I have conduct a quick search and found the only partition avaiable. I checked and all files are there. trying to write does not do anithing, it states " reboot needed for changes to take effect" but after reboot nothing has happened.
What I am missing? Is this the correct procedure to recover a partition?
Note: it's an external HDD
Sun Jun 26 16:28:54 2022
Command line: TestDisk
TestDisk 7.2-WIP, Data Recovery Utility, June 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=999538088960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1000186314752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=1000202043392
Hard disk list
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000DM010-2EP102, S/N:ZN1T99CC, FW:CC46
Disk \\.\PhysicalDrive1 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - CT1000P5SSD8, S/N:0000_0000_0000_0001_00A0_7521_30B7_A15A., FW:P4CR311
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - TOSHIBA External USB 3.0, S/N:F27302080805102
Partition table type (auto): Intel
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - TOSHIBA External USB 3.0
Partition table type: Intel
Analyse Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
search_part()
Disk \\.\PhysicalDrive2 - 1000 GB / 931 GiB - CHS 121601 255 63
file_win32_pread(400,16,buffer,158(0/2/33)) read err: read after end of file
file_win32_pread(400,1,buffer,160(0/2/35)) read err: read after end of file
file_win32_pread(400,16,buffer,3119(0/49/33)) read err: read after end of file
file_win32_pread(400,1,buffer,3120(0/49/34)) read err: read after end of file
NTFS at 0/32/33
filesystem size 1953519616
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Results
* HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
NTFS, blocksize=4096, 1000 GB / 931 GiB
NTFS filesystem needs to be repaired.
dir_partition inode=5
* HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
NTFS, blocksize=4096, 1000 GB / 931 GiB
Directory /
5 dr-xr-xr-x 0 0 0 19-Feb-2021 15:48 .
5 dr-xr-xr-x 0 0 0 19-Feb-2021 15:48 ..
40 dr-xr-xr-x 0 0 0 14-Dec-2019 19:00 $RECYCLE.BIN
423040 dr-xr-xr-x 0 0 0 14-Dec-2019 20:05 LAUREA STUFANIA
410024 dr-xr-xr-x 0 0 0 10-Dec-2019 23:01 Matteo documenti
472256 dr-xr-xr-x 0 0 0 19-Jan-2021 20:14 P30 STEFI
475587 dr-xr-xr-x 0 0 0 19-Jan-2021 20:01 P30 STEGI
35 dr-xr-xr-x 0 0 0 7-Jul-2017 00:11 System Volume Information
376287 dr-xr-xr-x 0 0 0 16-Dec-2019 22:55 The Bunker
19 dr-xr-xr-x 0 0 0 19-Feb-2021 22:13 found.000
368072 dr-xr-xr-x 0 0 0 11-Dec-2019 21:26 inge
48 dr-xr-xr-x 0 0 0 9-Dec-2019 21:31 stefy I
385086 dr-xr-xr-x 0 0 0 9-Aug-2019 15:24 stefy II
383612 dr-xr-xr-x 0 0 0 22-Sep-2018 18:21 stefy III
385314 dr-xr-xr-x 0 0 0 28-Jul-2020 21:27 stefy IV
373812 dr-xr-xr-x 0 0 0 19-Jan-2016 19:44 stefy V
376256 dr-xr-xr-x 0 0 0 15-Dec-2019 22:36 tech
366617 dr-xr-xr-x 0 0 0 11-Dec-2019 20:49 teo il picio
423174 dr-xr-xr-x 0 0 0 4-Jan-2020 17:45 the dumpster
39 -r--r--r-- 0 0 1772495 8-May-2014 02:54 TOSHIBA CANVIO BASICS.PDF
376255 -r--r--r-- 0 0 29 7-Nov-2016 22:01 autorun.inf
43 -r--r--r-- 0 0 9662 29-Dec-2015 14:37 stefy.ico
43 -r--r--r-- 0 0 26 29-Dec-2015 14:37 stefy.ico:Zone.Identifier
46 -r--r--r-- 0 0 15798 29-Dec-2015 14:34 stefy.jpg
interface_write()
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
interface_write()
1 * HPFS - NTFS 0 32 33 121601 25 24 1953519616 [TOSHIBA EXT]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
TestDisk exited normally.
write mbr does not to anything
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: write mbr does not to anything
You missed to describe the status quo. What exactly do you expect to happen? I can't understand why so many people believe I have a crystal ball.DucaDiMonteSberna wrote: ↑26 Jun 2022, 15:49 I have conduct a quick search and found the only partition avaiable. I checked and all files are there. trying to write does not do anithing, it states " reboot needed for changes to take effect" but after reboot nothing has happened.
