USB drive is RAW (Windows asks to format)

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
adsct
Posts: 3
Joined: 05 May 2022, 05:26

USB drive is RAW (Windows asks to format)

#1 Post by adsct »

Hello,

I have a 64GB USB drive from a family member that Windows says needs to be formatted (which was canceled when prompted). The user says that the drive was probably removed from the computer before it fully shut down (this is when the problem started).

The disk file system shows as RAW in Windows Disk Management. Using TestDisk 7.1, I tried to follow the RAW step by step example, but I see different information than the example shows. I went to Analyze / Quick Search and it only lists invalid partitions. I then run the Deeper Search. The log shows the following results:

Code: Select all

Partition table type (auto): Intel
Disk /dev/sdb - 62 GB / 58 GiB - Specific STORAGE DEVICE
Partition table type: Intel

Analyse Disk /dev/sdb - 62 GB / 58 GiB - CHS 7648 255 63
Geometry from i386 MBR: head=237 sector=12
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or exFAT boot
 1 P HPFS - NTFS              0   1  2  7648 236 12  122879936
 1 P HPFS - NTFS              0   1  2  7648 236 12  122879936
No partition is bootable

search_part()
Disk /dev/sdb - 62 GB / 58 GiB - CHS 7648 255 63
     HPFS - NTFS             17 216  8  7666 196 18  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
This partition ends after the disk limits. (start=286720, size=122879936, end=123166655, disk end=122880000)
     HPFS - NTFS             18 123 42  7667 103 52  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
This partition ends after the disk limits. (start=296960, size=122879936, end=123176895, disk end=122880000)
     HPFS - NTFS             19 161 15  7668 141 25  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
This partition ends after the disk limits. (start=315392, size=122879936, end=123195327, disk end=122880000)
file_pread(5,2,buffer,122879999(7648/236/12)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,122880000(7648/236/13)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,122880001(7648/236/14)) lseek err Invalid argument
file_pread(5,14,buffer,122880002(7648/236/15)) lseek err Invalid argument
file_pread(5,3,buffer,122880016(7648/236/29)) lseek err Invalid argument
file_pread(5,3,buffer,122880063(7648/237/13)) lseek err Invalid argument
file_pread(5,8,buffer,122880079(7648/237/29)) lseek err Invalid argument
file_pread(5,11,buffer,122880126(7648/238/13)) lseek err Invalid argument
file_pread(5,2,buffer,122882048(7649/13/45)) lseek err Invalid argument
Disk /dev/sdb - 62 GB / 58 GiB - CHS 7648 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (62 GB / 58 GiB) seems too small! (< 63 GB / 58 GiB)
The following partitions can't be recovered:
     HPFS - NTFS             17 216  8  7666 196 18  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
     HPFS - NTFS             18 123 42  7667 103 52  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
     HPFS - NTFS             19 161 15  7668 141 25  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 62 GB / 58 GiB - CHS 7648 255 63
     HPFS - NTFS             17 216  8  7666 196 18  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
This partition ends after the disk limits. (start=286720, size=122879936, end=123166655, disk end=122880000)
     HPFS - NTFS             18 123 42  7667 103 52  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
This partition ends after the disk limits. (start=296960, size=122879936, end=123176895, disk end=122880000)
     HPFS - NTFS             19 161 15  7668 141 25  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
This partition ends after the disk limits. (start=315392, size=122879936, end=123195327, disk end=122880000)
file_pread(5,2,buffer,122879999(7648/236/12)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,122880000(7648/236/13)) ReadFile The drive cannot find the sector requested.

file_pread(5,1,buffer,122880001(7648/236/14)) lseek err Invalid argument
file_pread(5,14,buffer,122880002(7648/236/15)) lseek err Invalid argument
file_pread(5,3,buffer,122880016(7648/236/29)) lseek err Invalid argument
file_pread(5,3,buffer,122880063(7648/237/13)) lseek err Invalid argument
file_pread(5,8,buffer,122880079(7648/237/29)) lseek err Invalid argument
file_pread(5,11,buffer,122880126(7648/238/13)) lseek err Invalid argument
file_pread(5,2,buffer,122882048(7649/13/45)) lseek err Invalid argument
Disk /dev/sdb - 62 GB / 58 GiB - CHS 7648 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (62 GB / 58 GiB) seems too small! (< 63 GB / 58 GiB)
The following partitions can't be recovered:
     HPFS - NTFS             17 216  8  7666 196 18  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
     HPFS - NTFS             18 123 42  7667 103 52  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB
     HPFS - NTFS             19 161 15  7668 141 25  122879936
     exFAT, blocksize=131072, 62 GB / 58 GiB

