339
check_part_i386 1 type EE: no test
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 P EFI GPT                        1  732558335  732558335

Warning: Bad starting sector (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/rdisk4 - 3000 GB / 2794 GiB - 5860467633 sectors
BAD_RS LBA=3899900526 487
check_part_i386 failed for partition type 01
     FAT12                 3899900526 4045672820  145772295
BAD_RS LBA=7289034735 868
check_part_i386 failed for partition type 07
     HPFS - NTFS           7289034735 7697615422  408580688
This partition ends after the disk limits. (start=7289034735, size=408580688, end=7697615422, disk end=5860467633)
BAD_RS LBA=7877319339 1109
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            7877319339 10214629774 2337310436
This partition ends after the disk limits. (start=7877319339, size=2337310436, end=10214629774, disk end=5860467633)
BAD_RS LBA=7786237794 805
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                 7786237794 11854746134 4068508341
This partition ends after the disk limits. (start=7786237794, size=4068508341, end=11854746134, disk end=5860467633)
BAD_RS LBA=8233355776 289
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             8233355776 11100731871 2867376096
This partition ends after the disk limits. (start=8233355776, size=2867376096, end=11100731871, disk end=5860467633)
BAD_RS LBA=7090313893 445
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA             7090313893 9543457839 2453143947
This partition ends after the disk limits. (start=7090313893, size=2453143947, end=9543457839, disk end=5860467633)
BAD_RS LBA=4270013704 822
check_part_i386 failed for partition type 01
     FAT12                 4270013704 8502432883 4232419180
This partition ends after the disk limits. (start=4270013704, size=4232419180, end=8502432883, disk end=5860467633)
BAD_RS LBA=4687949076 268
check_part_i386 failed for partition type 0E
     FAT16 LBA             4687949076 4761448502   73499427
BAD_RS LBA=6642142478 612
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                 6642142478 9103067482 2460925005
This partition ends after the disk limits. (start=6642142478, size=2460925005, end=9103067482, disk end=5860467633)
BAD_RS LBA=8198211103 693
check_part_i386 failed for partition type 07
     HPFS - NTFS           8198211103 11509242939 3311031837
This partition ends after the disk limits. (start=8198211103, size=3311031837, end=11509242939, disk end=5860467633)
BAD_RS LBA=8951926337 1169
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA             8951926337 10593035981 1641109645
This partition ends after the disk limits. (start=8951926337, size=1641109645, end=10593035981, disk end=5860467633)
BAD_RS LBA=6794221398 338
check_part_i386 failed for partition type 07
     HPFS - NTFS           6794221398 10937552566 4143331169
This partition ends after the disk limits. (start=6794221398, size=4143331169, end=10937552566, disk end=5860467633)
BAD_RS LBA=8355091735 588
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                 8355091735 11716184430 3361092696
This partition ends after the disk limits. (start=8355091735, size=3361092696, end=11716184430, disk end=5860467633)
BAD_RS LBA=5697254494 627
check_part_i386 failed for partition type 0B
     FAT32                 5697254494 8843229160 3145974667
This partition ends after the disk limits. (start=5697254494, size=3145974667, end=8843229160, disk end=5860467633)
BAD_RS LBA=5209364167 696
check_part_i386 failed for partition type 0B
     FAT32                 5209364167 7906636606 2697272440
This partition ends after the disk limits. (start=5209364167, size=2697272440, end=7906636606, disk end=5860467633)
BAD_RS LBA=8695842268 634
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 06
     FAT16 >32M            8695842268 8877981406  182139139
This partition ends after the disk limits. (start=8695842268, size=182139139, end=8877981406, disk

#2 Post by **cgrenier** » 27 Jun 2020, 09:04

As your disk has bad sectors, you should clone your disk to a new empty disk using ddrescue.
It's really not a good idea to work on this damaged disk.
Once it's done, remove the original disk and try to recover your data from the clone.

Back down the rabbit hole

Back down the rabbit hole

Re: Back down the rabbit hole