You might require running the chkdsk command but because of your missing problem description this is only a guess. As you can't reverse the actions of chkdsk I recommend duplicating the drive using ddrescue as described in the manual.
What I am missing? Is this the correct procedure to recover a partition?
Note: it's an external HDD
Sun Jun 26 16:28:54 2022
Command line: TestDisk
...
NTFS filesystem needs to be repaired.
...
The safest way is to try to copy the content to another drive from within Testdisk.
Have a look at the blueish list of questions to get an idea what should be contained in an incident description:
viewtopic.php?t=12055
-
- Posts: 2
- Joined: 26 Jun 2022, 15:22
Re: write mbr does not to anything
1.Which operating systems can be booted from your computer where the incident happened?
none, i just use it for storage
2. Which version of Testdisk do you use?
7.2
3.Do you prevent/reduce write access to the failed drive/file system?
no
4. If yes, how is that done?
/
5. Is the broken drive a drive where an operating system resides on or is it a data drive?
data drive
6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?
hdd
7. What is the size of your disk?
1tb
8. Who is the maker of your failed drive?
toshiba
9. What is the model?
10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
housing + cable
11. If possible, provide a logfile from smartmontools!
Instructions:
/
12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
mbr
13. How many partitions have been on the broken drive, what was their size, what was their file system?
1 single partition
14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
yes
15. Is the partition scheme containing your partitions still visible?
diskmanagement sees one partition as "RAW"
14. Describe the supposed event when your system went from "OK" to "broken"!
I was copying files between 2 external HDDs, lost both of them
15. Is your disk showing signs of failures such as
-clicking noises yes
16. Do you use encryption, if yes, which one?
no
17. If you use encryption, what is the scope?
/
I was expecting after the write that the unit was repaired and be able to be read again, but is not. What write MBR was supposed to do?
none, i just use it for storage
2. Which version of Testdisk do you use?
7.2
3.Do you prevent/reduce write access to the failed drive/file system?
no
4. If yes, how is that done?
/
5. Is the broken drive a drive where an operating system resides on or is it a data drive?
data drive
6. What technology is your disk (HDD, SDD, USB stick, Compact Flash card, SD card,...)?
hdd
7. What is the size of your disk?
1tb
8. Who is the maker of your failed drive?
toshiba
9. What is the model?
10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
housing + cable
11. If possible, provide a logfile from smartmontools!
Instructions:
/
12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
mbr
13. How many partitions have been on the broken drive, what was their size, what was their file system?
1 single partition
14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
yes
15. Is the partition scheme containing your partitions still visible?
diskmanagement sees one partition as "RAW"
14. Describe the supposed event when your system went from "OK" to "broken"!
I was copying files between 2 external HDDs, lost both of them
15. Is your disk showing signs of failures such as
-clicking noises yes
16. Do you use encryption, if yes, which one?
no
17. If you use encryption, what is the scope?
/
I was expecting after the write that the unit was repaired and be able to be read again, but is not. What write MBR was supposed to do?
-
- Posts: 2729
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: write mbr does not to anything
I can't understand why people fail to give necessary information even when being asked explicitly.
Unsufficient answer.10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?
housing + cable
Very useful in this case where the drive is making strange clicking noises.
11. If possible, provide a logfile from smartmontools!
Instructions:
Writing the MBR that includes partition table data only makes lost partitions visible again.
12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)
mbr
13. How many partitions have been on the broken drive, what was their size, what was their file system?
1 single partition
14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)
yes
15. Is the partition scheme containing your partitions still visible?
diskmanagement sees one partition as "RAW"
14. Describe the supposed event when your system went from "OK" to "broken"!
I was copying files between 2 external HDDs, lost both of them
15. Is your disk showing signs of failures such as
-clicking noises yes
16. Do you use encryption, if yes, which one?
no
17. If you use encryption, what is the scope?
/
I was expecting after the write that the unit was repaired and be able to be read again, but is not. What write MBR was supposed to do?
The clicking noises suggest duplicating the drive using ddrescue as described in the manual and rescuing from that physically healthy copy.