Results

interface_write()
 
No partition found or selected for recovery
If I go to Advanced and select Boot, I see the following information:

Code: Select all

Interface Advanced
Geometry from i386 MBR: head=237 sector=12
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0   1  2  7648 236 12  122879936

ntfs_boot_sector
 1 P HPFS - NTFS              0   1  2  7648 236 12  122879936
filesystem size           8079490062298770897 6323892405946713979
sectors_per_cluster       228 15
mft_lcn                   5344899223434726497 2676746074343047811
mftmirr_lcn               10362252849789950668 8250574942327510625
clusters_per_mft_record   -57 -48
clusters_per_index_record -53 -120
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Interface Advanced
Geometry from i386 MBR: head=237 sector=12
check_part_i386 failed for partition type 07
 1 P HPFS - NTFS              0   1  2  7648 236 12  122879936

ntfs_boot_sector
 1 P HPFS - NTFS              0   1  2  7648 236 12  122879936
filesystem size           8079490062298770897 6323892405946713979
sectors_per_cluster       228 15
mft_lcn                   5344899223434726497 2676746074343047811
mftmirr_lcn               10362252849789950668 8250574942327510625
clusters_per_mft_record   -57 -48
clusters_per_index_record -53 -120
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Can someone give me direction on the next steps? Is there some kind of disk geometry problem?
Last edited by adsct on 05 May 2022, 06:42, edited 1 time in total.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: USB drive is RAW (Windows asks to format)

#2 Post by recuperation »

Please use the most recent version of Testdisk which is 7.2. I never heard of a software called "Testfile".
If you are referring to Testdisk instead do me a favour and correct your posting, thank you.

Please run deep search in addition to quick search and post the results.

adsct
Posts: 3
Joined: 05 May 2022, 05:26

Re: USB drive is RAW (Windows asks to format)

#3 Post by adsct »

Yes, it was TestDisk 7.1, sorry for the typo. I fixed it in the original post. I used 7.1 since it was the latest stable version, but I did get 7.2 at your request. Here are the results of the deep search:

Code: Select all

Disk \\.\PhysicalDrive1 - 62 GB / 58 GiB - CHS 7648 255 63

The hard disk (62 GB / 58 GiB) seems too small! (< 63 GB / 58 GiB)
Check the hard disk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
    Partition               Start        End    Size in sectors
>  HPFS - NTFS             17 216  8  7666 196 18  122879936
    HPFS - NTFS             18 123 42  7667 103 52  122879936
    HPFS - NTFS             19 161 15  7668 141 25  122879936                                                                                                                                                                                                                                                           
I'm also attaching the full log file with both the quick and deep search information.
testdisk.log
(2.94 KiB) Downloaded 154 times

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: USB drive is RAW (Windows asks to format)

#4 Post by recuperation »

Use the "p"-key ("list files") to look into each partition to find content to recover.
If that does not work, use Photorec or any third party software.

adsct
Posts: 3
Joined: 05 May 2022, 05:26

Re: USB drive is RAW (Windows asks to format)

#5 Post by adsct »

Are you referring to the List Files option under the Advanced section? I tried that and it says "Can't open filesystem. File system seems damaged."

I did use Photorec and was able to recover a bunch of files. There are nine "recup_dir" folders containing the files. I''m not sure if these correspond to nine directories that previously existed (just without the directory names). I will talk to the user at this point and see what they can identify.
list_files.PNG
list_files.PNG (22.13 KiB) Viewed 3365 times
If this is the best that it can be, then thank you so much for your help. If you think there is anything else I can try to repair the original file system, please let me know.

Thanks again!

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: USB drive is RAW (Windows asks to format)

#6 Post by recuperation »

adsct wrote: 05 May 2022, 13:35 Are you referring to the List Files option under the Advanced section? I tried that and it says "Can't open filesystem. File system seems damaged."
No. It appears during quick search and deep search. Look at the screens:

https://www.cgsecurity.org/wiki/TestDis ... partitions

I did use Photorec and was able to recover a bunch of files. There are nine "recup_dir" folders containing the files. I''m not sure if these correspond to nine directories that previously existed (just without the directory names).
No, they do not.
If this is the best that it can be, then thank you so much for your help. If you think there is anything else I can try to repair the original file system, please let me know.
You can get yourself a hex editor, learn the inner structure of the file system in question and search for remains of metadata in a programming language of your choice.
You can extract additional information from your "family member" by asking lots of questions and take this information into account.
You can use that information for recovery.

Apart from some defined operations with a limited scope that Testdisk does, "repairing" a file system is not professional. Recovering to an external location is professional, however.

Locked